M-Governance Policy Of India

Mobile governance (m-governance) is an innovative method of using mobile technologies for effective governance and public services delivery. M-governance facilitates many public services in almost real time and without hassles. However, along with the benefits of m-governance it has many drawbacks as well.

Firstly, we have no implementable m-governance policy in India. In the absence of proper planning and a sound m-governance policy it is not a wise option to utilise m-governance services in India.

Secondly, we have no dedicated legal framework for m-governance in India. This may create problems in cases of mobile banking, m-governance, m-commerce, etc. Of course, we have information technology act 2000 (IT Act 2000) as the cyber law of India yet it is far from perfect for even e-governance purposes and it is not at all applicable to m-governance environment.

Another issue pertains to the exercises of e-surveillance and phone tapping by Indian government and its agencies. Till now we have no lawful interception law in India. Phone tapping is done under the colonial and outdated Indian telegraph act 1885 and e-surveillance is done under the IT Act 2000. Both these acts are violating the letter and spirit of Indian constitution and have incorporated many unconstitutional provisions that are well beyond the parliamentary and judicial scrutiny.

Recently, the ministry of communication and information technology (MCIT) has launched the central monitoring system project of India. It has the capabilities to monitor all sorts of telecommunication and electronic communications. However, it is a pure executive exercise with no legal framework, civil liberty safeguards and parliamentary and judicial scrutiny.

At the international level some development for safeguarding the human rights in cyberspace has been taking place. United Nations has declared that access to Internet is a human right. This shows that human rights protection in cyberspace cannot be ignored by nations in future.

Finally, m-governance cannot succeed till we ensure cyber security for m-governance in India. Till now even the basic level cyber security is missing in India and we have no cyber security policy in India. Further, the IT Act 2000 need to be suitably amended or a dedicated legislation for m-governance must be enacted in India.

All these issues are integral part of the m-governance policy of India. Before jumping upon the fancy idea of m-governance we must ensure that it can operate and flourish in India.

Central Monitoring System Project Of India

Central Monitoring System Project of India (CMS Project of India) is a very crucial project to safeguard Information and Communication Technology (ICT) related security and e-surveillance issues in India. It is mooted by the Central Ministry of Communication and Information Technology (MCIT).

The aim of CMS Project of India is to have a “Centralised Mechanism” where Telecommunications and Internet Communications can be analysed by the MCIT, Indian Government and its Agencies. Some have called this mechanism as the Internet Kill Switch of India where Internet Communications all over India can be suspended through this mechanism.

Recently, the United Nations declared “Right to Access” to Internet as Human Right. This would have a positive impact upon many Human Rights in Cyberspace. For instance, Right to Speech and Expression, Right to Privacy, Right to Know, etc cannot be violated by the CMS Project of India. United Nations must expand Human Rights Protection to many more issues.

This is the real problem for the CMS Project of India. We have no dedicated Privacy Laws in India, Data Security Laws in India and Data Protection Laws in India. Further, the CMS Project of India is also beyond the “Parliamentary Scrutiny”. The Cyber Law of India, incorporated in the Information Technology Act 2000 (IT Act 2000), was drastically amended through the Information Technology Amendment Act 2008 (IT Act 2008).

The IT Act 2008 incorporated various “Unconstitutional Provisions” in the Cyber Law of India that clearly violates the Human Rights in Cyberspace. For instance, provisions regarding Internet Censorship, Website Blocking, Encryption and Decryption, etc have no inbuilt “Procedural Safeguards” as mandated by the Constitution of India. This is the reason why the Cyber Law of India needs to be repealed.

Further, we have no E-Surveillance Policy in India. Even Phone Tapping in India is done in an “Unconstitutional Manner” and even by private individuals with or without Governmental approval.

If CMS Project of India has to be “Legal and Constitutional” it must be subject to “Parliamentary Oversight”. Further, the IT Act 2000 must be repealed as soon as possible as it is clearly not in conformity with the Constitution of India and Civil Liberties Protection in Cyberspace.

