Need access to decoded data or the key itself: government panel

So far,much of the information sent through telecom and web services has been inaccessible to the government because it involves an encryption and decryption process.

So far,much of the information sent through telecom and web services has been inaccessible to the government because it involves an encryption and decryption process. Now,scrutiny is set to become tighter; an expert panel says operators should be told to provide readable text of the traffic they encrypt,or to furnish the decoding keys for messages relayed by them but encoded by a third party.

These should be to the satisfaction of the law-enforcement agencies or else the entities may be mandated to install their servers in India to facilitate the availability of encrypted data and if required,they will also obtain keys through Indian commercial agents, says a report by the panel,comprising technical and security agencies.

The H K Gupta Committee,with Defence,Home and IB officials on board,was formed last November to explore Possible Solutions for Interception and Monitoring of Encrypted Communications. The need had been felt because of unchecked messaging through BlackBerry Enterprise Server.

Security agencies had demanded access for intercepting BlackBerry messages but its maker Research in Motion replied it does not hold the key to access Enterprise Server.

Besides phone calls,the recommendations extend to intercepting mails sent through BlackBerry,Nokia Pushmail,MSN and Yahoo Messenger as well as tracking voice calls through Skype.

Experts admit it would be impossible to intercept each and every technology with the existing available means in the country but suggest that a designated agency work on intercepted communications interception,monitoring and decryption of raw data. Funded separately and on priority,this agency could engage researchers from various organisations and institutes and act as the governments custodian of such intercepts and decoding keys.

There had been an argument for lowering the current encryption limit of 40-bit so that brute force could be used to break the keys. The committee is against this; instead,it recommends the limit be raised to 2048 in the Internet Service Provider policy.

Story continues below this ad

Reducing the bit length will have very serious and direct impact on security of transactions like banking,stock trading,BPO industry,passport services and software industry. Insecure communications will adversely affect the confidence across all industries dependent on IT, it warns.

Therefore,the only alternative is to either secure the keys or obtain a decryption solution from the encryption provider. Forcing weak encryption on law-abiding citizens will lead to a paradox where they will be left exposed to unlawful activities, it adds.

The panel suggests that there could also be restrictions on import and export of equipment,and that necessary technology for monitoring and decryption be made available to agencies for all equipment imported.