As per Draft National Encryption Policy, the Government will have access to all encrypted information, including personal emails, messaging services like WhatsApp, Viber, line, Google Chat, Yahoo Messenger, or even data stored on a private business server.
The proposed policy, issued by the Department of Electronics and Information Technology, makes it mandatory for users of services to store all their communication for as long as 90 days and make them available to law enforcement agencies when legally asked to, failing to do so may lead to imprisonment of the user.
The draft policy further says that that service providers using encryption technology or those providing such services in India “must enter into an agreement with the Government for providing such services in India.” This means thousands of companies around the world providing such services will be required to enter into an agreement with the Indian Government, something that experts think is unrealistic.
The conditions will apply to everyone, including Government departments, academic institutions, and citizens for all kind of communications — be it official or personal.
Generally, all the modern messaging services like WhatsApp, Viber, line, Google Chat, Yahoo Messenger, etc, come with high-level of encryption and many a time security agencies find it hard to intercept these messages.
“All information shall be stored by the concerned B/C entity for 90 days from the date of transaction and made available to law Enforcement Agencies as and when demanded in line with the provisions of the laws of the country,” the draft said.
The draft has defined ‘B category’ as all statutory organisations, executive bodies, business and commercial establishments, including all PSUs, academic institutions. The ‘C category’ as per the draft includes all citizens, including personnel of Government and business performing non-official or personal functions.
In case the user communicates with a foreigner or entity abroad, the primary responsibility of providing readable plain text along with the corresponding encrypted information would be that of the user in the country.
The draft proposes to introduce the New Encryption Policy under section 84A of the Information Technology Act 2000. The sub-section 84C that was also introduced through the amendment has provision of imprisonment for violation of the act.
“Encryption products may be exported but with prior intimation to the designated agency of the Government of India. Users in India are allowed to use only the products registered in India. Government reserves the right to take appropriate action as per law of the country for any violation of this policy,” the draft said.
The last date for public to comment on the draft is October 16, 2015.