Of course, if India Government persists in this “Unconstitutional Approach”, taking recourse of “Self Defence Measures” is not a bad option. Rather that remains the “Sole Option” when our Parliament, Executive and Judiciary fail to protect Fundamental Rights enshrined in the Constitution of India and the Human Rights Charter of United Nations.

Proposed Draft Right To Privacy Bill 2011 Of India

Right to Privacy is a very important Human Right. For long India ignored this important Civil Liberty despite demands for the same. Finally, Supreme Court of India interpreted Article 21 of the Constitution of India as a “Constitutional Source” of Right to Privacy in India.

Now Right to Privacy is a Fundamental Right in India. However, exercise of a Fundamental Rights is very difficult in India without a support of a “Statutory Right” in this regard. This is the reason why we need to enact a Statutory Law on Right to Privacy in India.

Privacy Rights have become even more important in this Information Era where Privacy of Netizens is in real danger. Indian Government has launched various Projects like Aadhar, NATGRID, CCTNS, Central Monitoring System (CMS), etc that are openly violating the Civil Liberties, including Privacy Rights, of Indians. This has forced the Law Ministry to consider enacting a Privacy Law of India.

Law Ministry has proposed a Right to Privacy Bill of India 2011. Surprisingly, the draft of Right to Privacy Bill of India 2011 has still not been made public so its analysis is not possible. However, this is a good beginning and I welcome this step of Law Minister Veerappa Moily.

I am not sure whether Human Rights in Cyberspace have been considered by the proposed draft Right to Privacy Bill of India 2011. However, Law Ministry must incorporate Privacy Rights in Cyberspace in the proposed Bill to make it effective and meaningful.

Privacy is very important for having peaceful and confidential phone conversations, e-mail communications and other forms of electronic communications. Indian Government has launched various Projects that can openly indulge in Unconstitutional Phone Tapping and Illegal E-Surveillance that also without any “Judicial Scrutiny”.

In the absence of Judicial Scrutiny and Privacy Laws, Indian Citizens are left with no choice but to use “Technological Self Defence Measures” to protect their Privacy Rights, especially in Cyberspace. Even this is not acceptable to Indian Government as it is harassing service providers like Blackberry, Gmail, Skype, etc that are using Encrypted Measures to protect Privacy Rights and to ensure Security. This is just like committing a wrong and then taking advantage of the same to one’s own benefits.

I hope this time we would finally have a Privacy Law of India as in the past as well many times it has been declared that Privacy Law for India would be enacted.

CCS Did Not Approve Natgrid Project Absolutely

National Intelligence Grid (NATGRID) Project of India is still in troubled waters as lack of Privacy Laws and Data Protection Laws has put it in doldrums. Media reports are full of rumours that the Cabinet Committee on Security (CCS) has cleared the NATGRID Project. However, this is not true as CCS has just granted the “in principle approval” to NATGRID Project and nothing more.

In the past as well in principle approval was given to NATGRID Project but it was not able to proceed as it lacks the basic Planning, Management and Legal Framework. Even today and after the in principle approval of CCS, NATGRID Project is still without any Legal Framework and Parliamentary Oversight.

Further, the CCS has granted its approval to NATGRID Project for “Limited Purposes” only. CCS has allowed NATGRID to operate for “Limited Phases” only that also where the same can operate within the limits of present Legal Framework. For subsequent stages, NATGRID has “not been approved” till “Suitable Amendments” are made in the Laws of India.

Experts in India have been saying that NATGRID Project of India must comply with Civil Liberties in order to be Legal and Constitutional. Fortunately, the CCS has also “Endorsed” this view and this is the reason why it did not give permission for subsequent and “Final Phases” of NATGRID Project. The CCS has just cleared first two “non-controversial phases” and it is still holding back nod for later phases that require Legal Alterations

The real problem with India is that it is not respecting Human Rights in Cyberspace. We have no E-Surveillance Policy in India and Lawful Interception Law in India is missing. Phone Tapping in India is not done in a Constitutional manner and Laws like Information Technology Act 2000, Official Secrets Act, Indian Telegraph Act 1885, etc are “no more constitutional” and deserve to be repealed.

