 Hello and welcome to NewsClick. I am Paranjoy Gohar Thakurtha and we are going to discuss the 20th December statutory order issued by the Ministry of Home Affairs which authorizes ten agencies of the Government of India to intercept, monitor and decrypt any information in any computer. Subsequently, the Ministry of Electronics and Information Technology has issued what it calls a draft note seeking to amend particular provisions of the Information Technology Intermediaries Guidelines Rules ostensibly to, and I quote, deploy technology-based automated tools or appropriate mechanisms with appropriate controls for proactively identifying or removing or disabling access to unlawful information or content. Is the Indian state now increasing its surveillance? Over ordinary citizens? What do these notifications and proposals to amend the rules mean for freedom of expression of every citizen, including journalists? And what does it mean in terms of the privacy of citizens? To discuss these issues, I'm very happy to have with me here Pravir Purokashto. He's the editor of NewsClick. He's been very, very active in issues pertaining to freedom of information. Pravir, what do you make out of this Home Ministry order of the 20th of December which authorizes ten agencies, the Intelligence Bureau, Narcotics Control Bureau, Enforcement Directorate, Central Board of Direct Taxes, Directorate of Revenue Intelligence, the CBI, the Central Bureau of Investigation, the National Investigation Agency, the NIA, the Research and Analysis Wing of the Cabinet Secretariat, the Directorate of Signal Intelligence. These are areas they operate in Jammu and Kashmir, the northeastern part of India, including Assam, and the Commissioner of Police. What do you make of this Delhi? That's correct. The Commissioner of Police, Delhi. Yes. Now, why now? Why suddenly when the Home Ministry itself says that these have been going on? I mean, these rules, these acts have been in place for some time now? Well, you know, there are different interpretations that can be put on this. One, the benign one that anywhere they had those powers, because this comes from the section 69 of the IT Act. And in fact, this was also challenged in the Supreme Court as a part of the Shreya Single Challenge. These rules were framed in 2009. That's correct. We're talking about 2009 rules. We're talking of the Home Ministry, which is really the section 69 of the IT Act under which they had certain powers. Section 69, the powers under section 69 were also challenged in the Shreya Single case, which actually struck down provisions of the 66, section 66, which had really draconian provisions which the police were using for all kinds of things, tweets that people might have made, Facebook post people had made. And it was finally seen to be a complete overreach in terms of law. The Supreme Court intervened. Section 69 had not become controversial at that time and the Supreme Court sort of let it stay, though there were apprehensions regarding section 69. What does it really say? It essentially has omnibus provisions that if certain authorization has been done by what the government of India and India and various, shall we say administrative bodies called the competent authority as defined in section 69, the very funny book called the competent authority as you know. Okay, let me interrupt you briefly and read out to you what the Minister of Home Affairs has said. They are saying this statutory order has been issued in accordance with rules that were framed in the year 2009 and been invoked since then. He said no new powers have been conferred on any of these security agencies or law enforcing agencies and furthermore it says that the notification has been issued essentially so that ISPs, that's internet service providers, telecom service providers and intermediaries codify, underline codify the existing orders. And then it goes on to say every case of interception monitoring decryption has to be approved by competent home secretary or in the state government. What is the reason for doing it now? I think that's the important part if this has always been there. Why now? Why now? And I think when we see the intermediary guidelines just sort to be modified, I think if you take both of them together. So I think it's very clear that the modification to 69 or the shall we say not so much the modifications, clarifications as the Ministry of Information Technology says with 69 was also to be seen in conjunction with the intermediate guidelines, intermediary guidelines which they are modifying. Taken together, there are two broad things that I want to draw your attention to. What is none of the state governments folk figure anywhere in this? Though they have a competent authority. They have competent authority under the act, there are certain powers given to them as well. But the way I read it, now this has been taken over entirely by the central government and its agencies. And if you take into account all the things we are hearing about CBI, somebody calling I think one of the DIGs who have moved the Supreme Court, talking about the extortion directorate as calling the enforcement directorate. So I think that these are really draconian powers which are inherent in the section 69, which we did not challenge as vigorously as you perhaps should have. Now we are aware of the dangers when it is clarified in this form. So central government is now saying we have the sole authority to do quote-unquote digital wiretapping if you will and we should be able to- Digital surveillance if you like. Digital surveillance, digital wiretapping whichever way you want to phrase it. And it is directed also at intermediaries like WhatsApp. All right. Now this is the key issue that comes up. We are going to come back to that but let us take one or two steps backward. According to the notification or the clarification issued by the ministry of home affairs, all such instances of interception or monitoring or decryption are to be placed before a review committee headed by the cabinet secretary as per rule 22 of the information technology procedures and safeguards for interception monitoring and decryption of information rules 2009. And this committee is