J-K govt bans pen drives in offices to strengthen cybersecurity

Srinagar: To strengthen cybersecurity, the Jammu and Kashmir government on Monday said it has decided to prohibit the use of pen drives on official devices at all administrative departments in the civil secretariat and deputy commissioners' offices across districts.

The use of public messaging platforms such as WhatsApp or unsecured online services like iLovePDF for processing, sharing or storing official or confidential materials has also been prohibited to uphold data sovereignty and prevent security breaches, a government order said.

The order issued by M Raju, Commissioner Secretary, General Administration Department (GAD), said the decisions were taken to enhance the cybersecurity posture of the Union Territory, protect sensitive government information, and minimise the risks of data breaches, malware infections, and unauthorised access.

“In exceptional cases where operational needs justify their use, controlled whitelisting may be permitted for up to 2-3 pen drives per department upon formal requests routed through the respective administrative head to the state informatics officer (SIO), National Informatics Centre.

“After approval, the pen drive must be physically submitted to the respective NIC cell for reconfiguration, authorisation, and ownership registration prior to use," the order said.

As a secure alternative, it said the departments are strongly encouraged to adopt GovDrive -- a Cloud-based, multi-tenant platform offering every government official 50 GB of secure storage with centralised access and synchronisation across devices, it said.

The order also said that all sensitive technical information, including ICT architecture diagrams, system configurations, vulnerability assessments, IP addressing schemes and strategic technology plans, must be classified as confidential and handled exclusively through approved secure channels in accordance with the Information Security Best Practices by the Ministry of Home Affairs, CERT-In directives, and department data classification policies.

"Failure to adhere to these instructions shall be viewed seriously and may invite disciplinary action under relevant rules governing official conduct, IT usage and administrative responsibility," the order said.

It also said the directions have issued with the approval of the competent authority and shall come into fore with immediate effect.

“All the departments are advised to accord top priority to the implementation of these guidelines in the interest of secure and safe e-governance,” it said.