Naavi.org | Towards building Cyber Jurisprudence in India

New Intermediary Guidelines… Legitimate and Well within the rights of the Government

Posted on December 26, 2018 by 98410spice

[This is in continuation of the Previous Article]

Some times “Experts” also go wrong. Particularly when they look at every Government notification with the colored glasses borrowed from the Political opponents. Today’s Economic Times highlights “Plan to tweak IT rules may widen rift between govt, social media companies” and quotes many experts to support the headline. The ET Bureau credits the article to two journalists Surabhi Agarwal, Megha Mandavia but makes extensive quotes from several experts to say that the recent draft Guidelines under Section 79 released for public comments by MEITY will widen the rift between the Social Media Companies and the Government.

Probably, it is not the Social Media Companies themselves but the Indian media which is painting a scary picture whenever the Government wants to do something good for the society. The media has not come to terms with the Modi Government which unlike the non performing Government of UPA is rolling out one decision after another in quick succession unnerving the political opponents and the media which supports them for their own vested interests.

The same media cried from the roof tops that the draft bill on Personal Data Protection which advocated “Data Localization” will have negative effect on the industry. But today we find that Ctrls plans to invest Rs 2000 crores in new Tier-4 Data Centers in Hyderabad, Chennai and Mumbai, to expand their current infrastructure. Even Microsoft and Amazon are reportedly expanding their data center infrastructure in India. The Market based industry will therefore look at the economic benefits and adapt to the changing requirements though some journalists in India keep raising their voices against such developmental measures to nurture their own constituencies.

The WhatsApp and other social media companies will also adapt to the changing needs since they realize that Modi Government does not budge for such arm twisting tactics executed through the pliant media. The conclusion drawn by ET therefore is not correct. We soon will have WhatsApp India, FaceBook India and Twitter India to start operating from locations within the country not only subjecting themselves to the Indian laws but also creating new employment and business opportunities in the eco system. There will be some negotiations between the Government and these companies not only on the regulations but also on taxation and other matters and these are business negotiations that happen all the time between MNC s and the local Government. Despite the strict “Local Partnership only” policies of the Gulf countries, most international companies have set up shop there. Similarly, the foreign Social media owners will also find a way to operate in India. Hence there will be “No Rift” and even if it arises, it is the right of our Government to do what is good for our citizens and it should not yield to the media pressure.

There will be the community of politician advocates who raise the bogey of “Constitution” and try to make the Supreme Court dictate terms with the Governance of the day. But I think the Court will refuse to be made a pawn in the hands of the politicians working for building their 2019 election campaigns through the Supreme Court.

What Experts Say and Why they are wrong

In many instances, experts are misquoted by journalists who publish quotes in parts and out of context to derive their own meanings. Hence all the quotes attributed to the experts in the article may not be true. However, for the sake of clarity to the public we need to comment on these attributed quotes and record our views.

Quote 1: removing content within 24 hours for reasons such as maintaining public order or defamation may be deemed as infringing upon freedom of expression and invite legal scrutiny.

Comment: This comment refers to rule 8 (proposed) which states as follows.

The intermediary upon receiving actual knowledge in the form of a court order, or on being notified by the appropriate Government or its agency under section 79(3)(b) of Act shall remove or disable access to that unlawful acts relatable to Article 19(2) of the Constitution of India such as

in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, on its computer resource without vitiating the evidence in any manner,

as far as possible immediately, but in no case later than twenty-four hours in accordance with sub-rule (6) of Rule 3.

Further the intermediary shall preserve such information and associated records for at least ninety days one hundred and eighty days for investigation purposes, or for such longer period as may be required by the court or by government agencies who are lawfully authorised.

It is clear from the above that the removal of content only arises when it is lawful and in tune with the constitutional rights. Hence there is no infringement of the freedom of speech. Legal scrutiny is possible because celebrity advocates may move the Court and the Court may be obliged to admit the petitions. But it is unlikely that an honest Court will interfere in such routine rules. Such interference itself will be unconstitutional.

Quote 2: “There is vagueness of rules. They (meaning tech companies including cab aggregators, e-commerce companies, hotel aggregators etc) don’t know whether they are supposed to help intercept or provide a backdoor…”

Law remains vague as long as tech companies fail to either understand themselves or consult an appropriate person for clarification. Law Can never be a “Check list” which a clerk can tick boxes as some tech companies desire.