supposed to meet at least once in two months to review cases. The second point is according to various RTI applications right to information applications every week thousands and hundreds of telephones are being tapped. Now furthermore the government is claiming that this statutory order of the 20th of December is to ensure that any interception monitoring or decrypting of any information through any computer resources done as per due process of law. This is what they're claiming. They think that's why it'll help. And it says that you know notification about these agencies will prevent any unauthorized use. I want to stop you all right because I think we need to understand what the two things that have happened as I said one is this seems to be directed and what's happened encryption as one part of it. There are two other parts of it which have not drawn attention. One is the Supreme Court has as per the judgment on privacy we call the Puttu Swami judgment has already said that people have a right to privacy. And this is a fundamental right. So now if fundamental right really come in conflict with section 69 what happens? What is the shall we say the surveillance laws you call it the surveillance laws. How do the surveillance laws square up with the right to privacy given under the Puttu Swami judgment and what should be the modifications done to these is an open question and also the Srikrishna commission on data privacy has also talked about measures required to square up all of these into our existing legislation. So that's one part of it. Second part of it and that's an even more important issue. You see once upon a time all these things were drawn up at a time when they had to issue orders to the different agencies and ask for information to be provided to them including pulling up conversations metadata access to phone conversations and so on no longer the case today they have now got what we call the central monitoring system that now it's tap into any service provider and they can pull in any information they want let's face it this is very much like the NSA and GHQ model which is a US and what is the general headquarters which is basically what the British intelligence agency is called the competent authority. This is the one which the Edward Snowden had disclosed that the national security agency of the US government had actually been invading the privacy illegally illegally and he also pointed out GHQ's close links with NSA and GHQ and Indian authorities functioned in a very similar legal framework because we draw our laws a lot of it from the colonial laws. Now Indian telegraph action. The important point is it is no longer asking for information they are really pulling information of any amount that they want directly from the cell phone mobile telephone lines whatever you call it today and this is in this is something which is hardware the centers we know where they are and they have access to all the all the telephone systems that we are talking about today service providers and this is now sought to be extended to all digital communications as well. Let me play devil's advocate let me here tell you what the Ministry of Home Affairs is claiming and they are claiming that this notification does not confer any new powers. They are claiming they are saying adequate safeguards are already provided in the information technology act of 2000 and similar provisions and safeguards and procedures already exist with the more than a century old telegraph act. Now they have been modified time to time. Now these they are saying the present notification that means the the recent notification is also subject to a robust review mechanism and it is analogous to the authorization issued under the old telegraph act. Now what is it every individual case will continue to require prior approval of the Home Minister of the State Government and the Minister of Home Affairs has not delegated its powers to any law enforcement or security. This is what is being played though we know they gave blanket permission to hundreds hundreds of people virtually every every day. You see this is like the NSA what constitutes pulling up what constitutes permission and so on. I am not going to get into technical details of this but let us understand what is happening. Ministry of Home Affairs has given blanket clearances for X number of agencies like this they will give a post fact to approval for anything these agencies do. It is a reality of what is happening today. We we cannot prove it but this is what we understand is hearing or what you hear from is happening. The second part of it is this pull mechanism that you pull up anything you want is subject to a review. Now you know if you remember the famous maintenance of internal security act reviews which is to take place during emergency the MISA. There are thousands of people who are in jail and they were all routinely reviewed and all the reviews said you know the grounds are perfectly okay and it should continue forever. So this this kind of reviews which take place is far single depending on the political authority the important part is why is it being done now. This is I think the crucial issue and you believe it has lot to do with the fact that the political atmosphere being what it is we are going to see the next general elections. I think it is very clear that as long as as long as WhatsApp was under the control of the BJP's electoral machinery they did not they did not really need this but now everybody is using now that everybody is following suit therefore the need to harass because you see if you criticize the BJP they can call it anti-government and anti-national and therefore any criticism of the off shall we say the existing political party in power could be construed to be an anti-national activity therefore subject to all the searches and harassment even if you can't prove any of these things finally all right but you can harass them. Now the interesting aspect and again I'm asking you tonight again go ahead a little bit what happened is the day after the statutory order was issued by the Minister of Home Affairs which was the 20th of December on the 21st of December the Minister of Electronics and Information