Moving Towards a Secure Digital Economy, Mint, 26 January

http://www.livemint.com/Opinion/YUSILwlMQ2GXqcB8NF86kK/Moving-towards-a-secure-digital-economy.html

Moving towards a secure digital economy

The velocity of digitisation and technology adoption must necessitate a response different from what was the norm in the ‘public sector era’

Samir Saran and Vivan Sharan

Even as incessant political bickering is polarizing opinion on demonetisation, India is making a significant transition to a digital payments ecosystem. This project endeavours to breach the urban-rural divide, geographical exclusions of the real world, and income criteria that privileged only a few with access to certain private and public services. This new digital payments ecosystem is brutal in its attempt to alter the way India transacts, trades and is taxed.

A wider adoption of digital payments will invariably change the dimensions of risks, crime and security as well. If pickpockets were a common menace some decades ago, cybercriminals may dominate conversations in the days ahead as they eye digital and online transactions. While the “pickpocket” had to select a relatively “fat target” to make the effort and risk worthwhile, the cyber thief will have a low-risk environment (lack of forensic capabilities, human capacities and attribution challenges) and an expansive reach of technology that will make even “petty pickings” attractive. And although cybercrime will affect us all, it will harm the poor disproportionately. It could ravage the small savings of many, deprive them of their meagre means and, most importantly, result in erosion of trust in the financial ecosystem currently being built. It is, therefore, important that the government pay heed to small fraud.

An early warning of this was provided by the frisson of panic that followed the cautionary message from the newly launched Bharat Interface for Money application (BHIM app) on 4 January 2017: “Users please beware: Decline all unknown payment requests you may get! We will work on an update, which will allow you to report spam.” This response is inefficient and leaves the ecosystem vulnerable to malicious intent.

Governments around the world and here in India must respond to this new dimension, where “petty cash is big money” and digital pickpockets pose a range of threats to individuals, institutions and economic stability itself. Most governments have left themselves with little time to create the requisite mitigation capabilities. The velocity of digitization and technology adoption must necessitate a response from policymakers different from what was the norm in the “public sector era”, where Centrally controlled banks and enterprises offered a modicum of stability, privacy, and security (with less efficiency). To achieve this, a comprehensive approach for securing the digital ecosystem must be devised and some actions must be taken immediately.

First, there are a multiplicity of stakeholders operating networks and tools that pose varying degrees of risk. This, in turn, demands differentiated security responses. These include the Reserve Bank of India (RBI)-run National Electronic Funds Transfer (Neft) and Real Time Gross Settlement (RTGS), the National Payment Corporation of India’s (NPCI’s) Immediate Payment Service (IMPS) on which the Unified Payments Interface (UPI) currently operates, traditional card networks, mobile payments solutions, various banking apps. In a report released in December 2016, the Union ministry of finance’s committee on digital payments suggested a hierarchical approach based on the level of “systemic risk” posed by different tools and networks. This must form the design basis going forward.

Second, while industry is consulted by expert committees such as the one referenced above, an inclusive multi-stakeholder consultative process must become the norm for policymaking itself, to avoid arbitrariness. This can be done by instituting multi-stakeholder consultations that are transparent and inclusive. This is the model India has agreed is best suited to govern the Internet internationally, and it’s time to adopt consonant processes at home.

Third, while the “mobile” is being hailed as a replacement for physical wallets as well as a proof of identity through its widespread use in second-factor authentication of digital payments, government and users should be circumspect about the risks involved. For instance, there is evidence to suggest that distributed denial-of-service (DDoS) attacks—in which a multitude of compromised systems attack a single target, causing denial of service for users of the targeted system—are increasingly targeting the applications layer rather than the network layer of the Internet. In layman terms this means a sophisticated mode of cybercrime is being unleashed on unsuspecting users of mobile applications and popular software.

Mature hardware-based solutions, such as tamper-proof Universal Integrated Circuit Cards and Embedded Secure Elements, are being tested against the latest forms of cyberattack. Software-based solutions such as Host Card Emulation are also relatively secure but require upgrades through the cloud, placing large data demands on the user and testing the service capabilities of the issuer.

Globally payment solutions that have been able to integrate hardware- and software-based security exist, but domestic mobile payments providers are relying largely on software-based security solutions. And while the Indian government’s Computer Emergency Response Team, RBI and NPCI are undertaking security audits of payment solutions, it is important that users be given standardized information to make informed choices, particularly when the digital adoption drive is at its height.

