Govt allows agencies to monitor computers, sparks privacy fears

Govt allows agencies to monitor computers, sparks privacy fears

News:

Government to allow 10 central agencies and Delhi police rights to snoop into anyone’s computer.

Important Facts:

• Union Home Secretary issued a statutory order authorizing 10 “security and intelligence” agencies including the Intelligence Bureau, the Narcotics Control Bureau, the Enforcement Directorate and the Central Bureau of Investigation to lawfully “intercept, monitor and decrypt” information through a “computer resource”.
• Until now, there were standard operating procedures (SOPs), the 2009 Procedure and Safeguards for Interception, Monitoring and Decryption of Information Rules, which has now been made into a statutory provision
• According to Government, authorised agencies have right under the law to intercept any attempt to subvert national security, defence, public order or integrity of India

There are two main acts governing the legal provisions for surveillance in India: The Telegraph Act of 1885 and the Information Technology Act of 2000.

• The Telegraph Act – Allows for the interception of calls and messages.
  • The Telegraph Act says there should be a condition of a “public emergency” or “interest of public safety” for intercepting information but the IT Act is silent about these.
• Information Technology Act of 2000 – Deals with provisions to intercept digital information including data stored on a computer, internet traffic and other data flows.
  • Section 69 of IT Act – The section states that the Centre or a state government or any of its officers specially authorised for the purpose can order or direct any government agency to “intercept, monitor or decrypt” any information “generated, transmitted, received or stored” in any computer resource if they are satisfied it is necessary to do so.
  • The five grounds laid down in the IT Act, 2000
    • Sovereignty or integrity of India
    • Defence of India
    • Security of the state
    • Friendly relations with foreign states
    • Public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence
  • Rule 4 of the IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules of 2009 provides that ‘the competent authority (home secretary in case of the central government) may “authorise an agency” of the government to intercept, monitor or decrypt computer resource traffic.

Safeguard Provisions:

• New system will prevent unauthorized use and every individual case will continue to require the prior approval of the Home Ministry or concerned state government.
• As per Rule 22 of the IT Rules 2009, all cases of interception or monitoring or decryption are to be placed before the review committee headed by Cabinet Secretary, which shall meet at least once in two months to review such cases.
• In the case of state governments, such cases are reviewed by a committee headed by the Chief Secretary concerned.

Argument Against:

• Critics argue that Government move is “unconstitutional and an assault on fundamental rights”, and the new rule will turn the country into a “police state”.
• The order does not provide the procedure or the object for such an exercise or the quantum of period for which a person’s private data could be intercepted.
• Directives is silent about the circumstances in which interception will be permitted.

Challenges to online monitoring:

• Platforms such as WhatsApp have end to end encryption. So even if you intercept it from the gateway, what you will get is garbled text that will make no sense
• It is difficult to make laws on data sharing as most of companies do not have servers in India
• Social media platforms with servers in the US have largely been reluctant to share information. Unless companies voluntarily agree to do this, there is no way of forcing them until their servers are based here
• There are further complications as internet communication can be sent using proxy servers. “A smart operator can even encrypt his email and we will not be able to do anything

Way Forward:

• In 2017, the Supreme Court delivered a judgment establishing privacy as a fundamental right. The legal foundation of the computer interception directive could be still be challenged in court because it has not yet been considered in light of the privacy judgment.