Technology with members of what is called the Cyber Law Division they convened a meeting there were representatives of Google representatives of Google Facebook WhatsApp basically the major intermediate Yahoo Twitter share chat the Securities and Exchange Board of India and the Internet Service Provider's Association of India there was supposed to be a sort of a closed door session and a five page set of draft rules which are now available in the public or the mighty mighty website that's all this all happened in the 21st of December and now the point that everybody has to understand and this is where I'd like you to explain it. If the proposed and by the way these people who were part of the meeting they have been given time till the 7th of January to respond to these draft proposals. Now have we turned gone back in a sense regressed after the Shreya single judgment of the Supreme Court which was in March 2015 which repealed its struck down section 66A of the Information Technology Act which allowed the arrest of those who were posting offensive content online. Now you're saying you're proposing to say you can go back to where you started from and the earlier one the Home Ministry's orders you know the I mean seven months you can be put behind bars for up to seven months I mean whether you do it or not is another story so how do you see is it all really WhatsApp again. You see let's put it this way this is a lot to do with encryption as you saw the 69 the section 69 they were talking about in the IT Act refers to also de-encryption of computer resources. So and if you see what the intermediary section that we are talking about of the IT Act again it refers to essentially again encryption issue. So I think there is a battle that's going to come up immediately Facebook has to give its encryption keys to the government of India so they should be able to pull up anything they want but Facebook just hold on just hold as long as it is lynching as long as it is common and writes in Zafar Nagar in which Facebook you know was used but much more than that WhatsApp was used. We know it has been used extensively people have been asking what are you doing about it there is enough information available in public domain why aren't you prosecuting anybody till that point of time government appeared to be very shall we say continuing in its position of laissez faire on this you know one should not interfere in any of these things now the elections are close it raises an issue more than the legality of all of this and I think all of this need to be questioned in line of the Supreme Court judgment on the what is right to privacy that we should not be incriminating ourselves you know without the due process of law. So see what is on my computer but you have to exercise due process that part is not seems to not to be there but to me the main important part is why today why is it that suddenly it has become so important to look at all these issues which we have been raising for a considerable period of time that social media is used being used for all this shall we say violent incidents so the government is not cracking down on those who violate public law and order including bullenshire and suddenly you find this so let's say that we seem to be regressing in a okay possibility direction and it seems to be more than anything else in this particular time this particular time one must the charged political atmosphere post the assembly elections in the run up to the next general elections. Okay the opposition the Indian National Congress the Samajwadi Party the Communist Party of India Marxist the Rajasthya Janta Dal the Srinomul Congress have all been very very critical they are saying the right to privacy fundamental right this is all being done by stealth by by surreptitiously and and and and people have said this is unconstitutional it's draconian and and he says every citizen should be concerned when and Sitaram Yathuri has said why is every Indian being treated like a criminal and so so the whole opposition is predictably up in arms now let's hear another view the other view saying that the opposition is perhaps you know exaggerating the danger that that intercepting online communication systems monitoring coming computer systems is not really as simple as it is sometimes made out to be whether it's by the national investigative agency all of these so the contrary viewpoint from the Ministry of Home Affairs is that the new notification has only streamlined the process and specified which agencies can do the interception and the monitoring earlier it was free for all now I am quoting here an article by Dipthiman Tiwari in the Indian Express which was published a day after Sima Chisti broke the story about the draft rules to change the IT act yes please your reaction well I think the fact they're talking about exaggerating the danger is an admission the danger exists okay okay opposition is exaggerating it but it's a concession at least to saying that yes of course such powers are dangerous the question is that we are moving into a scenario where is wiretapping digital wiretapping is it to be done under only the internal jurisdiction of the Ministry of Home Affairs are the judge jury and executioner as it were of these set of policies or these powers that's really the question and I would submit that before any of these things takes place we have to go back to fundamentals that as technology changes the digital platforms emerge we have to go back to fundamentals what is the right to privacy in the digital age and I think these the danger of these laws being expanded in this fashion is a matter of concern probably you are a technical expert you have been very very active in the free and open source software movement in India across the globe you hold official you're an office bearer of free software movement but the contrary viewpoint is that you know platforms like WhatsApp have end-to-end encryption so even if the messages are intercepted at the gateway what you might get is a garbled text and the analogy that has been given in Deepthi Mantewari's article that you open like a Hindi text document on your laptop or your computer but you don't have Hindi fonts so it comes