Vagueness therefore is inherent in any law and it is the responsibility of the judiciary to clarify when required.

(In fact, we may recall that Justice Chelmeshwar in his part of the judgement on Privacy went along to say that even what is written or not written in the Constitution is not sacrosanct and the Court has a right to read words and meanings into the law. I admit that I disagree with this view and also hold the Court inconsistent since the same Judges refused to read down Section 66A and went about scrapping it. But his words are a judge’s view on the sanctity of the written law).

Quote 3: Rule 9, mandates companies to “deploy technology based automated tools” for removing “access to unlawful information or content,” ….”it may be against the Constitution”

Comment: I recall the landmark Yahoo Nazi Memorabalia case in which the French Court ruled that Yahoo shall block French web users from its auction sites which sell Nazi memorabilia using appropriate technical measures failing which they have to pay a daily fine of 100,000 francs.

During the trial, Yahoo!’s lawyers argued that blocking the site from French web surfers would be technically impossible. “The internet has no borders, and there is no effective means of preventing its users from travelling where they like”…they said.

In its ruling, the Paris court said that it is technically possible for Yahoo! France, the company’s local subsidiary, to block at least 90% of French users from the sites in question and ordered Yahoo! to find ways to block French users from its Nazi auction sites.

The arguments that there is technical difficulty and we would not do what the Indian law makers desire is a rogue response which should be politely brushed aside.

Quote 3: WhatsApp can refuse to build technology that will trace messages, leading to a “prolonged tussle” with the government.

Comment: The requirement of the Government under Section 79 to track “Fake News” as a crime after its detection is only for tracing the origin of the message and hence may not need decryption. The decryption would be to prevent offensive messages being circulated, which is under Section 69 of ITA 2000. In the end-to-end encryption originating from the user’s device there is some apparent logic to the argument that WhatsApp may not be able to decrypt.

However, since the encryption algorithm is provided by WhatsApp and it has all the details of the user’s mobile at the time of installation, it is difficult to believe that it cannot recreate the decryption key or is already not storing a copy of the decryption key under its control or cannot do so if it wishes to do.

I therefore donot buy the argument that it is not possible to decrypt the message though I reiterate that the Government has not so far put up this demand as a blanket requirement. Under Section 69, it is only when the competent authority has reasons to ask for the information that the power would be exercised.

I presume that WhatsApp is already under amicable discussion with the Government. On the other hand the problem could be more with Google which has been hiding the e-mail sender’s IP address under the false impression that it is required for the protection of privacy and refusing the information even when the recipient of the message himself is demanding the information. This is an example of deliberate attempt not to cooperate with the law enforcement authorities which has forced the Government of legal measures to drag the foreign companies into the Indian jurisdiction.

In summary I welcome the Government move and agree with some of the experts who have stated that this could result in better tax compliance by the international agencies. There is in my opinion no legal hassle and it is extremely unlikely that the Supreme Court will even admit a petition to block the Government notification if it is finalized on the terms now indicated.

Naavi

Previous Articles:

Shreya Singhal is Back again!

New Intermediary Guidelines… Legitimate and Well within the rights of the Government:
Proactive technology tools to identify violation..new intermediary rules:
New Intermediary Guidelines.. Intermediaries need to have Indian Subsidiaries..:
Intermediary Guidelines.. Who is and who is not an intermediary?:
Draft Intermediary Guidelines 2018… Public Comments invited:
Copy of the guidelines:

P.S: The last date for submission of comments extended upto 31st January 2019. The comments would be put up on the website on 4th February and counter comments accepted upto 14th February 2019… http://meity.gov.in/writereaddata/files/Extention_Guidelines_2018.pdf

Posted in Cyber Law | Tagged intermediary guidelines, sec 79 | 2 Comments

Proactive technology tools to identify violation..new intermediary rules

Posted on December 25, 2018 by 98410spice

[This is in continuation of the previous article on the topic]

Continuing our discussion on the new Intermediary guideline, one other aspect that is attracting attention in the media is the proposed Rule no 9 which states as follows:

“The Intermediary shall deploy technology based automated tools or appropriate
mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content”

“Identification” is often discussed in the WhatsApp context as the “Origin” of a message. One of the main concerns of the society in recent days have been the “Forwarding” of messages through the social media leading to fake news generation and incitement of unrest in the society.

