E-Vehicles and Data Privacy: Concerns and Considerations

Introduction

Iran stands as a nation poised at the threshold of a transformative era. The Islamic Republic, a land of ancient civilisations now grappling with the exigencies of the 21st century, is now making strides in the emerging field of artificial intelligence (AI). This is not merely an adoption of new tools; it is a strategic embrace, a calculated leap into the digital unknown, where the potential for economic growth and security enhancement resonates with the promise of a redefined future.

Embarking on this technological odyssey, Iranian President Ebrahim Raisi, in a conclave with the nation’s virtual business activists, delineated the ‘big steps’ being undertaken in the realm of AI. The gathering, as reported by the pro-government Tasnim News, was not a simple exchange of polite remarks but a profound discourse that offered an incisive overview of the burgeoning digital economy and the strides Iran is making in the AI landscape. The conversation deeply revolved around the current ecosystem of technology and innovation within Iran, delving into the burgeoning startup culture and the commendable drive within its youth populace to propel the nation to the forefront of technology.

Iranian AI Integration

Military Implications

The discourse ranged from the current technological infrastructure to the broader implications for the security and defense of the region. The Iranian polity, with its rich history that seamlessly blends with aspirations for the future, is acutely aware that the implications of AI reach far beyond mere economic growth. They extend into the very fibres of military might and the structure of national security. The investment in cyber capabilities in Iran is well-documented, a display of shrewdness and pragmatism. And the integration of AI technologies is the next logical step in an ever-evolving defense architecture. Brigadier General Alireza Sabahifard, Commander of the Iranian Army Air Defense Force, has underscored the pivotal role of AI in modern warfare. He identifies the ongoing adoption of AI technologies as a strategic imperative, a top priority fundamentally designed to elevate the air defense capabilities in Iran to meet 21st-century threats.

Economic Implications

Yet, the Iranian pursuit of AI is not solely confined to bolstering military prowess. It is also pervasive in nurturing economic opportunity. President Raisi’s rhetoric touches upon economic rejuvenation, job creation, and the proliferation of financial and legal support mechanisms, all blurred into a cohesive vision that would foster a suitable environment for the private sector in the AI domain. The ambition is grand and strikingly clear — a nation committed to training several thousand individuals in the digital economy sector, signaling a deep-rooted commitment to cultivating a healthy environment  for AI-driven innovation.

The Iranian leader’s vision extends beyond the simple creation of infrastructure. It extends to the fostering of a healthy, competitive, and peaceful social milieu where domestic and international markets are within easy reach, promoting the prosperity of the digital economy and its activists. Such a vision of technological symbiosis, in many Western democracies, would be labelled as audaciously progressive. In Iran, however, withdrawing a major chunk of economic investments from the country's security state adds layers of complexity and nuance to this transformative narrative.

Cultural Integration

Still, Iran’s ambitious AI journey unfolds with a recognition of its cultural underpinnings and societal structure. The Nexus between the private sector, with its cyber-technocratic visionaries, and the regime, with its omnipresent ties to the Islamic Revolutionary Guard Corps, is a tightrope that requires unparalleled poise and vigilance.

Moreover, in the holy city of Qom, a hub of intellectual fervour and the domicile of half of Iran's 200,000 Shia clerics, there burgeons a captivating interest in the possible synergies between AI and theological study. The clerical establishment, hidden within a stronghold of religious scholarship, perceives AI not as a problem but as a potential solution, a harbinger of progress that could ally with tradition. It sees in AI the potential of parsing Islamic texts with newfound precision, thereby allowing religious rulings, or fatwas, to resonate with the everchanging   Iranian society. This integration of technology is a testament to the dynamic interplay between tradition and modernity.

Yet the integration of AI into the venerable traditions of societies such as Iran's is threaded with challenges. Herein lays the paradox, for as AI is poised to potentially bolster religious study, the threat of cultural dissolution remains present. AI, if not judiciously designed with local values and ethics in mind, could inadvertently propagate an ideology at odds with local customs, beliefs, and the cornerstone principles of a society.

