In the space of two decades, encryption has gone from being a heavily restricted technology falling under the arms-control regime, to becoming a key enabler of all online communications and commerce. India’s regulations concerning encryption, however, continue to be sclerotic and in some ways hearken back to the wild days of the 1990s crypto wars. As India currently scrambles to update its laws and regulatory structures for the data-driven future, encryption is likely to become one of the most keenly contested fronts in the battle between privacy, commerce, and national security.

Current encryption regulations

India currently does not have any generally applicable restrictions on encryption. What it does have though is sectoral restrictions in areas such as telecom, as well as enabling laws that empower the government to issue general restrictions if it wants to.

Entities holding telecom licences in India (whether they’re pure internet service providers such as ACT Fibernet or full-fledged telcos such as Airtel or Vodafone) are subject to the most extensive encryption regulations. Most notably, they are prohibited from deploying ‘bulk encryption’ (a term that the Department of Telecom has unhelpfully left undefined) on their networks. Some telecom licences and associated guidance documents, including for telecom services such as international long distance (ILD) which carry all of India’s inbound and outbound internet and voice traffic, also contain an anachronistic provision restricting encryption key lengths to 40-bits.

Sectoral regulators such as the Reserve Bank of India or the Securities and Exchange Board of India have, on the other hand, thankfully gone in the other direction. They mandate minimum encryption standards for entities and transactions, acknowledging the key role played by encryption in enabling trust and security.

Separate from this, the Information Technology Act, 2000 (IT Act) contains a framework for more general regulation. Section 84A empowers the government to “prescribe modes or methods for encryption” by issuing rules. This was attempted in 2015 when the Ministry of Electronics & IT (MeitY) issued a disastrous ‘draft encryption policy’, which was withdrawn almost immediately due to a strong private sector and civil society opposition (along with, perhaps, the realisation that it was completely unworkable). While there have been rumours of a MeitY committee tasked with producing a new draft, there is no clarity on it or when such a draft will be released.

The IT Act also contains another wide provision in Section 69, which allows the government to issue directions for ‘decryption of any information generated, transmitted, received or stored in any computer resource’. Crucially, under this provision, an ‘intermediary’ (a wide term which covers telcos, online communications and social networking services, and others) is obliged to assist the government in any manner directed. Failure to do so can lead to fines and imprisonment of up to seven years. Interestingly, this provision appears never to have been used by the government, at least based on publicly available information.

Effect of these regulations

The combination of outdated laws and regulatory gaps has lead to ambiguity for the private sector, sub-optimal information security, and roadblocks to innovation.

For example, while telcos are not allowed to deploy ‘bulk encryption’, the same licence requires them to protect the ‘privacy of communication’ and ensure that ‘no unauthorized interception’ takes place. Both of these objectives cannot be achieved without strong encryption, but the licence provides no guidance on how to resolve this dissonance.

Staying with telcos, the 40-bit key length restriction is laughable, given that a modern consumer laptop would likely be able to break this level of encryption in minutes or even seconds. It is possible that this specific key length is taken directly from US regulation, where the National Security Agency and the software industry at one point came to an agreement to allow use of 40-bit encryption without a cumbersome export licence. There’s just one problem: this agreement was reached in the early 1990s, and was done away with in the US by the end of that decade. What this means for Indian telecom users though is that cellular voice and SMS traffic is vulnerable to off-the-air interceptors — this is particularly worrying given how SMS is now used ubiquitously as the second factor in authentication for critical services such as banking and payments, as well as in Aadhaar authentication.

Unlike telcos, internet-based services or applications (often referred to as over-the-top or OTT apps) do not face restrictions on the use of encryption. When it comes to security issues though, the government has shown a tendency to arm-twist in the shadows rather than regulate in a transparent and predictable manner. In 2012/13 the government picked a battle with BlackBerry (remember them?) over their encrypted email and messenger services. BlackBerry was not a telco and hence not subject to the encryption restrictions under the telecom licence. However, the government threatened to force telcos to cut off BlackBerry services unless the company deployed lawful interception equipment in India. BlackBerry eventually gave in, setting a precedent for back-room deals rather than moving the regulatory framework forward. While BlackBerry may have been a special case because of their tight integration with telcos, this is an incident that still gives tech companies pause when thinking about deploying encrypted products in India. Regulatory uncertainty can be a huge drag on business.