The Government has therefore been insisting that messages should be hashed and WhatsApp has to maintain a hash tag with every message.

However, what is of relevance is only the identity of the sender since hash can easily be changed with just an addition of a comma or space.

In the WhatsApp scenario the identity is always linked to the mobile and therefore unless the Mobile Service Provider has not failed in the KYC, identity of the sender is available for the investigating agencies. Whats App also works in “Groups” and hence forwarding from one group to another occurs through the WhatsApp server which knows the identity of both groups and therefore the members of both groups. Hence it is not difficult to tag the messages going into and out of the WhatsApp server with an identity information in a header to be created (outside the boundary of the encrypted message) that can also distinguish between a message sent by a member to other members of the same group and a message sent from one group to another. The header is relevant in inter-group transfers and WhatsApp can enable the header view in its menu such as “Message Info”.

Intermediaries like Google actually try to hide the identity information through a “Proxy” and by interfering in the identification of the message delivery system fail the test of “Intermediary” as discussed in our first article of this series. Gmail is therefore liable for Reasonable Security Practice under Section 43A and cannot claim exemption under Section 79 under the “Due Diligence” clause.

WhatsApp on the other hand does not hide the sender’s identity though many of the users create a profile name and picture which could be misleading. But their mobile number is still available for scrutiny and the Admin is supposed to know the users. It would be better if WhatsApp disables “Join through a Link” and restrict membership of a group only through an invitation from the admin.

While designing the automatic tools, the intermediaries may also as part of the due diligence, introduce measures to identify spoofing by comparing the identity of the sending device with the name as displayed and as resolved from its IP address. This is routinely done in the E Mail scenario and there is no reason why this should not be extended to other cases. It would be the responsibility of each ISP to check the identity of the previous ISP with the IP address as is visible and resolved.

Another aspect that has frequently pointed out the negligence of the intermediaries is in not naming the “Grievance Officer”. At least now, we hope the intermediaries will start this practice.

To summarize, except for the “Need to have a local subsidiary” there is no other major change between the previous version of the guideline and this. There are clarifications which were relevant and some mandates which were anyway part of the interpretation of the due diligence.

We suppose that the intermediaries co-operate with the Government in implementing the guidelines since Intermediaries are the key to Cyber Crime prevention and cannot be allowed to be tools of commission of Cyber Crimes.

(Comments are welcome)

Naavi

Previous Articles:

Shreya Singhal is Back again!

Posted in Cyber Law | Tagged intermediary guidelines, sec 79 | 1 Comment

New Intermediary Guidelines.. Intermediaries need to have Indian Subsidiaries..

Posted on December 25, 2018 by 98410spice

[This is in continuation of the previous article on the subject]

In the 2011 version of the guidelines, the “Due Diligence” included a prompt action to be taken by the intermediary when a complaint is received by them about some contravention occurring on his platform with a message that is either stored or displayed under his control. The guideline stated that” When the intermediary receives actual knowledge”, he has to remove the information within 36 hours from the display but preserve it as evidence for legal purposes.

This applied to mainly websites including Facebook or Twitter which “Publish” Content. Initially some intermediaries interpreted this as if it was a mandate to remove the allegedly offending content within 36 hours and the Government later on clarified that the Intermediary need not take a judgmental view of what is right or wrong but has to wait for a judicial order.

Now the Government says that they are modifying this rule consequent to the Shreya Singhal Judgement. Accordingly the sub section 4 has been removed and a new sub section 4 along with some modifications in sub section 5 has been introduced.

Also the sub section (8) clarifies that the “Actual Knowledge” refers to receiving a Court order or a notification from an appropriate Government agency.

Now, it will be necessary for the Intermediary to send “Monthly Reminders” to the users that in case of non compliance with rules and regulations and user agreement and privacy policy the service access may be terminated.

Comment: While it appears that this will introduce a new responsibility for monthly reminders to the lakhs of subscribers which some of the intermediaries like Facebook, Google or WhatsApp may have, it can be implemented with a monthly customization of access involving a pop up notice instead of sending an e-mail notice.

One advantage of this monthly notification rule is that whenever the policy is changed by the service provider, he will have a monthly window when he can inform the user with a link to the new version of the policy. This will prevent the obnoxious policy of a policy or terms of service being modified without a notice to the users. Though this notice of modification is mandatory for contractual purpose, the proposed monthly alerts can be a good approximation to meeting this obligation of notice of change.