Natural Resources

Similarly, Iran's strategic foray into AI extends into its sovereign dominion—the charge of its natural resources. As Mehr News Agency reports, the National Iranian Oil Company (NIOC) is on the cusp of pioneering a joint venture with international tech juggernauts, chiefly Chinese companies, to inject the lifeblood of AI into the heart of its oil and gas production processes. This grand undertaking is nothing short of a digital renaissance aimed at achieving 'great reforms’ and driving a drastic 20% improvement in efficiency. AI’s algorithmic potency, unleashed in the hydrocarbon fields, promises to streamline expenses, enhance efficacy, and maximise production outputs, thereby bolstering Iran's economic bulwark.

The AI way Forward

As we delve further into Iran's sophisticated AI strategy, we observe an approach that is both vibrant and multi-dimensional. From military development to religious tutelage, from the diligent charge of the environment to the pursuit of sustainable economic development, Iran's AI ventures are emblematic of the broader global discourse. They mark a vivid intersection of AI governance, security, and the future of technological enterprise, highlighting the evolution of technological adoption and its societal, ethical, and geopolitical repercussions.

Conclusion

The multifaceted nature of Iran's AI pursuits encapsulates a spectrum of strategic imperatives, bringing the spearheads of defense modernisation and religious academics with the imperatives of resource allocation. It reflects a nuanced approach to the adoption and integration of technology, adjudicating between the venerable pillars of traditional values and the inexorable forces of modernisation. As Iran continues to delineate and traverse its path through the burgeoning landscape of AI, attending global stakeholders, watch with renewed interest and measured apprehension. Mindful of the intricate geopolitical implications and the transformative potential inherent in Iran's burgeoning AI endeavours, the global community watches, waits, and wonders at what may emerge from this ancient civilisation’s bold, resolute strides into the future.

References

- https://www.fdd.org/analysis/op_eds/2024/03/17/irans-president-wants-new-focus-on-artificial-intelligence/

- https://www.jpost.com/middle-east/article-792391

- https://www.ft.com/content/9c1c3fd3-4aea-40ab-977b-24fe5527300c

- https://www.foxnews.com/world/iran-looks-ai-weather-western-sanctions-help-military-fight-cheap

‍

Introduction

The whole world is shifting towards a cashless economy, with innovative payment transaction systems such as UPI payments, card payments, etc. These payment systems require processing, storage, and movement of millions of cardholders data which is crucial for any successful transaction.

And therefore to maintain the credibility of this payment ecosystem, security or secure movement and processing of cardholders data becomes paramount. Entities involved in a payment ecosystem are responsible for the security of cardholders data. Security is also important because if breaches happen in cardholders data it would amount to financial loss. Fraudsters are attempting smart ways to leverage any kind of security loopholes in the payment system.

So these entities which are involved in the payment ecosystem need to maintain some security standards set by one council of network providers in the payment industry popularly known as the Payment Card Industry Security Standard Council.

Overview of what is PCI and PCI DSS Compliance

Earlier every network providers in the payment industry have their own set of security standards but later they all together i.e., Visa, Mastercard, American Express, Discover, and JCB constituted an independent body to come up with comprehensive security standards like PCI DSS, PA DSS, PCI-PTS, etc.  And these network providers ensure the enforcement of the security standards by putting conditions on services being provided to the merchant or acquirer bank.

In other words, PCI DSS particularly is the global standard that provides a baseline of technical and operational requirements designed to protect account data. PCI DSS is a security standard specially designed for merchants and service providers in the payment ecosystem to protect the cardholders data against any fraud or theft.

It applies to all the entities including third-party vendors which are involved in processing storing and transmitting cardholders data. In organization, even all CDE (Card Holder Data Environment) including system components or network component that stores and process cardholders data, has to comply with all the requirements of PCI compliance.  Recently PCI has released a new version of PCI DSS v4.0 a few months ago with certain changes from the previous version after three years of the review cycle.

