The IT resources of private banks ICICI Bank, HDFC Bank and NCPI which oversees the payment system Unified Payments Authority (UPI) have been linked to national security by the government. The government has declared the data of these entities as ‘critical information infrastructure’, which implies that any harm to their digital assets will be considered a threat to national security. Unauthorised persons accessing their systems could be jailed for up to 10 years, a government notification said.
The Ministry of Electronics and IT (MeiTY) in a notification dated June 16 declared the IT resources of ICICI Bank as critical infrastructure under Section 70 of the IT Act, 2000.
“The Central Government hereby declares the computer resources relating to the Core Banking Solution, Real Time Gross Settlement and National Electronic Fund Transfer comprising Structured Financial Messaging Server, being Critical Information Infrastructure of the ICICI Bank, and the computer resources of its associated dependencies to be protected systems for the purpose of the said Act,” the notification said.
In similarly worded notifications, IT resources of HDFC Bank and National Payments Corporation of India have also been tagged as ‘critical infrastructure’.
The notifications authorise designated employees, authorised team members of contractual managed service providers, third party members and any consultant, regulator, government official, auditor and stakeholder authorised by the entities mentioned above on case-to-case basis to access the IT resources of the companies.
“Looking at the recent sophisticated cyber attacks, it is high time all the banks and financial institutions get themselves notified as a protected system. Similarly, the control system of all the electricity, oil, airports, railways, metros and transport systems are critical infrastructure and must be declared as a protected system,” SP, Cyber Crime, Uttar Pradesh Police and certified cyber expert Triveni Singh told news agency PTI.
As per the Act, ‘critical information infrastructure’ means a computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.