Under Sub rule 5 it is now clarified that the intermediary is obliged to respond to an assistance for information as asked by an appropriate Government agency when required by a “lawful order”. It is necessary that such request is made in writing (including electronic) stating the purpose and the information required and the intermediary shall enable tracing the originator of the message.

Comment: This provision is nothing new since such powers of requesting for information under Sec 69B or CrPC was already available to the law enforcement agencies including the Courts. There is better clarity now.

Though some intermediaries may have some issues in recording IP address and other log information associated with the messages/posts it is easily done as observed by the server of the service provider. Obviously, if the server does an “Anonymization” of the user, then they have the need to answer the law. If the user has spoofed the identity, then the service provider may not be generally liable except to the extent of identifying spoofing attempts as part of the “Reasonable Security Practice”.

For example when a “Phishing” mail is sent by a person from a server which is different from what it appears to be in its name, the e-mail provider or the message receiving server needs to identify that the sending device identity does not match with the published identity and hence the message is suspicious. Already many mail servers have implemented verification of the signature of the previous sender and this system needs to be extended to other cases as part of the compliance requirements. (Look forward to more clarification from my tech friends).

Another interesting aspect of the notification is Rule 7 which states that intermediaries with more than 50 lakh users in India or specifically notified by the Government should be companies incorporated in India, have a permanent registered office and have a nodal point of contact.

Comment: Just as the debate on the Data Localization, I am sure that this rule will be fiercely contested by the industry giants. But this is a clever move of the Government which also has an impact on the “Data Protection regulations”.

I have in the past made references to the non availability of identifiable representatives of Facebook and Google in India when an abuse had to be reported and we have often observed that Police are told by these companies that their services are handled from USA subject to the laws of USA and hence all law enforcement queries have to be directed to them.

This rule therefore is the single most critical measure that may improve the law enforcement capability in India where companies such as Google, Facebook, WhatsApp, PayPal, and many others may have to open their India subsidiaries and be subject to Indian law enforcement supervision.

…. To be continued

Naavi

Previous Articles:

Posted in Cyber Law | 2 Comments

Intermediary Guidelines.. Who is and who is not an intermediary?

Posted on December 25, 2018 by 98410spice

The following are the comments from Naavi.org on the proposed modified rules under Section 79 of ITA 2000/8 released for public comments on 24th December 2018.

After the passage of amendments to ITA 2000 in December 2008, which was notified with effect from 27th October 2000, a notification was released under G S R 314(E) dated 11th April 2011. This notification was called ” Information Technology (Intermediate guidelines) Rules, 2011 and laid out the requirements of “Due Diligence” to be followed by “Intermediaries”.

Who is and Who is Not an “Intermediary”?

The Intermediaries are defined under Section 2(w) as follows:

“Intermediary” with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes.

The intermediaries includes the many IT giants such as the Google, Facebook, WhatsApp etc.

Though some of the E Commerce websites may also be treated as “Intermediaries” and Banks have also tried to wear this hat some times to claim exemption of liabilities for cyber crimes, it must be noted that the definition applies to those organizations who process third party information without “initiating the transmission”, “Selecting the receiver of the information” or “Select or modify the information contained in the transmission” . (Refer section 79(2)).

In other words, most of the intermediaries who today interfere with the messages passing through them by trying to use the content for their own benefit including for advertising purposes lose the status of an “Intermediary”. They become users of the information passing through them and would fall under “Due Diligence” or “Reasonable Security Practices” as required under Section 43A of the ITA 2000/8. (This aspect needs to be kept in mind when Section 43A is removed with the introduction of PDPA 2018)

It is not a Section for Exemption..But for defining Due Diligence

While Section 79 has often been interpreted as a section which provides “Exemptions to Intermediaries” from liabilities, it must be remembered that it actually extends all the liabilities under ITA 2000/8 that may be attributed to a computer/human resource owned by an organization to the organization itself and also triggers the liabilities under Section 85, if the conditions under Section 79(3) are not fulfilled.

According to Section 79(1), an intermediary shall not be liable for any third party information, data, or communication link hosted by him only if the provisions of sub-sections (2) and (3), are fulfilled”.

Sub section (2) clarifies who is an intermediary and Sub section (3) talks of conspiracy, abetment and assistance including inducement and threats and the action to be taken on receipt of knowledge.