like garbled text and he said it can he said is very difficult to break what is called the 256-bit encryption it can take weeks or months by which time the information would be of no use well I think the intent of this laws are very clear that end-to-end encryption has to be broken by the intermediary and that's what is really the subtext of what is being argued and that is the the the source of concern and and and considerable apprehension and danger am I right yes absolutely absolutely this basically this whole issue of being able to see proactively means essentially demanding that encryption keys must be made available because they are saying that it should be proactive that the intermediary should deploy technology based to automated tools or appropriate mechanism with appropriate controls for proactively identifying and removing or disabling public access to unlawful information or content so that would really mean that encryption keys need to be broken the end-to-end encryption needs to be broken that's the argument which I have been saying has been the intent of both the earlier notification and this one. Okay now the other complication that a lot of people talk about that data is not kept kept here the data is they have said very clearly servers in the US wherever the servers are that they have to be given access if they are operating the services in India I think that position would lead to the position that data has to be localized all right no so those are said if India says that all data is 64-bit data then it's easier to break but if it's not 64-bit data it's 256 then it becomes the encryption okay now the encryption now again when you look at and here I'm quoting an officer quoted in this Indian Express report an unnamed officer it's a social media platforms with servers in the United States have been largely reluctant to share information and after 2611 there has been good cooperation quote-unquote India and US there are agencies and social media information has been shared on a case-to-case basis all related almost all of it is related to terrorism so the officer is also saying even if you have all these these draft rules or these rules are changed then unless these companies voluntarily agree to allow their access to that information it'll be difficult for the India's law law enforcing agencies to force them to provide this information because their servers are based elsewhere so this is the big battle which took place over Blackberry if you remember Chidambaram had actually asked Blackberry to give its encryption system he was at that time the home minister he was actually the home minister he wrote to the finance minister yes he did ask for access to their encryption keys because Blackberry had a messenger system which was a turn to Blackberry so I think we are reaching a similar point where this carpet is also essentially asking going to ask for two things one is localization of data which is coming in different forms already notifications have been issued for all financial data I think we're going to get that I'm not opposed to it per se because yes of course data localization is something we should encourage but at the same time that does not mean the right to privacy should therefore be arbitrarily construed by the government that's I think the threat okay my last question to you and you can sort of conclude with the big messages that are coming after the home ministry's notification after this proposal to amend the IT rules IT intermediary guidelines rules the media say a journalists if we say we want to protect the information that has been provided to us by a source on condition of anonymity and if we don't give this data I consider this private data a source of mine from a particular ministry has given me this data on condition that my source the name of that person would not be disclosed can I be put behind bars for seven years and under this laws that the way I see it that this is a distinct possibility both for you to be put under bars and a facebook or whatsapp in this case owned by facebook doesn't give access theoretically even their the company official city taken to put behind bars we know that's not going to happen they're going to negotiate with them and see what is what can be resolved but certainly you can be asked to de-encrypt whatever you have received which is on your mobile or which is on your computer and if you are using a lot of people use for instance encrypt whatever is there the hard disk of the computer you can be asked to de-encrypt it yes that's a distinct possibility but Praveer I mean what does it mean for freedom of expression and not just the citizens right to privacy I mean this is George Orwell big brother is is watching you and and and I mean what do I say they've gone ahead all all these proposals to change the rules these notifications there've been no public consultations whatsoever one bright day you were suddenly provided these these my virtue of a leak my virtue of a leak of a conversation they were having only with the intermediaries you see here is the issue that something which concerns every citizen becomes a discussion with only intermediaries you know when these rules and laws were put in place they were publicly discussed and in fact the intermediaries were actually lobbying with various groups hey you know for your interest you should do this this this now we seem to be going by intermediaries to the government to know what the hell is happening I think that's a that's something which is really ironic last pop comment I would make this is somebody's written this is 1984 beats a brave new world it's Aldous Huxley and George Orwell put together so we are in a far worse situation than either of them anticipated thank you so much for explaining what are obviously very very complicated technical and legal issues but nevertheless has an important bearing on the every citizen of this country every Indian citizens fundamental right to free expression and privacy thank you once again and all of us should be aware of how big brother is snooping on us and in the process are violating our fundamental rights to free expression and privacy thank you for being with us keep watching news click