Question : DIGITAL CERTIFICATES

(a) whether the Information Technology Act, 2000 envisages digital signature certificates for electronic authentication of users and if so, the details thereof and the purpose for the same;

(b) whether the Controller of Certifying Authorities (CCA) mandated to licence and regulate the working of Certifying Authorities (CA) has suspended certain CA Certificates issued to the National Informatics Centre for issuing unauthorized digital certificates to several entities and if so, the details thereof including its ramifications on the security of users account and the reasons therefor;

(c) whether CCA has inquired into the matter and if so, the details thereof along with action taken by the Government/CCA in this regard; and

(d) the remedial steps taken/being taken by the Government in this regard.

MINISTER FOR COMMUNICATIONS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

(a) To (d): A Statement is laid on the Table of the House.

STATEMENT REFERRED TO IN REPLY TO LOK SABHA STARRED QUESTION NO.369 FOR 04.08.2014 REGARDING DIGITAL CERTIFICATES

(a): Yes, Madam. Controller of Certifying Authorities (CCA) appointed under the Information Technology Act 2000, licenses Certifying Authorities (CA) to issue Digital Signature Certificates (DSC) for electronic authentication of users.

DSCs are issued under Sub Section 4 of Section 35 of the Information Technology (IT) Act. These DSCs facilitate “e-Commerce” and electronic filing of documents through authentication of users and their transactions.

(b): Yes, Madam. Three Certificates issued to National Informatics Centre CA were suspended by CCA. The unauthorized certificates that had been issued, were revoked by National Informatics Centre Certifying Authority (NIC CA). This was done to prevent misuse.

(c): The incident has been investigated and the findings suggest that the perpetrators made an electronic intrusion into the CA systems from outside India. National Informatics Centre - Certifying Authority (NIC-CA) has been asked to revamp their infrastructure from all aspects – technical, physical and procedural.

(d): Advisory has been issued to all CAs to examine and, wherever necessary, strengthen security controls in the infrastructure used for DSC issuance.