Soon It May Be A Crime To Delete Your Whatsapp Chats, That's if Goverment Does Not Ban Instant Messaging Apps

The union government has put up a draft National Encryption Policy document online seeking to prescribe the methods of encryption of data and communications used by the government, businesses, and even citizens.

DeitY wants its eye on you

huffpost

The document has been formulated by an "expert group" set up under the Department of Electronics and Information Technology (DeitY) which comes under the union ministry of communications and information technology. While the draft policy claims to have an objective of enhancing data security, at least one activist feels that it runs counter to the aim, and is ill-conceived.

The draft policy has been introduced under Section 84 A of the Information Technology Act (2000). Once finalised, rules for encryption of electronic information and communication will be introduced under the policy. The draft document is open to public comment until October 16. The draft document says that the policy's mission is to "provide confidentiality of information in cyber space for individuals, protection of sensitive or proprietary information for individuals & businesses, ensuring continuing reliability and integrity of nationally critical information systems and networks."

The importance of encryption

At an institutional level, transactions on e-commerce websites, bank transactions, and online government services use encryption to protect personal data, as do several websites that store user data such as Facebook and Google. At an individual level, Virtual Private Networks (VPNs), or secure messaging apps are some examples of encryption technologies. Activists around the world are taking to encrypted emails to dodge spying by repressive regimes.

Pranesh Prakash, policy director at the Bengaluru-based Center for Internet and Society, slams the proposal and calls it "bad idea conceived by people who do not understand encryption". "A policy like this would require tens of thousands of companies across the world to enter into an agreement with the government of India. Does the government have the capacity to enter into those many agreements?" asks Prakash.

The real problem - you can't delete anything for 90 days

windows central

He further points to another part of the document that says users "shall reproduce the same Plain text and encrypted text pairs using the software/hardware used to produce the encrypted text from the given plain text. All information shall be stored by the concerned B/C (business/citizen) entity for 90 days from the date of transaction and made available to Law Enforcement Agencies as and when demanded in line with the provisions of the laws of the country."

"This means," explains Prakash, "that if something like Ashley Madison were to exist in India, they would have to keep passwords in plain text (unencrypted, and hence vulnerable) with them for 90 days. That is a problem. Moreover, certain forms of encryption don't maintain the logs that they want users to store. The group that has come up with this draft policy does not take that into account," says Prakash, also pointing out that the draft document describes SSL and TLS (Secure Socket Layer and Transport Layer Security) as "products" when they are actually protocols or widely accepted standards of encryption.

"Encryption products may be exported but with prior intimation to the designated agency of Government of India. Users in India are allowed to use only the products registered in India," says the draft policy document, available on the DeitY website.Raman Jit Singh Chima, lawyer and policy director at Access, a digital rights organisation, says that such a provision undermines security. "By limiting what encryption technology citizens and businesses can use, the draft policy in its current shape reduces everyone's security by default. Only services that are, in a sense, cooperating with the government will be allowed for use," says Chima

However, he also points out that the encryption policy can be useful if it advances its main mission of enhancing security and not undermine it. "The government can work with technologists towards that goal. The draft document does mention positive measures such as promotion of cryptography research and development in the country," says Chima. "Sensitive departments" of the government are exempt from the policy, something that Prakash finds odd. "What the government ought to be doing is, setting minimum standards for encryption for governmental use. But here, they are doing the opposite," he says.

(Originally published in the Times of India)