CERT-In’s new directives + Google India’s new policy head

Why read this story?

Editor's note: Mahima here. The Indian Computer Emergency Response Team, better known as CERT-In, made waves when, a week ago, it released a set of directives that bowled over everyone from corporations to cybersecurity activists and experts. The directives sparked concerns over privacy and government surveillance, as well as compliance issues for industry. Much of it doesn’t seem to make sense. But more importantly, it genuinely looks like none of it can be enforced. There were six directives, of which four require special focus:  First, the synchronization with government-controlled time servers: Under this directive, CERT-In wants directed parties to synchronize their time servers with national servers like the Network Time Protocol Server of the National Informatics Centre or the National Physical Laboratory. Experts at the Internet Freedom Foundation pointed out that this is a necessary step to help with forensic investigations and filing incident reports. However, other cybersecurity experts I spoke to say that syncing servers can result in a host of latency or lag issues. Most of them were sceptical if Indian government time servers could handle the load.   Second, filing …