It is only now that India has started paying attention towards issues like Privacy Laws but even these efforts lack Protection of Civil Liberties in Cyberspace and Protection of Privacy Rights in the Information Era.

NATGRID Project of India would not be finished before Five Years in these circumstances. This is despite the claims of Home Minister P. Chidambaram. If NATGIRD Project is finished before that time period and within the present Legal Framework it means only two things. Either the CCS has “forsaken” the Civil Liberties of India Citizens or Home Ministry is operating the NATGIRD Project “Illegally and Unconstitutionally” and without the knowledge of CCS.

Privacy Rights In India In The Information Age

We have no Dedicated Privacy Laws in India and Data Protection Laws in India. In fact, when it comes to respecting Privacy of Indian Citizens, Government of India tries its level best to avoid the same.

For instance, India has launched Projects like Aadhar, National Intelligence Grid (NATGRID), Crime and Criminal Tracking Network and Systems (CCTNS), National Counter Terrorism Centre (NCTC), Central Monitoring System (CMS), Centre for Communication Security Research and Monitoring (CCSRM), etc. None of them are governed by any Legal Framework and none of them are under Parliamentary Scrutiny.

Further, India is the only country of the World where Phone Tapping and Interceptions are done without a Court Warrant and by Executive Branch of the Constitution of India. Phone Tapping in India is “Unconstitutional” and the Parliament of India has not thought it fit to enact a “Constitutionally Sound Law” for Phone Tappings and Lawful Interceptions. Even the Supreme Court’s directions in PUCL case have proved futile and presently the Court is dealing with the issue once more.

Phone Tapping in India has been in controversies for long. Whether it is Illegal Phone Tapping by Private Individuals or Unaccountable Phone Tapping by Indian Government and its Agencies, Phone Tapping in India has never been smooth.

There is a blessing in disguise in Ratan Tata’s Petition before Supreme Court of India. This is a golden chance for the Supreme Court of India to analyse the “Implementation” of its decision in the PUCL case (Phone Tapping Case). The Supreme Court must “Widen” the scope of Privacy Rights in India not only in the context of Phone Tapping but in an “Overall Manner”. The Supreme Court must formulate and lay down the widest possible “Guidelines” regarding Privacy Protection in India as it has done in the Vishaka’s Case (Guidelines against Sexual Harassment). The Supreme Court has even said that with the Technological Advancement, Privacy is virtually disappearing.

On the front of Legal Framework as well we have no Dedicated and Constitutionally Sound Lawful Interception Law in India. The Indian Telegraph Act, 1885 and other similar Laws are not in “Conformity” with the Constitution of India, especially Fundamental Rights of Indians. Even the Home Ministry of India is considering enactment of a Lawful Interception Law in India.

However, what is more surprising is the fact that the Law Enforcement Agencies and the Intelligence Agencies that indulge in Unconstitutional E-Surveillance and Phone Tapping are themselves Governed by No Law. It is no surprise that the Central Bureau of India (CBI) is also not governed by any Law and it is operating in India Without any Law. It is only now that the Central Bureau of investigation act 2010 was drafted. Till now it is a mere draft and has not become an enforceable law. Even the Constitutional Validity of the National Investigation Agency Act 2008 is doubtful. Even the Draft Intelligence Services (Powers and Regulations) Bill, 2011 has been recently circulated in the Parliament of India. India must urgently formulate E-Surveillance Policy so that the E-Surveillance conducted by Intelligence Agencies and Law Enforcement Agencies of India can be regulated.

Surprisingly, India has no E-Surveillance Policy and Legal Framework. This is despite the fact that many Indian Projects are so S-surveillance Oriented that they cannot pass the scrutiny provisions of Indian Constitution. Of all these E-Surveillance Projects Aadhar Project of India or Unique Identification Project of India (UID Project of India) is the most “Dangerous Project” that should not be there at the very first place. It is based upon Deceit and Deception and both Indian Government and Unique Identification Authority of India (UIDAI) are Hiding Truth from Indians. There is no Legal Framework, no defined Policies and Guidelines and most importantly no Procedural and Civil Liberty Safeguards.

