Natgrid And NIA Have Become Obscure And Unconstitutional

Indian government is implementing various e-surveillance projects in clear violation of human rights and fundamental rights. Merely labeling a project as national security project does not make it one. The truth is that Natgrid project of India is still nebulous and unconstitutional. Exempting it from the applicability of RTI Act 2005 proves this point.

Accountability and transparency are two words that do not apply to Indian law enforcement and intelligence agencies. India has chosen to stick to the British legacy of non transparency. Whether it is laws like official secrets act, Indian telegraph act or the accountability of Indian law enforcement and intelligence agencies, Indian government has even surpassed the Britishers in this regard.

Instead of strengthening the transparency and Parliamentary scrutiny, India is further making these agencies more unaccountable and lawless. The right to information act 2005 (RTI Act 2005) is the sole transparency law of India that needs further amendments and strengthening. However, the proposed right to information rules 2010 instead of strengthening the RTI Act, 2005 took steps that are retrograde in nature.

Firstly, India amended the cyber law of India through the draconian information technology amendment act 2008 that empowered Indian government and its agencies with unconstitutional e-surveillance, internet censorship and website blocking powers. Subsequently, it made the RTI Act 2005 weaker and redundant.

Now Indian government has announced that Central Bureau of Investigation (CBI), national investigation authority of India (NIA) and national intelligence grid (Natgrid) would be exempted from the applicability of RTI Act, 2005. The constitutional validity of national investigation agency act, 2008 (NIA 2008) is still doubtful and CBI and Natgrid are not governed by any law at all. Even the proposed central monitoring system of India is without any parliamentary oversight.

Whether it is CBI or Intelligence Agencies of India, none of them are presently Accountable to Parliament of India, informs Praveen Dalal, managing partner of New Delhi based ICT law firm Perry4Law and CEO of exclusive Human Rights Protection Centre for Cyberspace in India. This casts a doubt about the Impartiality and Transparency of these Agencies, suggests Dalal. Exempting these Agencies without any parallel “Parliamentary Oversight” is against the provisions of Indian Constitution, informs Dalal.

In these days the role of Indian Parliament has been reduced to almost nothing. Important laws are never passed and existing laws like the cyber law of India have been made e-surveillance instrumentality for Indian government and its agencies. The Parliament of India needs to take its legislative role seriously, at least now.

Encryption Laws And Regulations In India

Encryption is an important aspect of cyber security and data security. Though India has a cyber law in the form of information technology act 2000 (IT Act 2000) yet it does not contain any effective and robust encryption provisions. Till now encryption is an unresolved enigma in India.

For some strange reasons, encryption is a feared technology in India. Government of India in general and intelligence and security agencies in particular are very nervous regarding use of encryption in India. Till now there are no clear and definite encryption standards in India

India is increasingly looking forward for concepts like e-governance, e-commerce, m-commerce, mobile governance, mobile banking, cloud computing, etc. However, we do not have legal enablement of ICT systems in India. Further, we do not have a cyber security policy of India.

In this background, absence of encryption laws, regulations and standards is a death knell of online dealings of Indian citizens. There are no safeguards against possible loss of sensitive information and money due to insecure online transactions.

Governments of most developed countries allow the usage of strong encryption standards ranging from 128 bits to 256 bits or more to ensure the security of sensitive information exchanged via Internet and other networks. However, India is still clinging to 40 bits encryption standards for the simple reason that intelligence and security agencies of India are not capable enough to break strong encryptions.

Instead of strengthening its cyber security capabilities, Indian government and security agencies are concentrating more upon e-surveillance. However, e-surveillance is not a substitute for effective cyber skills, especially the ability to break high quality encrypted communications.

The Information Technology Amendment Act 2008 (IT Act 2008) incorporated a single provision in the form of Section 84A for Encryption Purposes, informs Praveen Dalal, leading techno legal expert of India and Managing Partner of Perry4Law. Although the provision became applicable since 27th October 2009 yet Indian Government has slept over the issue, says Dalal. Indian Government must urgently formulate a Dedicated Encryption Policy of India, suggests Dalal.

