By IndiaTomorrow.net,
New Delhi, 22 Sep 2015: The central government has drafted an encryption policy – which cyberlaw experts have termed as ‘draconian’ – to get access to all encrypted information, including personal emails, messages or even data stored on a private business server. Soon after the draft policy was put in the public domain to invite comments from people, there was a huge outcry against the move, and consequently the government had to release an addendum exempting social media outlets like Whatsapp, facebook and twitter from the draft policy.
The draft is said to have been formulated by an expert group set up by the Department of Electronics and Information Technology (DeitY) under Section 84A of the Information Technology Act, 2000. As every messaging service and email, including WhatsApp and Gmail, use some form of encryption, this draft would cover almost all instant messages and emails.
“Almost everyone using the Internet will find themselves in violation of these rules. It is hence detached from the ground realities. This policy has been drafted for the PC era and does not take into consideration the mobile revolution in the country,” Cyberlaw expert Pawan Duggal has been quoted as saying by The Indian Express.
As an outcry erupted over the issue on social media, the government issued an addendum to the draft policy exempting “mass use encryption products, which are currently being used in web applications, social media sites, and social media applications such as Whatsapp, Facebook, Twitter etc”. The government has also exempted SSL/TLS encryption products used in Internet-banking and payment gateways as well as SSL/TLS encryption products being used for e-commerce and password based transactions.
Eminent Supreme Court lawyer Prashant Bhushan has also criticized the encryption policy as espionage of the people by the government.
“The govt’s encryption policy requires that govt must have access to all communication. Govt wants to spy on all of us!… Govt’s encryption policy confirms the CMS system it is putting in place to monitor all our communications. Big brother will be watching you!,” he tweeted.
—
Input from IANS:
Draft policy proposes to store all messages for 90 days
Every message that is sent, through email, Whatsapp or SMS, should be stored in plain text format for 90 days from the date of transaction and should be made available to the law enforcement agencies on demand, says a draft National Encryption Policy.
The mission of the policy is to provide confidentiality of information in cyber space for individuals, protection of sensitive or proprietary information for individuals and businesses, ensuring continuing reliability and integrity of nationally critical information systems and networks, it said.
“Users or organizations within B group (that is business to business sector) may use encryption for storage and communication. Encryption algorithms and key sizes shall be prescribed by the government through notifications from time to time,” the draft said.
“On demand, the user shall be able to reproduce the same plain text and encrypted text pairs using the software or hardware used to produce the encrypted text from the given plain text. Such plain text information shall be stored by the user or organization or agency for 90 days from the date of transaction and made available to law enforcement agencies as and when demanded in line with the provisions of the laws of the country.”
The objectives of the draft policy is to synchronize with the emerging global digital economy, network society and use of encryption for ensuring the security, confidentiality of data and to protect privacy in information and communication infrastructure without unduly affecting public safety and national security, it added.
The draft proposes to introduce the New Encryption Policy under section 84A of Information Technology Act 2000.
The last date for public to comment on the draft is October 16.