If this was not enough the sole Cyber Law of India (Information Technology Act 2000) was amended through the Information Technology Amendment Act 2008. The IT Act 2008 made the Cyber Law of India an “Unregulated and Unaccountable” piece of E-Surveillance Legislation. It is now wide open to misuses by Indian Government and its Agencies. Further, the IT Act 2008 also violated various provisions of Indian Constitution and hence is “Unconstitutional” as well. Ideally Cyber law Of India must be repealed as soon as possible.

If Parliament of India has abdicated its duties and Indian Judiciary is watching as a moot spectator, it becomes of paramount importance for Cabinet Committee on Security (CCS), Union Cabinet and Prime Minister’s Office (PMO) to “Disallow” all such Projects till proper Civil Liberty Safeguards and Legal Frameworks are at place.

Telecom Equipments Security Framework Of India

Telecom equipments, especially imported one, have been in controversy for long. The security agencies of India have shown their apprehension regarding imported telecom hardware and equipments. For some time, even import of the same was hampered.

This is primarily due to the fact that India has no telecom security policy that must essentially carry norms for import of telecom equipments and hardware. Meanwhile, it has been proposed to get the telecom equipments checked by Telecom Engineering Centre (TEC) mandatorily before use in India. Now intelligence agencies of India are asking telecom companies to store call data records for five years.

The Department of Telecommunications (DoT) has approved new security norms governing telecom equipment that could cost operators at least Rs 5,000 crore each to implement. DoT has unveiled a new telecom security framework that did away with many existing controversial clauses such as mandating foreign equipment companies to put their software in the equivalent of a sealed envelope and submit it to the government.

Another controversial clause that stipulates penalties of 100% of the contract value on vendors if any spyware or malware is found in the imported equipment has also been dropped. Instead, any security breach will invite a maximum penalty of 50 crore in addition to criminal proceedings against the mobile phone company.

The new policy also dilutes the earlier rule that mandated vendors to employ only Indian engineers to maintain the networks of local mobile phone companies. The fresh norms say only top personnel with vendors need to be Indians. The names of these individuals will have to be cleared by the telecom and home ministries prior to their appointment. This is in line with the rules for mobile phone companies where top executives are required to be resident Indians.

Besides, with phone tapping in the limelight, the changed policy also mandates that mobile phone companies must only appoint Indians as chief technical officer, chief information security officer or as nodal executives for handling monitoring and interception functions across mobile networks.

The new framework is a good step in the right direction. Perry4Law and Perry4Law Techno Legal Base (PTLB) welcome this effort of DoT. However, this is just a piecemeal effort and DoT must come out with a proper telecom security policy of India as soon as possible.

Illegal Phone Tapping In India Under Scrutiny

Phone Tapping in India has been in controversies for long. Whether it is Illegal Phone Tapping by Private Individuals or Unaccountable Phone Tapping by Indian Government and its Agencies, Phone Tapping in India has never been smooth.

On the front of Legal Framework as well we have no Dedicated and Constitutionally Sound Lawful Interception Law in India. The Indian Telegraph Act, 1885 and other similar Laws are not in “Conformity” with the Constitution of India, especially Fundamental Rights of Indians. Even the Home Ministry of India is considering enactment of a Lawful Interception Law in India.

On the top of it we have Central Monitoring System of India (CMS of India). It is suffice to say that this Unconstitutional Phone Tapping in India and Illegal E-Surveillance in India is a “Constitutional Failure of India”. India urgently needs a Valid Phone Tapping Law.

Now the Central Government has shown some concerns regarding Illegal Phone Tapping happening openly in India. The Centre has asked the Government Agencies and State Governments to return all surveillance equipment. The Home Ministry of India has now issued directions in this regard.

