The Shady Mann Ki ‘Bot’ in Govt of India’s ‘Cyber Swachhta Kendra’

Cyber Swachhta Kendra aims to make Digital India safer, but here’s why we couldn’t trust this software completely.

Cyber Swachh Kendra is a free botnet cleaner software by the Government of India (Photo: TheQuint)

Not everything seems sarkaari about the Indian government’s latest effort to make internet safer.

“50,362 cyber-security incidents were reported in 2016,” said PP Chaudhary, Minister of State for Electronics and IT, while launching the ‘Cyber Swachhta Kendra’, a bouquet of applications ‘to create a secure cyber space’. It has been released under the Government’s ‘Digital India’ initiative.

Screen grab of the official Cyber Swachhta Kendra website.

On the official website, ‘Cyber Swachhta Kendra’ is written with full nationalistic fervour of a tricoloured font. It’s difficult to keep your hand from saluting at every instance. The ‘Botnet Cleaning and Malware Analysis Centre’ offers a slew of tools, such as a USB safety scanner and a browser security extension. But those are hidden away in a different page, and the primary focus remains the ‘botnet cleaner’.

What’s a ‘botnet’, you ask? Read on.

A bot is a software, which is often identified as the villain of your personal computer or smartphones. It’s a malware, which has the potential of handing over the control of your device from a remote location, and then taking commands or exposing all your data to the remote client. A network of bots is called a botnet.

If your system becomes a part of a botnet, it can leave you vulnerable to whatever data you may type, such as your bank account details and other information.

And the government wishes to keep you safe from such attacks. Sweet, isn’t it? Almost. Because the government ‘encourages’ you to download QuickHeal – a private company’s software. But wasn’t it supposed to be developed by the Ministry of State for Electronics and IT? And what’s with the in-your-face branding?

Screen grab of the official Cyber Swachhta Kendra website.

Anyway, we trusted the government like a good naagrik and proceeded to download the application which is only available for a Windows PC.

The download button takes us to the company’s website, away from the government domain. It asks us to download the free tool. We are skeptical, but happy, because free hai bro.

Screen grab of the botnet cleaner tool website.

Scrolling further below, we found an advertisement for another company’s application. This time for your Android mobile. Smart move there.

Screen grab of the botnet cleaner tool website.

We still went ahead and installed the BOT Removal Tool, because ye strange tool, kar gaya chull.

Observe how eagerly the ‘I Agree’ button sits here, waiting encircled in excitement.

A few key points condensed from the window above:
• Copyright
This Tool and the accompanying written materials are the property of Quick Heal and are copyrighted. (Okay, it’s fine)

• No Warranty (Yes, it’s actually written in all caps)
USE OF THE TOOL IS AT YOUR SOLE RISK... QUICK HEAL DOES NOT WARRANT...THAT DEFECTS IN THE TOOL OR SERVICES WILL BE CORRECTED. SHOULD THE TOOL OR SERVICES PROVE DEFECTIVE, YOU ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. (What The....!!)

• Disclosure
Notwithstanding anything, Quick Heal reserves the right to disclose any information in response to/that it is required to be shared, disclosed or made available to any governmental, administrative, regulatory or judicial authority under any law or regulation applicable to Quick Heal. (But I trusted you dear government’s friend...)

We agree to those terms. The first window pops up, and politely welcomes you.

Quick quiz time: How many QuickHeals can you see in the window above? And how many mentions of the Ministry or the Digital India initiative? Well...

Next, we get a barebones menu like this. We go for a quick scan.

We interrupt the scan to quicken the quick scan. And land at a window which technically tells that, ‘Haha. Good you downloaded this. But kya ukhaad lia? For full protection, download our AntiVirus too. The website is here”

No, we didn’t install the anti-virus. We clicked Finish, our scan was over.

But the story’s not. The government must not become a proxy server to such third party applications, which explicitly mention in their ‘Terms & Conditions’ that they can share user data on their will.

We appreciate the ministry’s active stance on the rising instances of cyber threats, but it would need a lot more than a branded exercise to create a sense of trust in the end user. A small assurance for us, but a giant leap for Digital India.