Lastly, it may be useful for the government to think of the digital payments ecosystem, now anchored by the NPCI, as analogous to the Internet. And much like the Internet, the National Financial Switch (the infrastructure backbone of all Indian ATMs, operated by the NPCI) must acquire robust redundancies offered by private-sector partnerships in order not to be a vulnerable single point of failure—which can potentially be compromised by self-styled “legions” of hackers. The NPCI should be managed through multi-stakeholder groups that can help with standard-setting, and can ensure that the payments ecosystem serves the common citizen, making even a small transaction online.

Samir Saran and Vivan Sharan are, respectively, vice-president at the Observer Research Foundation and founding partner at the Koan Advisory Group.

"Narendra Modi must ensure demonetisation is not seen as increasing government’s role in citizens’ lives", Economic Times, 27 November

http://blogs.economictimes.indiatimes.com/et-commentary/government-must-ensure-that-demonetisation-is-not-seen-as-its-increasing-role-in-lives-of-citizens/

Narendra Modi must ensure demonetisation is not seen as increasing government’s role in citizens’ lives

By Samir Saran & Vivan Sharan

By the demonetisation move, Prime Minister Narendra Modi has enacted a strong policy that has removed nearly all currency from circulation, without an immediate recourse to its replenishment.

This move again positions him as a disrupter of the status quo, an attribute increasingly being endorsed by voters across the globe. If he has to carry this disruption to its logical political outcome, significant support will need to come from the ‘JAM ecosystem’ (Jan Dhan, Aadhaar and Mobile).

This political gambit puts into sharp relief the importance of what the government does next. Its job has just begun and uncertainty about long-term outcomes will persist until complementary steps are taken. Since the central proposition put on the table is that business as usual is no longer acceptable, the important question is: what next? To answer this, it is useful to first benchmark India’s cash economy against ‘emerging market’ peers.

In terms of ‘narrow money’, which includes coins and notes in circulation and other currency equivalents easily convertible to cash, India has a higher cash-to-GDP ratio (11.77%) than all its Brics counterparts. There are also extreme benchmarks set by advanced countries such as Sweden, which aims to go completely cashless (something that may be neither desirable nor doable in India’s case), and has a cash-to-GDP ratio of close to 2%.

Within Brics, South Africa is a standout performer with a cash-to-GDP ratio of under 5%. Like India, South Africa has well-developed telecom networks, large and rising number of internet users and a thriving innovation culture in digital payments. The additional South African ingredient that seems to be missing in India is a supportive institutional environment. Modi’s litmus test will be whether he can overcome legacy issues that plague India’s institutional ecosystem that inhibit the evolution to a cash-light economy.

One such issue is the over-reliance and unhealthy prioritisation of the government-run digital payments solution to the detriment of private service providers. Modi’s promise of ‘less government, more governance’ should certainly not include the perpetuation of a digital payments ecosystem dominated by government-backed entities. Instead, it must focus on building partnerships that leverage entrepreneurial energies outside of the government. Digital payments currently constitute only around 5% of all consumer transactions and need a dramatic and exponential ramp-up.

While the RBI has adopted a digitalfocused ‘Payments and Settlement Systems Vision’ in June, there is no mentionof any competition issues that should ordinarily be considered when safety, efficiency and universal access are stated goals of this vision. Further, there exists a conflict when the government-sponsored digital infrastructure backbone, the National Payments Corporation of India (NPCI), also establishes the terms of engagement of the emergent digital payments ecosystem. The NPCI promotes the RuPay card, which has been pushed out to most citizens who have opened Jan Dhan accounts.

After demonetisation, the NPCI has waived switching fees paid for all RuPay issuing and acquiring member banks for points of sale and e-commerce transactions (till the year-end), ostensibly to promote its own product. Here, the licenser, regulator and the business entity are one, and are perversely gaming politics and policy. This is not avirtue for any market seeking to promote itself as business-friendly.

But it’s more than just the ‘ease of doing business’ that is at stake. It would be clear to incumbent card networks that they may have lost the opportunity to service the 800 million who make up the bottom of the economic pyramid to the supply-led RuPay proposition. But the government must also recognise that an army of stakeholders will be required to increase both the volume and value of digital transactions. For instance, there is negligible payment acceptance infrastructure in rural areas, despite RuPay’s dominant presence over the last few years.

The immense task of ensuring ubiquitous acceptance infrastructure is not something government can achieve alone. RuPay will need to work with its counterparts. Risks that come from having created a single point of infrastructural failure through the NPCI are immense and real. One such threat materialised when cyber attacks were witnessed over the last few months that affected 3.2 million debit cards.

GoI must ensure that demonetisation is not seen as a time for increasing the role of government in the lives of citizens, rather as a moment to rationalise it. The government has the responsibility to balance security, access and competition as the digital economy evolves. This has to be done through sensible policies and regulations, not through predatory business interventions.