All Central and State Monitoring Agencies have been told to return any GSM equipment used for illegal tapping of phones back to the Department of Telecommunications (DOT). A secret MHA advisory to all State Police Departments says there will be crackdown on private individuals as well, which means Corporate India is included.

A DOT advisory dated December 31, 2010 to return the illegally imported equipment had evinced a poor response. In fact, till six months ago, passive interception machines could be easily imported under the Open General Licence. It's now been placed in the restricted list.

The Department of Revenue Intelligence suspects there are over 1100 machines that have been imported in the past 3 years alone. But the exercise could be a shot in the dark as the end users of these machines are still being traced. In fact, an internal audit by the CAG of the NTRO had revealed that these machines were placed more frequently in cities rather then the international borders or even in naxal or insurgency hit areas - for which they were acquired. This has given rise to suspicion that they were being used for tapping political and corporate rivals. Let us see how effective these directions of Home Ministry would be in preventing Illegal Phone Tapping and E-Surveillance in India.

CBDT Can Continue To Request Phones Tap In India

Phone tapping in India has been in controversies recently. Whether it is phone tapping by private individuals or public distribution of tapped conversations, Indian government has been in controversies.

In a recent development, the Prime Minister’s Office (PMO) has authorised the Home Ministry to take the final call on the contentious issue of withdrawing the CBDT’s powers of phone-tapping.

Now it has been reported that the CBDT will continue to enjoy the power to request telephone tapping despite a strong recommendation by a Committee of Secretaries against it. However, it is not immediately clear the conditions the CBDT will have to fulfill before requesting the tapping of telephones of any individual.

Suggestions for removal of CBDT from the agencies that can request phone tapping were given believing that tax evasion cases neither have criminal liability nor any national security issue as these were only civil matters.

The panel recommended either removal of the CBDT from the list of authorised agencies that can request telephone interception as the income tax laws fall within civil jurisdiction and do not always impinge on the public safety or to specify stipulations regarding the extent of surveillance allowed to the agency, including the level at which requests are to be made for authorisation by the Home Secretary. However, we have still to deal with lawful interception law in India.

There is an urgent need to formulate effective and constitutional lawful interception law in India. Lawful Interception is a process that “Reconciles” the Law Enforcement requirements and Civil Liberties of a Nation. In the Indian context, we have no Lawful Interception Law in India. By Lawful Interception Law it means a “Constitutionally Sound” Lawful Interception Law and not the present “Self Serving Laws” of India like Indian Telegraph Act 1885.

If we have a clear cut law, this turf war between various Ministries of India can be avoided. Presently, phone tapping is not regulated by a clear cut and constitutional law.

Is Cloud Computing A Viable Solution In India?

India is a country that is weak privacy, data protection and data security laws. India is also infamous for its e-surveillance and eavesdropping exercises without any constitutional laws backing the same. Phone tapping in India is not done in a strictly constitutional manner and we also lack a lawful interception law in India.

With the information technology amendment act, 2008 (IT Act 2008), the cyber law of India has been amended and this has also made it vulnerable to constitutionality attacks. With projects like national intelligence grid (Natgrid), crime and criminal tracking network and systems (CCTNS), central monitoring system (CMS), etc e-surveillance in India has reached its zenith.

In this background we have to analyse the use of cloud computing in India. Cloud computing in India cannot succeed till we have trust in the service provider. We cannot trust a service provider who can be forced to disclose even the most sensitive information and data without a court order.

In India a mere order from the Indian government or its agencies is enough for the service provider to share sensitive information. There is no judicial scrutiny of a warrant that is absolutely required in these circumstances. So you cannot be even sure what government agencies are looking at and what information they are taking from the service provider.

Any business model must essentially balance profit motives and risks associated with the business. Similarly, the users of cloud computing services must ensure that the convenience of software as a service (SASS) and cloud computing is much greater than the risks of data leakages and manipulations.

Till now the legal opinion is weighting against the use of cloud computing and SAAS in governmental departments and for governmental projects. Without a conducive legal framework, user’s data in India is not safe. Let us create a conducive commercial and legal environment before we jump upon cloud computing wagon.