Amidst a raging scandal, a leading Indian digital security firm has announced the shutting down of its global website authentication business. The ignominious exit will not only dent the company’s reputation but also of the country’s technology governance competence. The Bengaluru-based firm, eMudhra, will not be issuing security certificates that verify and authenticate websites as real. These are critical to preventing a wide range of cybersecurity threats, including website spoofing, impersonation and data theft.
The announcement comes in the wake of a massive security incident which was reported by an independent cybersecurity researcher, who revealed that a handful of certificates issued by eMudhra were susceptible to attack. Even an amateur hacker could crack their weak keys. Within hours of disclosure, global tech companies such as Google, Apple, Microsoft, and Mozilla moved swiftly to revoke eMudhra’s international intermediate certificates.
Even though the company claimed that there has not been any reported instance of data breach which exploited the vulnerabilities and caused financial loss, it is evident that the company’s reputation and trustworthiness has suffered a nearly irreparable damage at a global level.
The response of the company and the Indian government to the security disaster leaves much to be desired. Firstly, the vulnerability persisted over a period of 18 months and even survived two rounds of audits. It indicates the failure of the government agencies connected with its regulatory oversight. The government left the supervision and audits to third parties which are private international companies. This over-reliance on third-party audits is tantamount to abdication of responsibility and shirking accountability. After the damage is done, the Ministry of Electronics and Information Technology (MeitY) took a serious note of the incident and constituted a special team to investigate it.
Secondly, there has been a tendency to downplay the magnitude of a systemic failure by characterising it as a technical glitch or an isolated flaw. Such an approach rooted in denial and obfuscation will not be conducive to finding long-term solutions required to address systemic issues in a holistic manner. Cybersecurity experts have strongly criticised MeitY for resorting to gaslighting by lashing out at critics and accusing them of indulging in fear-mongering on social media. In the past decade, denial, evasive doublespeak and shooting the messenger have become a part of government’s SOP in the face of governance failures.
On the brighter side, Indian government did swing into action to isolate and insulate the domestic systems since eMudhra is deeply involved in the country’s e-governance systems such as taxation, Aadhaar, and other critical portals. On its part, eMudhra quickly revoked the affected certificate authorities. Indian Computer Emergency Response Team (CERT-In), the national cyber defence watchdog, issued a timely official advisory warning about the vulnerability and remedial measures to be undertaken.
The challenge is to take credible and effective steps to build trust in Indian technology systems and regulatory governance mechanisms. The government should abjure defensive and passive-aggressive posturing and be open to rigorous accountability. The government should consider having a unified body or agency dedicated to digital security which, among other things, will be responsible for overseeing and enforcing mandatory audits. Auditing agencies too should be held accountable in the event of a security lapse and imposition of professional and financial liabilities would discourage complacency and ensure rigour in audit.