WhatsApp, web services out of draft encryption policy after outcry

Draft National Encryption Policy: Government says all mass use encryption products now exempted after experts call policy draconian

By Nandagopal Rajan

The Government will have access to all encrypted information, including personal emails, messages or even data stored on a private business server, according to the draft of a new encryption policy.

The Draft National Encryption Policy wants users to store all encrypted communication for at least 90 days and make it available to security agencies, if required, in text form. It also wants everyone to hand over their encryption keys to the government.

The draft was formulated by an expert group set up by the Department of Electronics and Information Technology (DeitY) under Section 84A of the Information Technology Act, 2000. Since every messaging service and email, including WhatsApp and Gmail, use some form of encryption, this draft would cover almost all instant messages and emails.

As the issue started snowballing on social media, DeitY issued an addendum to the draft policy exempting “mass use encryption products, which are currently being used in web applications, social media sites, and social media applications such as Whatsapp, Facebook, Twitter etc”. It also exempted SSL/TLS encryption products used in Internet-banking and payment gateways as well as SSL/TLS encryption products being used for e-commerce and password based transactions.

Cyberlaw expert Pawan Duggal has described the policy as “draconian” and “misplaced”. “Almost everyone using the Internet will find themselves in violation of these rules. It is hence detached from the ground realities. This policy has been drafted for the PC era and does not take into consideration the mobile revolution in the country,” he said.

According to Duggal, the policy presumes that everyone will fall in line, while the technology providers, most of whom are based outside India, will not conform to these rules. “In fact, the policy will be counter productive and only discourage people from using encryption,” he said, adding that the draft was also in contrast to the objectives of the IT Act under which it has been framed.

The draft policy, for which the DeitY has invited comments from the public till October 16, has suggested that “all vendors of encryption products shall register their products with the designated agency of the Government”.

The final policy will be drafted only after the feedback is taken into account. At the moment, it seems the public reaction to the policy will be aggressive as it will affect almost all Internet users — a majority is not even aware that it is using encryption technologies.

The preamble of the draft says “the cryptographic policy for domestic use supports the broad use of cryptography” in ways that facilitate privacy and international economic competitiveness. However, in its objectives, it lists the “use of encryption for ensuring the security/ confidentiality of data and to protect privacy in information and communication infrastructure without unduly affecting public safety and National Security”.

The Government will regularly notify a list of registered encryption products and only these services will be able to conduct business in the country. Duggal said this will restart a “registration raj” and isolate India further.

Unlike the US, which prevents the export of encryption products, India will allow this with “prior intimation to the designated agency”. But again, “users in India are allowed to use only the products registered in India”.

When contacted, representatives of OTT messaging and email services refused to react to the draft policy.

Earlier this year, a debate over net neutrality gathered steam in India when Airtel proposed a zero rating plan where app developers paid to make data consumption free for users. But a public backlash saw apps like Flipkart which were part of the Zero rating scheme as well as Facebook’s Internet.org, the so-called free gateway to the Internet, pulling out.

The Department of Telecommunications’ net neutrality report released in July said “the core principles of Net Neutrality must be adhered to” and that user rights on the Internet need to be protected. The government has so far received over 60,000 responses on the policy framework.