(Saran is vice-president, Observer Research Foundation, and Sharan is founding partner, Koan Advisory Group)

DISCLAIMER : Views expressed above are the author’s own

DISCLAIMER : Views expressed above are the author's own.

Government of India should not Make in India, Column in Mint, 7 Oct 2016, Vivan Sharan and Samir Saran

http://www.livemint.com/Opinion/eLQGanpcx6DGwMDSFMCFNI/Government-of-India-should-not-Make-in-India.html

India is recording historically high investments in technology-oriented industries such as telecom and over the top (OTT) services that ride on telecom networks such as financial technology and e-commerce.

The latest infusion of Rs47,700 crore by UK-based telecom giant Vodafone Plc. into its Indian arm is indicative of the fact that the Indian market remains much coveted despite the headwinds to global growth. Manufacturing investments are also targeting the tech-hungry Indian consumer.

Chinese telecom giant Huawei will begin manufacturing smart phones in India this year, the 40th such manufacturing investment in the country in the past two years alone. With such investments and parliamentary consensus on the GST, one may be tempted to conclude that ‘Make in India’ is on track. This may be premature.

India’s transition from an agricultural economy to a service economy has posed a conceptual challenge for many who see industrialization as the only way to create jobs. Industrialization requires best-in-class infrastructure, cheap energy and a skilled workforce, all impossible prerequisites to fulfil in the short or medium term. But the ‘digital economy’ offers a way out.

While productivity gains from automation and digitisation have driven industrial growth in advanced countries over previous decades, their effects are not fully felt here.

The digital economy can potentially mobilise millions of Indians, constituting the ‘informal workforce’, bringing them within a more productive fold. India’s biggest challenge is also its best opportunity: it has a large, young and untrained workforce that can intuitively understand applied technology, if given early exposure.

In fact, India can extract greater relative gains from the digital economy than its advanced country counterparts. Real income growth in advanced countries requires sustained and fundamental innovation whereas India can harness incremental innovation towards higher rates of growth (mostly owing to a favourable demographic).

But continued innovation support through private sector investments is not inevitable. Many policymakers mistakenly believe that India cannot be ignored as an investment destination. Nothing is inevitable.

Conversely, Make in India’s greatest threat is the ubiquitous government-run enterprise itself. And this is borne out in a number of technology-oriented industries; which is worrying as successive governments have first created favourable conditions for investments and then jeopardised them.

For instance, the telecom industry, often cited as an example of successful liberalization, finds itself at a crossroads. It is dependent on falling voice call revenues despite enough global precedent to show that data revenues are the future. The industry lacks the bandwidth to deliver affordable data.

And there is policy inertia to address this, partly due to the existence of BSNL. Policymakers have hesitated from undertaking comprehensive reforms around key challenges such as Right of Way regulations, hoping that BSNL’s networks will save the day. And BSNL has not delivered the goods: the quality of its Internet infrastructure and service ethic are reminiscent of the pre-liberalisation era.

Instead of harnessing a well-designed ‘ring network’ as was originally conceptualised in ‘BharatNet’, India has to settle for optic fibre cables thrown on electricity poles, barely resilient enough to withstand a windy day.

Another competitive technology industry, broadcasting, is another example. While most advanced countries have public broadcasters, few have created legacy issues as profound as Prasar Bharati has here.

The private broadcasting industry has been haemorrhaging money owing to high cost of ‘carriage’ and regulatory restrictions on deriving more revenues. Prasar Bharati has been on the wrong side of both these issues—not readily relinquishing spectrum to private operators which could help lower carriage costs, and forcing private operators to circumscribe their lifeline advertising revenues by applying Mandatory Sharing regulations on high value content such as sports broadcasts. Policymakers have conflated national interest with consumer choice.

The result is that broadcasting investments have been muted over the past decade despite progressive liberalization of FDI caps. The larger lesson to draw is that governments should not be both regulators and competitors. This is not the easiest pill to swallow, particularly when sentimentality accompanies the notion of government-run enterprise.

The introduction of RuPay cards by the National Payment Corporation of India, which is heavily guided by the Reserve Bank of India, indicates that the government is tempted to enter markets to disrupt perceived monopolies even in the digital economy.

Ironically, India is a party to the US-led dispute with China at the WTO on the Chinese variant of RuPay, called UnionPay. India’s approach therefore is neither consistent nor wise. It is a legacy of the past, wherein the government created markets for ‘old economy’ industries such as energy and infrastructure.

While public enterprises have succeeded, to an extent, in traditional industries, they are not optimized for the new economy which requires constant innovation and high standards of service delivery.

