The Government will have access to all encrypted information, including personal emails, messages or even data stored on a private business server, according to the draft of a new encryption policy. The Draft National Encryption Policy wants users to store all encrypted communication for at least 90 days and make it available to security agencies, if required, in text form. It also wants everyone to hand over their encryption keys to the government.
The draft was formulated by an expert group set up by the Department of Electronics and Information Technology (DeitY) under Section 84A of the Information Technology Act, 2000. Since every messaging service and email, including WhatsApp and Gmail, use some form of encryption, this draft would cover almost all instant messages and emails.
- Ae Dil Hai Mushkil Audience Reaction: Ranbir, Aishwarya, Anushka Starrer Gets A Thumbs Up
- Bigg Boss 10, October 27 Review: Navin, Lokesh Fights During The Immunity Task
- Shivaay Audience Reaction: Ajay Devgn Impresses Viewers
- Pakistan High Commission Staffer Caught With Defence Documents: What It Means For India & Pakistan
- The Royal Opera House Reopens After Decades Of Neglect: Here’s A Quick Tour
- Tata Sons Rubbishes Cyrus Mistry’s Allegations: Here’s What Happened
- Pakistan High Commissioner denies allegations leveled on his staffer for espionage activities
- Odisha: Villagers Refuse To Cremate Dalit Woman’s Body
- Here’s What Farhan Akhtar Said On Karan Johar-MNS ‘Deal’ Over Ae Dil Hai Mushkil’s Release
- Government’s Diwali Gift to Central Government Employees, Pensioners
- Bigg Boss 10 26th October Review: This Episode Is All About Fights
- New Zealand Beat India By 19 Runs In Ranchi; Series Levelled At 2-2
- DND Toll-Free: Noida Toll Company Moves Supreme Court Against Allahabad High Court
- British PM Theresa May Says Kashmir Is A Matter For India, Pakistan To Sort Out
- J&K: Students Suffer As Schools Along LOC Forced To Shut Amid Firing
As the issue started snowballing on social media, DeitY issued an addendum to the draft policy exempting “mass use encryption products, which are currently being used in web applications, social media sites, and social media applications such as Whatsapp, Facebook, Twitter etc”. It also exempted SSL/TLS encryption products used in Internet-banking and payment gateways as well as SSL/TLS encryption products being used for e-commerce and password based transactions.
Watch Video: (App users click here)
Cyberlaw expert Pawan Duggal has described the policy as “draconian” and “misplaced”. “Almost everyone using the Internet will find themselves in violation of these rules. It is hence detached from the ground realities. This policy has been drafted for the PC era and does not take into consideration the mobile revolution in the country,” he said.
According to Duggal, the policy presumes that everyone will fall in line, while the technology providers, most of whom are based outside India, will not conform to these rules. “In fact, the policy will be counter productive and only discourage people from using encryption,” he said, adding that the draft was also in contrast to the objectives of the IT Act under which it has been framed.
#BeyondTheNews | Why the policy is ambiguous despite the addendum
The draft policy, for which the DeitY has invited comments from the public till October 16, has suggested that “all vendors of encryption products shall register their products with the designated agency of the Government”.
The final policy will be drafted only after the feedback is taken into account. At the moment, it seems the public reaction to the policy will be aggressive as it will affect almost all Internet users — a majority is not even aware that it is using encryption technologies.
The preamble of the draft says “the cryptographic policy for domestic use supports the broad use of cryptography” in ways that facilitate privacy and international economic competitiveness. However, in its objectives, it lists the “use of encryption for ensuring the security/ confidentiality of data and to protect privacy in information and communication infrastructure without unduly affecting public safety and National Security”.
The Government will regularly notify a list of registered encryption products and only these services will be able to conduct business in the country. Duggal said this will restart a “registration raj” and isolate India further.
Unlike the US, which prevents the export of encryption products, India will allow this with “prior intimation to the designated agency”. But again, “users in India are allowed to use only the products registered in India”.
When contacted, representatives of OTT messaging and email services refused to react to the draft policy.
Earlier this year, a debate over net neutrality gathered steam in India when Airtel proposed a zero rating plan where app developers paid to make data consumption free for users. But a public backlash saw apps like Flipkart which were part of the Zero rating scheme as well as Facebook’s Internet.org, the so-called free gateway to the Internet, pulling out.
The Department of Telecommunications’ net neutrality report released in July said “the core principles of Net Neutrality must be adhered to” and that user rights on the Internet need to be protected. The government has so far received over 60,000 responses on the policy framework.