12 Requirements of PCI DSS

This is the most important part of PCI DSS as following these requirements can make any organization to some extent PCI compliant. So what are these requirements:

• Installing firewalls or maintaining security controls in the networks
• Use strong password in order to secure the CDE( Card holders data environment)
• Protection of cardholder data
• Encrypting the cardholder data during transmission over an open and public network.
• Timely detection and protection of the cardholders data environment from any malicious activity or software.
• Regular updating the software thereby maintaining a secure system.
• Rule of business need to know should apply to access the cardholders data
• Identification and authentication of the user are important to access the system components.
• Physical access to cardholders data should be restricted.
• Monitoring or screening of system components to know the malicious activity internally in real-time.
• Regular auditing of security control and finding any vulnerabilities available in the systems.
• Make policies and programs accordingly in order to support information security.

How organization can become PCI compliant

• Scope: First step is to determine all the system components or networks storing and processing cardholders data i.e., Cardholders Data Environment.
• Assess: Then test whether these systems or networks are complying with all the requirements of PCI DSS COMPLIANCE.
• Report: Documenting all the assessment through self assessment questionnaire by answering following questions like whether the requirements are met or not? Whether the requirements are met with customized approach.
• Attest: Then the next step is to complete the attestation process available on the website of PCI SSC.
• Submit: Then organization can submit all the documents including reports and other supporting documents if it is requested by other entities such as payment brands, merchant or acquirer.
• Remediate: Then the organisation should take remedial action for the requirements which are not in place on the system components or networks.

Conclusion

One of the most important issues facing those involved in the digital payment ecosystem is cybersecurity. The likelihood of being exposed to cybersecurity hazards including online fraud, information theft, and virus assaults is rising as more and more users prefer using digital payments.

And thus complying and adopting with these security standards is the need of the hour. And moreover RBI has also mandated all the regulated entities ( NBFCs Banks etc) under one recent notification to comply with these standards.

Executive Summary

The IT giant Apple has alerted customers to the impending threat of "mercenary spyware" assaults in 92 countries, including India. These highly skilled attacks, which are frequently linked to both private and state actors  (such as the NSO Group’s Pegasus spyware), target specific individuals, including politicians, journalists, activists and diplomats. In sharp contrast to consumer-grade malware, these attacks are in a league unto themselves: highly-customized to fit the individual target and involving significant resources to create and use.

As the incidence of such attacks rises, it is important that all persons, businesses, and officials equip themselves with information about how such mercenary spyware programs work, what are the most-used methods, how these attacks can be prevented and what one must do if targeted. Individuals and organizations can begin protecting themselves against these attacks by enabling "Lockdown Mode" to provide an extra layer of security to their devices and by frequently changing passwords and by not visiting the suspicious URLs or attachments. 

Introduction: Understanding Mercenary Spyware

Mercenary spyware is a special kind of spyware that is developed exclusively for law enforcement and government organizations. These kinds of spywares are not available in app stores, and are developed for attacking a particular individual and require a significant investment of resources and advanced technologies. Mercenary spyware hackers infiltrate systems by means of techniques such as phishing (by sending malicious links or attachments), pretexting (by manipulating the individuals to share personal information) or baiting (using tempting offers). They often intend to use Advanced Persistent Threats (APT)  where the hackers remain undetected for a prolonged period of time to steal data by continuous stealthy infiltration of the target’s network. The other method to gain access is through zero-day vulnerabilities, which is the process of gaining access to mobile devices using vulnerabilities existing in software. A well-known example of mercenary spyware includes the infamous Pegasus by the NSO Group.

Actions:  By Apple against Mercenary Spyware

Apple has introduced an advanced, optional protection feature in its newer product versions (including iOS 16, iPadOS 16, and macOS Ventura) to combat mercenary spyware attacks. These features have been provided to the users who are at risk of targeted cyber attacks.