The government should remain a licensor, regulator and adjudicator and let consumer choice select winners in markets where neither capital nor technology are constraints.

Samir Saran is vice-president, Observer Research Foundation, New Delhi; and Vivan Sharan is founding partner at Koan Advisory Group, India.

This article has been produced in collaboration with the World Economic Forum and in line with the programme topics of the India Economic Summit on 6-7 October 2016 in New Delhi under the theme “Fostering an Inclusive India through Digital Transformation.” For more information about the meeting visit http://wef.ch/ies16.

Don’t Shackle the New Economy with the Restrictions of the Old: The Wire, 11 July 2016

http://thewire.in/50544/old-vs-new-challenges-of-a-changing-economy/

There is a perpetual tussle between the old and the new. Perhaps nothing exemplifies this better than the tensions between the old economy and the new economy. A large share of the billions of dollars of foreign investments into India are now linked to the new economy. The new economy in turn is one that benefits from the freer movement of capital that has been enabled through a gradual opening up of our domestic market. And this capital is ruthless. It is attracted by productivity and efficiency, and not the populist impulses of our political class. Conversely, the old economy does seem to care about social equity – insofar as at least giving back through entrenched political patronage. A number of fallacies persist in the manner in which the old is pitted against the new –  and recent debates on Uber versus traditional taxi operators illustrate this.

Perhaps the biggest fallacy is that there are no common traits between old and new economy businesses. Of course, both aim to maximise profit, albeit through different means. Old economy businesses rely on high barriers to entry, which in the case of traditional taxi services are achieved through manipulation of the political economy. Anyone attempting to use community parking spots in Delhi for instance, would quickly realise that taxi stand operators have managed to appropriate space in a number of them, by paying ‘rent’ to the local officials. No doubt the cost of this rent is lower than that which would have to be paid if this were a formal levy.

On the other hand, new economy businesses such as Uber, rely on the sheer efficiency of technology to minimise costs. A nifty mobile application matches demand and supply in the taxi market, through an interactive experience that both the driver and the rider can use. There should be no mistaking the fact that the objective of any technology that is applied commercially is to create a monopoly of some form. And this is enabled through intellectual property laws that are widely recognised as essential for innovation, with some governments also complicit in perpetuating this virtuous cycle. Indeed, old and new economy businesses have different ways to achieve the same objective of achieving some form of monopoly in a product or a service value chain. And it remains incumbent on the government to regulate monopoly formation through appropriate regulatory mechanisms – whether for the old or for the new.

Another fallacy worth pointing out is that foreign capital is very different from domestic capital in its ruthlessness. The first quarter of the 2016-17 fiscal year has already witnessed the highest capital raise through initial public offerings (IPOs) in India in nine years. While the sum is a relatively paltry Rs. 5,855 crores (less than a billion dollars), capital allocation patterns are illustrative of this fallacy. Three out the six of the companies that participated in these IPOs were previously funded through private equity or venture capital investments, which are in turn intrinsically linked to capital availability in the global markets. Distinguishing between foreign and domestic capital, at some level or the other, is a fool’s game.  If India has chosen not to remain isolated from global markets, it is incumbent upon policymakers to make capital available for domestic enterprise to flourish.

So how can policymakers resolve this regulatory debate? One would imagine that a first step would be to reduce entry barriers, including licenses wherever possible, in order to foster competition. This should include doing what it takes to increase access to capital as well as removal of arbitrary pre-conditions at every step. Instead, state governments are busy figuring out how entry barriers to technologically-enabled businesses can be made higher. Karnataka for instance, has issued “On-demand Transportation Technology Aggregators Rules, 2016”; wherein one of pre-conditions is that licensees should have a minimum of 100 taxis in their fleet. This is perhaps not the best way to ‘Start-Up India’.

An alternative could be to first revisit and reconcile existing regulations and to focus on institutional capacity building within government while finding ways to enforce transparency. It is neither the moral responsibility of the private sector to think beyond its stakeholders, nor is it the task of governments to save the old economy from disruptions. It is however necessary for technology-driven businesses to be transparent given their inherent complexities; and in turn for governments to manage inevitable transitions from old to new by through some useful form of ‘co-regulation’ that empowers consumers.  

The ability of government or for that matter, the judiciary, to regulate dynamic sectors is limited – most recently evidenced in the call-drop case wherein the judgement states that telecom operators should not be penalised for bad quality of service since the faults cannot be “traceable exclusively” to them. Consumer experiences can easily prove otherwise and therefore should be used as a metric within the regulatory paradigm.

The author is a partner at Koan Advisory Group.