Before we start discussing the Guidelines issued by the Ministry now, it is essential for all of us to be familiar with Section 79 since the rules are to be interpreted within the provisions of the Act/Section and cannot be ultra vires the Act itself. If the “Rules” try to change the “Act”, it has to be held invalid.

Possibility of Mistakes by the Court

In the course of the discussion of the new rules, some members of the media have referred to the Shreya Singhal judgement which resulted in the scrapping of Section 66A which remains a symbol of the inability of the honourable Supreme Court to appreciate the need of certain parts of the law.

This has been extensively debated earlier and we would not like to digress here except to highlight that Supreme Court is amenable to be misguided by Vocal PIL Advocates into decisions which are short sighted and it has to guard itself against such attempts in every case where a political motivation is evident.

It is often observed that lawyers who are supposed to be “Servants of the Court” and assist the Judges in arriving at a truth through a judgement, often resort to complete falsehoods in trying to justify their client’s interest bordering on committing a “Fraud on the Court”. The Court cannot therefore drop its vigilance and go entirely by the averments of the advocates.

The silence of the defense advocates which lead to some recent wrong decisions was also evident in the withdrawal of some tender notifications by UIDAI on media monitoring which were wrongly projected in the Court as a possible violation of Privacy and the Court appeared to concur with it.

While Courts are required to adjudicate on genuine differences of views on legal issues they often are called upon to adjudicate on differing political views. If the Court is not fully conscious of this possibility, there could be slip ups which come to haunt them later and adversely affect the reputation of the judiciary either for their in efficiency or for bias.

The recent Aadhaar judgement which inter-alia killed the e-Sign system of authentication, which many of the experts who support the judgement never realized, is another example of how the Court may be driven into an incorrect decision with a blinkered vision particularly when the matter can be linked to a “Constitutional Right”.

Now a days, every politician including the enemies of the State have become conscious of their rights under the constitution and drag Supreme Court to sit in judgement of every administrative order issued by the Government. This is a gross misuse of the resources of the Supreme Court.

Though the current CJI has been conscious of the fact that the precious time of the Court is being wasted in politically motivated cases, we need to still witness the courage of the Court to put its foot down on frivolous and politically motivated litigation which are brought up only to gain media attention and score a political point.

The PIL filed by advocate Mr M.L. Sharma on the MHA notification on Section 69 will be a test case on whether the current Supreme Court does exhibit its resolve to focus on the more important matters of the Citizens or devote most of its energies to satisfy the political debates in the garb of upholding the constitutional rights of citizens. (This requires a separate debate which we shall do shortly).

It is one of the strategies of the opposition to engage the Court in such a manner that more important cases gets relegated hopefully until the Government changes. Citizens are watching if the Supreme Court is conscious of this clever manipulations.

We hope there would not be one more PIL on the proposed Section 79 rules and all those who have a view will try to place their comments with the Ministry rather than going straight to the Court.

While we donot expect everybody to accept the views presented here, I suppose these views would be considered before they come to their own conclusions.

So…let us proceed further on the proposed changes in the intermediary responsibilities…

…. To Be Continued

Naavi

Previous Articles:

Posted in Cyber Law | Tagged Intermediary rules, section 79 | 3 Comments

Draft Intermediary Guidelines 2018… Public Comments invited

Posted on December 25, 2018 by 98410spice

The Government of India has released a draft Intermediary guidelines 2018 under Section 79 of Information Technology Act 2000 (ITA 2000/8) for public comments before January 15th. (Refer here).

The notification records that a calling attention motion on “Misuse of Socal Media platforms and spreadig of fake News” was admitted in the Parliament (Rajya Sabha) in 2018 (Monsoon session) and the Hon’ble Minister for Electronics and IT, responding to the calling attention motion on 26/07/2018, made a detailed statement where he inter alia conveyed to the House the resolve of the Government to strengthen the legal framework and make the social media platforms accountable under the law.

The department (MeitY) has now prepared the draft Information Technology (Intermediary Guidelines) Rules 2018 to replace the rules notified in 2011.

Comments and suggestions can be sent to gccyberlaw@meity.gov.in, pkumar@meity.gov.in, and dhawal@gov.in.

The Copy of the proposed guideline is available here.

As has been the trend of politics today, there has already been comments by many politicians that this is an attempt at the Government trying to take control of the social media as a part of the strategy to win elections etc. It appears that the politicians are only exposing their ignorance of law and bias by making extreme comments which are misplaced.