Finally, the actual government objective behind mandating weak encryption in telecom was presumably to make interception and surveillance easier. While this might have once worked, over the last decade practically all sensitive or personal communications have moved to heavily encrypted internet applications, which are technically not subject to these restrictions. It’s unclear whether India’s intelligence agencies have the ability to break currently ubiquitous strong encryption algorithms. While the capabilities of technical intelligence agencies such as the NTRO have not been clearly established, India is also known to be a customer of zero-day exploits on the international market. There’s little doubt though that the current regulations in this space do not help them significantly in such efforts and instead merely serve to make India’s telecom networks less secure against foreign attacks — leaving Indian citizens vulnerable to unauthorised surveillance.

Why is the encryption debate likely to resurface now?

Since the failed 2015 attempt to come up with an encryption policy, there have been few signals that this is an area of current interest for regulators. Why then is this a good time to start considering this issue again?

There are three obvious reasons. In the recent slew of draft legislation and policies that have been announced or leaked, encryption has featured in many. The TRAI (short for Telecom Regulatory Authority of India) recommendations on data privacy took a positive step in acknowledging that the telecom sector regulations on encryption desperately need to be updated, and it’s quite possible that the department of telecom will act on this recommendation. The draft e-commerce policy contains extensive data localisation provisions, along with a (perhaps related) recommendation for MeitY to fast-track work on a new encryption policy. The draft Personal Data Protection Bill mandates mirroring of personal data on servers physically located in India, with a major objective of this being law enforcement access to data. This objective does not take into account practical realities – the data on these servers will likely still be owned by a foreign entity, which will also hold the encryption keys. Without encryption-related regulation that works in tandem, the provisions of the Bill would only give Indian law enforcement agencies access to a locked box, without any way of opening it. Policymakers will eventually realise this, providing momentum to the dialogue around encryption regulation, even if there are no easy answers to this problem.

Secondly, end-to-end (E2E) encrypted communications platforms such as WhatsApp, and the role many consider them to play in the dissemination of inflammatory messages, are a major policy issue before the government at present. E2E encryption poses a unique problem (which also makes it uniquely secure), because the encryption keys are held only by the sender/receiver of messages, and not by the company running the platform, which possesses no ability to decrypt messages or otherwise view their content. In this ongoing regulatory battle, the threat of regulating encryption to mandate backdoors, weaken encryption, or outlaw E2E encryption altogether is a potent one. While there are a number of reasons why the government may eventually choose not to go down this path, in the medium term this will again provide impetus to debates around encryption and regulation.

Thirdly, global trends are keenly watched by Indian policymakers and they provide ample food for thought. Apple recently announced that iCloud data of Chinese users would be moved to servers in China operated by a Chinese partner company. Perhaps even more importantly, it has been confirmed that the encryption keys will also be held by the Chinese partner, which is obviously directly subject to China’s stringent cybersecurity laws which include a mandate to decrypt data when required. Also sure to have not gone unnoticed is the recent Australian draft law on encryption and law enforcement data access. This proposes a system where the government can compel encrypted platforms to build tools allowing secure access to law enforcement. While the bill would likely not force companies to break E2E encryption, it would still be a significant expansion of powers. And in the United States, the upcoming court battle between the FBI and Facebook over breaking encryption in its Messenger product promises to be even bigger than the 2016 FBI-Apple encryption case.

Are ‘keys under doormats’ inevitable?

The seminal 2015 paper ‘Keys Under Doormats’, authored by a group of highly respected security researchers and professionals, provides an authoritative exploration of the conundrums posed by strong encryption (including E2E encryption) and the possible technical and policy responses such as mandating backdoors, restricting encryption key-lengths, or key escrow. In their conclusion, the authors state that “this report’s analysis of law enforcement demands for exceptional access to private communications and data shows that such access will open doors through which criminals and malicious nation-states can attack the very individuals law enforcement seeks to defend” and acknowledge that the report raises far more questions than it answers. This is indicative of exactly how difficult a problem this is — even some of the world’s foremost experts have no clear prescription for a way forward that balances all considerations. India’s 2015 draft encryption policy ticked all the wrong boxes on this front, restricting encryption key length and mandating retention of plaintext copies of messages.

All of this only serves to illustrate how critical it is to start a robust and sophisticated public debate about what India’s approach should be, building on some of the good work already done. In the absence of such a process, there is a real chance that we will end up with a knee-jerk policy response in the face of either a trying circumstance such as a terrorist attack or public backlash against a product or company. This is not without precedent: the immediate aftermath of the 2008 Mumbai attacks saw the issuance of a restrictive DoT circular which hobbles public WiFi efforts to this day and the backlash against Free Basics in 2016 resulted in a rushed policy process culminating in the TRAI differential pricing regulations. Reactive policymaking undertaken in a short time window rarely leads to the best outcomes. With an issue as complex and with implications as far-reaching as encryption, it is especially important to ensure that we don’t end up falling into old and damaging patterns of behaviour.

---