Empanelled cloud service offerings are used for storage of government data: MeitY

Asked about whether the government is creating a plan and laying down guidelines as to the data that Governmental agencies can store on international cloud providers like AWS, Azure and Google Cloud, the Minister of State for Electronics & Information Technology, Rajeev Chandrasekhar, said that empanelled cloud service offerings are recognised after an audit is conducted by the Standardisation Testing and Quality Certification Directorate to ensure international security standards are met.

“Further, the terms and conditions of empanelment require submission of a legal undertaking guaranteeing that the data shall

reside in India and that there shall not be any legal framework outside Indian law that will be applicable to the operation of the cloud services,” Chandrasekhar said in a written response to an unstarred question.

The Minister said that with the expansion of the Internet, there’s been a huge increase in the volume of data generated, stored and processed, putting the need to secure such data in the spotlight.

“The (IT) rules specifically provide that the disclosure of sensitive personal data or information by the body corporate to any third party requires prior permission from the provider of the information, unless such disclosure has been agreed to in the contract between the body corporate and the provider of information or where the disclosure is necessary for compliance of legal obligations,” he said.

Discover the stories of your interest

In another question that was posed on the Deepfake App, Chandrasekhar said the government was cognizant of the same and that these could pose serious security risks.

“(With) more Indians coming online, the potential for information that may be harmful or pornographic or threatens national security, or is misinformation or information that is patently false and untrue or misleading in nature, has grown,” he said. “Technologies that alter the image or voice of a person to make it appear to be that of another person, or that create an image or voice that appears to be that of a person, enabling creation of “deep fakes”, may pose security risk to individuals, enterprises and the nation.”

Chandrasekhar said that the rules under the IT Act, 2000 contain several provisions for safeguarding users in the cyberspace. He said the Act penalises various cybercrimes relating to computer resources, including tampering with computer source documents (section 65), publishing or transmitting of obscene material in electronic form or containing sexually explicit act (sections 67, 67A and 67B), etc.