Wary of vital Government data being pilfered from the servers of Yahoo and Google, the Department of Electronics and Information Technology, under the Ministry of Communications and Information Technology has reminded all States, including Delhi, to adapt to working on the Government’s server.
Shockingly, the majority of departments and officials of Delhi Government are flouting Government norms by using e-mails of other servers instead of the National Informatics Centre’s (NIC) server.
A policy in this regard was framed by the erstwhile UPA Government as concerns were raised that sensitive data was being leaked, though inadvertently, as officers were sending and receiving communications via Yahoo and Google servers.
The 13-page, top secret document prepared by the Department of Electronics and Information Technology, Ministry of Communications and Information Technology was sent to all States
including Delhi for effective usage of e-mail in Government departments.
The said document, accessed by The Pioneer, has given a detailed account among other things on the creation of e-mail addresses, data retention, data back-up and desktop protection
procedures in Government establishments.
The e-mail policy came in the wake of revelations by former National Security Agency contractor Edward Snowden about mass illegal surveillance by the United States (US). According to Snowden, the US Government had access to network infrastructure of other countries and personal data, including e-mails and chat records of individual users. According to documents released by Snowden, India was one of the countries most affected by US surveillance.
The Ministry has made it mandatory that there have to be two e-mail accounts of every user in a Government organisation. One is based on the designation and the other on the name. The user has to hand over the designation-based ID to his or her successor prior to moving out of office. The user can, however, continue to use the name-based ID assigned to them on Government e-mail service during their entire tenure in the Government. Any user retiring after 20 years of service can now retain the name-based ID created on the Government e-mail service for life. But this comes with a rider that the person can retain this for life only after changing his e-mail address.
The guidelines have made it amply clear that any employee prior to leaving an organization on transfer, should ensure that the password of his designation-based e-mail is changed. If an ID is misused, the respective nodal officer of each organisation would be held accountable.
A reality check by The Pioneer revealed that most of the departments of Delhi Government and officials are continuing to use Google and Yahoo for their official work rather than the official e-mail service provided by NIC, the national service for IT purposes. There are over 126 departments of Delhi Government. Strangely, most of the departments are not aware of the policy requiring them to use the server provided by the NIC. When asked about the e-mail policy or guidelines, several Heads of Departments gave a vague answer saying that the Government was in the process of implementing it.
According to the e-mail policy, for designation-based e-mail IDs, a one-time password has been suggested for authentication. The accounts of outsourced or contractual employees would, however, be created with a pre-defined expiry date. The guidelines said that an e-mail account can be created by the authorized person from an organization by using the “Delegated Admin Console” or by routing their request through the implementing agency.
Any account which is inactive for a period of 90 days shall be deactivated. “The user ID along with the data shall be deleted from the e-mail system after a period of 180 days, if no request for activation is received during this period,” it said.
For desktop protection, the Ministry’s guidelines say that spam and anti-virus filters have been configured at e-mail gateways by the implementing authority. It has, however, made it clear that use of encryption was mandatory for sending any e-mail deemed as classified or sensitive. To ensure integrity of the downloaded files, the officials have been told that digital signatures/ hash values should be verified wherever possible.