These comments supported by some of the known biased journalists will be spreading disinformation to the extent possible. For the time being let us ignore these comments.

We will try to explain the changes and put out our views in this regard.

Naavi

PS: As per the addendum released on 31/12/2018, the public comments released upto 15th January 2019 would be placed on the website on 18th January 2019 and a 10 day period upto 28th January 2019 would be allowed for receiving counter comments if any…. Group Cordinator, gccyberlaw@meity.gov.in

Posted in Cyber Law | 1 Comment

The Second Awakening… What is there in Rules of Oct 27, 2009 on Section 69?

Posted on December 23, 2018 by 98410spice

[This is in continuation of the previous article on the subject]

(P.S: These discussions are called the “Second Awakening” because though ITA 2000 came into existence on 17th October 2000, the stake holders and more particularly the IT industry never recognized that there was a law that required a closer look as part of their compliance requirements. It was only in April 2011 when the rules under Section 43A was notified, that the industry woke up to the existence of this law. This was the first awakening. Then everybody went to sleep once again. Today there is greater recognition of GDPR and the proposed PDPA than the currently prevailing ITA 2000/8. The current controversy which was politically motivated and arose out of a simple sub notification has suddenly created a flutter in the IT industry which I have called the Second Awakening.)

Background:

In the previous article, I referred to Section 69 of ITA 2000/8 which empowers a competent authority to authorize “Interception, Monitoring and Decryption” of electronic information through any computer source.

There was a notification of a rule titled “Information Technology (Procedure and
Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009″ on October 27, 2009.

A Controversy has now broken out after the Ministry of Home Affairs came up with a notification on 20th December 2018 stating that they are designating 10 agencies to carry out Interception, Monitoring and Decryption.

The notification has been wrongly interpreted by members in the political community as a move to create a Police State in India before the next general election and a challenge to Privacy. The controversy has gained traction because the professionals also were unaware of the law as it existed and what this notification actually meant and in their eagerness to support Privacy, the technical circles also went with the politicians in criticizing the MHA order as a draconian move to upstage the Puttaswamy judgement of Supreme Court on Privacy. Media as usual went with their TRP objective to create a fire where there was none. The legal activists are already preparing their petition to move the Supreme Court after the vacation to get the Section 69 of ITA 2000/8 squashed a-la Section 66A.

I completely disagree with the false narrative being created in this regard and tried to explain the legal position related to Section 69. The narrative has taken political over tones and most of the professionals are not comfortable in expressing their views if it opposes Rahul Gandhi’s Congress because they are afraid that if Congress comes to power ever, it could hold a grudge. On the other hand we know that Mr Modi and BJP is too soft and anything can be said against them.

Readers of this blog who think I am expressing political views may excuse me since it is difficult to remain silent when Rahul Gandhi, Asaduddin Owasi, Omar Abdulla, Anand Sharma or Gulam Nabhi Azad etc start interpreting Section 69 of ITA 2000 and the regulations there under to create a fake narrative for their political gain. Kindly leave the political comments and focus on what I would like to say on the law as it appears to me.

I pointed out in my previous article that section 69 of ITA 2000/8 gave certain powers but they were within the exceptions under Article 21 of the Constitution, (Refer: Academike)

According to the Article 21, no person shall be deprived of his liberty “Except according to a procedure established by law”.

It is the duty of the Government to define what is the procedure to be followed if this exception has to be exercised. Not providing such procedure would tantamount to “Dereliction of Duty”.

Privacy is admittedly not an “Absolute Right” and is subject to reasonable restrictions .

Section 69 is an attempt to define the “Due Legal Process” and incorporates adherence to the reasonable restrictions principles.

Hence Section 69 is well within the powers of the Government (remember, it was passed by the UPA Government).

Having enacted Section 69 with effect from 27th October 2009, it was incumbent on the Government to expand the provisions of the section into a more detailed rules which was also promptly done by the UPA Government with its notification of October 27, 2009.

What does the Notification of 2009 contain?

This notification has 25 different clauses. The clause headings are reproduced below.