Apple released a statement on the matter, sharing, “mercenary spyware attackers apply exceptional resources to target a very small number of specific individuals and their devices. Mercenary spyware attacks cost millions of dollars and often have a short shelf life, making them much harder to detect and prevent.”

When Apple's internal threat intelligence and investigations detect these highly-targeted attacks, they take immediate action to notify the affected users. The notification process involves:

• Displaying a "Threat Notification" at the top of the user's Apple ID page after they sign in.

• Sending an email and iMessage alert to the addresses and phone numbers associated with the user's Apple ID.
• Providing clear instructions on steps the user should take to protect their devices, including enabling "Lockdown Mode" for the strongest available security.
• Apple stresses that these threat notifications are "high-confidence alerts" - meaning they have strong evidence that the user has been deliberately targeted by mercenary spyware. As such, these alerts should be taken extremely seriously by recipients.

Modus Operandi of Mercenary Spyware

1. Installing advanced surveillance equipment remotely and covertly.

2. Using zero-click or one-click attacks to take advantage of device vulnerabilities.

3. Gain access to a variety of data on the device, including location tracking, call logs, text messages, passwords, microphone, camera, and app information.

4. Installation by utilizing many system vulnerabilities on devices running particular iOS and Android versions.

5. Defense by patching vulnerabilities with security updates (e.g., CVE-2023-41991, CVE-2023-41992, CVE-2023-41993).

6. Utilizing defensive DNS services, non-signature-based endpoint technologies, and frequent device reboots as mitigation techniques.

Prevention Measures: Safeguarding Your Devices

1. Turn on security measures: Make use of the security features that the device maker has supplied, such as Apple's Lockdown Mode, which is intended to prevent viruses of all types from infecting Apple products, such as iPhones.

2. Frequent software upgrades: Make sure the newest security and software updates are installed on your devices. This aids in patching holes that mercenary malware could exploit.

3. Steer clear of misleading connections: Exercise caution while opening attachments or accessing links from unidentified sources. Installing mercenary spyware is possible via phishing links or attachments.

4. Limit app permissions: Reassess and restrict app permissions to avoid unwanted access to private information.

5. Use secure networks: To reduce the chance of data interception, connect to secure Wi-Fi networks and stay away from public or unprotected connections.

6. Install security applications: To identify and stop any spyware attacks, think about installing reliable security programs from reliable sources.

7. Be alert: If Apple or other device makers send you a threat notice, consider it carefully and take the advised security precautions.

8. Two-factor authentication: To provide an extra degree of protection against unwanted access, enable two-factor authentication (2FA) on your Apple ID and other significant accounts.

9. Consider additional security measures: For high-risk individuals, consider using additional security measures, such as encrypted communication apps and secure file storage services

Way Forward: Strengthening Digital Defenses, Strengthening Democracy

People, businesses and administrations must prioritize cyber security measures and keep up with emerging dangers as mercenary spyware attacks continue to develop and spread. To effectively address the growing threat of digital espionage, cooperation between government agencies, cybersecurity specialists, and technology businesses is essential.

In the Indian context, the update carries significant policy implications and must inspire a discussion on legal frameworks for government surveillance practices and cyber security protocols in the nation. As the public becomes more informed about such sophisticated cyber threats, we can expect a greater push for oversight mechanisms and regulatory protocols. The misuse of surveillance technology poses a significant threat to individuals and institutions alike. Policy reforms concerning surveillance tech must be tailored to address the specific concerns of the use of such methods by state actors vs. private players. 

There is a pressing need for electoral reforms that help safeguard democratic processes in the current digital age. There has been a paradigm shift in how political activities are conducted in current times: the advent of the digital domain has seen parties and leaders pivot their campaigning efforts to favor the online audience as enthusiastically as they campaign offline. Given that this is an election year, quite possibly the most significant one in modern Indian history, digital outreach and online public engagement are expected to be at an all-time high. And so, it is imperative to protect the electoral process against cyber threats so that public trust in the legitimacy of India’s democratic is rewarded and the digital domain is an asset, and not a threat, to good governance.

‍