The Indian Government has developed cold feet yet again. In what is being castigated as a one step forward and two backward bid, the Government has got flak over its proposed encryption policy. Hell broke loose once the draft was circulated. The public outrage forced the government’s hand and it had little option but to backtrack.�The Government was clearly on a back-foot. In a hasty retreat, within 48 hours of the draft being
circulated, Indian Telecom minister Ravi Shankar Prasad announced withdrawal of the draft policy. He did this on grounds that there were misgivings that were uncalled for
The shoddy handling of the National Encryption Policy
Kumkum Chadha
The Indian Government has developed cold feet yet again. In what is being castigated as a one step forward and two backward bid, the Government has got flak over its proposed encryption policy. Hell broke loose once the draft was circulated. The public outrage forced the governments hand and it had little option but to backtrack.
The furore was over some clauses of the proposed policy. It was, to put simply, letting the cops out. It was falling prey to the states highhandedness and allowing the Government to snoop and violate ones right to privacy and civil liberty. In other words while citizens think that their communication is private, it is actually open to scrutiny, rendering the factor of confidentiality useless and irrelevant.
As per the draft guidelines of the proposed policy, all citizens were required to store plain-texts of the corresponding encrypted information for 90 days from the date of transaction and provide the verifiable plain text to the law enforcement agencies as and when required. All citizens meant all citizens including government departments, and academic institutions. It also applied to all kinds of communications: official and personal. Besides, all service providers located within and outside India that use encryption technology must register themselves with the government, as per the initial draft.
The Indian government had put up a draft National Encryption Policy document online.
The 90-day retention programme on information on the computer in text format defeats the basic objective of encryption. An encryption enables one to put in an algorithm and secure the message that seals it from interception and modification.
The draft policy made it legally binding for every Indian to follow the retention programme. Negligence or a slip up meant criminal prosecution. This, it was felt, was a stringent provision and reduced law abiding and net savvy citizens to criminals. As against this, the 90- day retention clause also makes it susceptible to theft and copying of confidential data.
On surface, the draft seems to advocate safeguarding national security and protecting citizen privacy; promoting ease of doing e-business securely; safeguarding national security and protecting citizen privacy. The conflict is with the last because it contradicts the basic spirit of freedom. How can citizen privacy be maintained once the Government has the power to see the encrypted communication? The requirement for every Indian to save in text form all his messages can also be legally challenged given that this provision is in violation of right to privacy under 21 of the constitution. This provision also undermines confidence of doing business
online.
The document, formulated by a department in the Union Ministry of communications and information technology, was introduced under Section 84 A of the Information Technology Act (2000). Once finalized, it aimed to introduce rules for encryption of electronic information and communication.
At the outset, the draft policy is in variance with this section. The section, as understood and interpreted, enables the government to prescribe the methods and modes of encryption and it is required to be done for secure usage of the electronic format and also for promoting ecommerce and e-governance. The objectives of the draft are anything but this.
There was an outrage with the public expressing concerns on the issue of privacy. That all citizens using encryption services must store in plain text versions of encrypted communication for 90 days, triggered intense reactions. In other words, users were being asked to store their WhatsApp messages for 90 days or face action if they failed to reproduce old messages in case they were asked.
Worse still, this would open to scrutiny business and transaction details of all users given that e-commerce websites that may have to keep a plain text copy of user transaction details, leaving their information very, very vulnerable.
The Government was clearly on a back-foot. In a hasty retreat, within 48 hours of the draft being circulated, Indian Telecom minister Ravi Shankar Prasad announced withdrawal of the draft policy. He did this on grounds that there were misgivings that were uncalled for. With the Governments U-turn, worries about the consequences of deleting WhatsApp, Facebook and Viber chats before 90 days, are likely to be over. The Governments clarification exempting the social media applications comes as a relief to those hooked on to social media. That the government has bowed down to pressure is clear.
It is against this backdrop that the government, while withdrawing the policy, hammered on its sensitivity and support to social media freedom. The minister spoke about the government honouring its peoples rights of articulation and freedom.
The devil, however, is in the detail. One cannot dismiss or overlook the Governments emphasis on the need for an encryption policy. The Minister while withdrawing the much-maligned draft said that a reworked policy would soon be in public domain. The Government, the minister, said had taken note of the concerns of the public.
The way this has been handled, rather mishandled, raises key questions. It signals the governments ill-preparedness and shoddy handling of a policy as important as the National Encryption Policy. It also raises doubts about whether the Government and its departments are working in tandem with each other. The fact that the Minister had to step in and announce withdrawal of the draft signifies that either he was not in the loop or caught napping on a vital issue.
For the Modi government and its participants this is bad news. It reflects poorly on the way things are in a set up forever hollering that it means business and intends to make development its mantra. The least that should have been done was to test the waters, tone down the regressive clauses if not omit them altogether rather than raise alarm bells that the Government wants to play cop on innocent, well-meaning citizens. With his reputation of being dictatorial and a control freak, this does not bode well for Modis image or his style of functioning. Some measures are necessary, given that in the past there has been a complete disregard of laws by errant citizens and a Government that looked the other way. Yet the present government needs to tread with caution. It can ill afford to get a reputation of being one that is ever ready to throttle democracy and create an atmosphere that is stifling and ever willing to strip citizens of their freedom to breathe, speak or think.
The Modi governments problem is one of perception. Therefore anything it does, even if it is in national interest, is suspect. It is this baggage it needs to shed before many of its policies, encryption or any other, are accepted as being for public good rather than going against the spirit of democracy or the countrys Constitution. It is on this that the Government needs to work much harder than on policy formulation. Once this battle is won, the rest would be childs play.
The writer is a senior Indian journalist, political commentator and columnist of The Independent. She can be reached at: ([email protected])