Short title and Commencement
Definitions
Direction for interception or monitoring or decryption of any information
Authorization of agency of Government
Issue of decryption direction by competent authority
Interception or monitoring or decryption of information by a state beyond its jurisdiction
Contents for direction
Competent authority to consider alternative means in acquiring information
Direction of interception or monitoring or decryption of any specific information
Direction to specify the name and designation of the officer to whom information to be disclosed
Period within which the direction shall remain in force
Authorized agency to designate nodal officer
Intermediary to provide facilities, etc
Intermediary to designate officers to receive and handle
Acknowledgement of instruction
Maintenance of records by designated officer
Decryption key holder to disclose decryption key or provide decryption assistance
Submission of the list of interception or monitoring or decryption of information
Intermediary to ensure effective check in handling matter of interception or monitoring or decryption of information
Intermediary to ensure effective check in handling matter of interception or monitoring or decryption of information
Responsibility of Intermediary
Review of directions of competent authority
Destruction of records of interception or monitoring or decryption of information.
Prohibition of interception or monitoring or decryption of information without authorization
Prohibition of disclosure of intercepted or monitored, decrypted information.

Even without going into the details of these 25 clauses, I suppose the professional critics of the MHA notification will realize that this notification does address all the concerns that the critics have raised from the Privacy perspective.

The MHA order was made under rule (4) above which stated

Authorisation of agency of Government.— The competent authority may
authorise an agency of the Government to intercept, monitor or decrypt information
generated, transmitted received or stored in any computer resource for the purpose
specified in sub-section (1) of section 69 of the Act.

So far no such agency had been designated and therefore the Competent authority had a wide power to designate any public or private body for the purpose of exercising its rights albeit the other restrictions.

By designating 10 agencies now, the Government has curtailed the powers of the Competent authority significantly.

Who is the Competent Authority?

According to rule 1(d), Competent authority means (i) the secretary in the Ministry of Home Affairs in case of the Central Government and (ii) the Secretary of the Home Department in case of the State Government or a Union Territory as the case may be.

The jurisdiction of the state authority lies within the State and where interception etc is required in a different state, the state authority has to work through the MHA.

Is there a proper Over view

The Competent authority has to issue a written order and name the person to whom the information has to be disclosed, containing the reason for the necessary action. This has to be forwarded also to a review committee within 7 days. The order itself lapses in 90 days unless extended and can be extended to a maximum of 6 months.

The Review committee is the Review Committee constituted under rule 419A of Indian Telegraph Rules 1951 and should meet once in two months.

The Review committee consists of the Cabinet Secretary (Chairman) and the Secretary legal affairs and Department of Telecommunications in respect of the Central Government and the Chief Secretary (Chairman) and the law secretary and another secretary other than the Home Secretary).

Under rule 24, any person who violates any of the provisions of this order is liable for punishment.

I interpret this as an authorization to not only launch Section 43 and 66 proceedings in case of “Unauthorized access or disclosure”.

This also provides for judicial overview in case there is any violation of the order.

Destruction of Records

Under Rule 16, the designated officer has to maintain proper records of compliance. But the monitored information need to be destroyed after 6 months according to the rule 23.

I have in the past indicated my view that if the information becomes an evidence of a crime, the record may be deemed as evidence and needs to be preserved.

The rule 25 prohibits disclosure of information monitored except as per the order.

Judicial Challenge is not even worth Admission

Thus we can see that there is enough checks and balances built into the rule to satisfy any legal requirements and therefore if this order is challenges in the Court and if the Court is aware of the legal provisions, then the challenge should be not even admitted.

Misinterpretation that the Agencies have been given power

We need to recognize that the MHA order does not provide any powers to the agencies to conduct their own investigations. Such an impression if created is wrong.

The only authority that can order the interception is the Secretary Home. The agencies are those through which such information can be collected by the competent authority.

Any person including the agency itself if it requires monitoring, has to approach the Competent authority, get a written order and proceed.

There are of course certain emergency powers where monitoring can be started before the authority issues a written order and they are dealt with separately under Rule 3 as emergency powers.

I request all my professional friends to go through the above and let me know if any further doubts remain in their mind that the perception being circulated in the media is blatantly false and malicious.

Naavi

The Second Awakening… What is there in Rules of Oct 27, 2009 on Section 69?
The Second Awakening… What is Section 69?
Snooping and Section 69 of ITA 2000: Beyond Politics, Distrust and Passion..The second awakening
Agencies empowered under Sec 69. No Need to raise a false alarm

The MHA Notification
Section 69
Section 69 Rules of 2009

Articles on ITA 2008 written in 2008/9