Thankfully, encryption policy has been dropped
The draft of the National Encryption Policy put out by the Government last week, and thankfully withdrawn on Tuesday, was not just weak or flawed. It was an exercise in absurdity. Not only were the proposed provisions maximalist in scope, raising suspicions of a Big Brother-state, they were downright un-implementable. It is difficult to believe that a policy as strange and illogical as this was even approved for public consultation. Union Minister for Communications and Information Technology Ravi Shankar Prasad has distanced himself from the episode by saying that the policy was released without his clearance; even if this is true, there can be no reasonable explanation for how a supposedly ‘expert group' from the Department of Electronics and Information Technology put together a document that was so ludicrous that it sparked a national outrage on an issue like encryption, which hardly qualifies as a matter of general public interest. Had the policy come into effect, it would have placed almost every other Indian in violation of the law. The proposed regulation requiring all users to save their encrypted messages — which effectively refers to every message sent and received, since all text exchanged today are encrypted — in plain text format (such as a Word document) for 90 days was, of course, the one that spooked the nation. There are thousands of smart phone users across India who use social media and instant messaging platforms like Facebook, Twitter and Whatsapp on a regular basis. In many cases, given the sheer volume of messages exchanged daily, it is not physically possible for users to save them all for 90 days because their phone would not have the necessary storage space. Also, who would monitor if the messages were indeed being saved or deletedIJ And then, there is the equally important matter of invasion of privacy, in case a Government agency was to actually order a user to produce their messages or emails on demand. The draft also had other glaring problems: For example, it required any service provider using encryption technology, including those located outside the country, to enter into an agreement with the Government. In other words, the Government would have to sign individual deals with Android, Facebook, Google, Apple, Yahoo, Microsoft, Amazon… this list can go. And until these deals were signed, using not just one or two websites but entire operating systems would become illegal. Similarly, the policy also sought to initiate a state stranglehold on the Internet by suggesting that all encryption products used in India had to be registered with the Government. This would have given the state full and total control of online data.
That the Government has responded to public criticism and now withdrawn the outrageous policy is a step in the right direction but, in future, it must be more cautious. Only weeks earlier, it had to retract a similarly vague and poorly thought-out order on online pornography; and before that, it was seen dithering on Net Neutrality. While the Government may be allowed some leeway, as cyberspace issues are very much a work-in-progress around the world, with each country trying to find what works best for it, the Modi Administration must get its act together, especially if its serious about its Digital Indian campaign.