Presently, Indian government has taken a wrong decision by enforcing encryption standards through Internet service provider’s (ISPs) license. The same strategy has been adopted by Indian government to force Research in Motion (RIM) to surrender Blackberry’s encryption keys. It is indirectly forcing Blackberry to succumb to its demand by forcing the telecom service providers of India to drop services of Blackberry if e-surveillance of Blackberry is not possible.

This is not the right strategy and Indian government must take a pro active and positive approach regarding encryption issues.

Cyber Due Diligence Requirements In India

Cyber due diligence in India has emerged as an essential regulatory requirement. The information technology act 2000 (IT Act 2000) originally carried provisions regarding cyber due diligence but they were not as stringent as they are now.

With the passing of the information technology amendment act 2008 (IT Act 2008) things have changed dramatically. Now the cyber law of India has made cyber due diligence even more stringent.

Further, the ministry of communication and information technology (MCIT) has also framed certain rules that go even further in mandating extreme cyber due diligence requirements by intermediaries in India.

Under the IT Act 2000 “Intermediary” are required to observe “Due Diligence” to escape liabilities arising out of third party acts or omissions, informs Praveen Dalal, a Supreme Court lawyers and leading techno legal expert of India. The scope, definition and ambit of Due Diligence is very wide under the IT Act, 2000 and stakeholders must be wary of the requirements of Indian Cyber Law, suggests Dalal.

Another aspect that is closely related to cyber due diligence pertains to e-discovery. For instance, e-discovery for due diligence by banks is imperative in today’s banking environment in India.

In fact, to ensure proper cyber security of banking transactions and to comply with the IT Act 2000cyber due diligence requirements, all banks now would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest.

Since the cyber due diligence is new in India, there is no ready made reference material available for it. Perry4Law Techno Legal Base (PTLB) and Perry4Law are in the process of writing the first and exclusive techno legal cyber crime investigation manual of India. The manual is in the final phase of preparation and it may be available to governmental departments and general public after few months. The manual also cover cyber due diligence requirements to be followed by stakeholders in India, especially by intermediaries.

Cyber due diligence must be perceived as an essential business requirement than a regulatory requirement. Many frauds and crimes can be prevented if proper cyber due diligence is at place.

Cyber Due Diligence In India

Due diligence means to act with due care and caution. Cyber due diligence means to take proper care and caution while dealing with cyberspace transactions. In the Indian context, the information technology act, 2000 (IT Act 2000) mandates taking due diligence for cyberspace matters and other allied matters to escape civil and criminal liability.

Under the IT Act 2000 “Intermediary” are required to observe “Due Diligence” to escape liabilities arising out of third party acts or omissions, informs Praveen Dalal, a Supreme Court lawyers and leading techno legal expert of India. The scope, definition and ambit of Due Diligence is very wide under the IT Act, 2000 and stakeholders must be wary of the requirements of Indian Cyber Law, suggests Dalal.

Recently the Reserve Bank of India made the requirements of observing cyber due diligence by banks in India even more stringent. RBI executive director G Gopalakrishna recently said that all banks would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest.

This decision came after the incidence of fraud by the Gurgaon branch of Citibank came into light. According to Dalal incidences and frauds like these can be prevented if proper Cyber Due Diligence is in place.

Among many factor, e-discovery plays a major role in preventing and punishing cyber crimes, banking frauds and other crimes. Although there is no e-discovery law in India yet it must be adopted as a prudent and due diligence exercise by all.

Till now there was no guidelines and readymade reference for crucial issues like cyber crime investigations, due diligence practices, best practices to prevent cyber crimes, etc. Perry4Law Techno Legal Base (PTLB) and Perry4Law are in the process of writing the first and exclusive techno legal cyber crime investigation manual of India. The manual is in the final phase of preparation and it may be available to governmental departments and general public after few months.

Issues regarding due diligence and cyber due diligence would also be discussed in the manual. Banks operating in India can effective use the manual of Perry4Law and PTLB to meet the techno legal requirements of due diligence, cyber security and prevention of cyber crimes committed against banking institutions.

Due diligence, especially cyber due diligence, cannot be ignored by any person and institution any more. It is in their own interest to follow proper and adequate due diligence requirements to escape punishment under various laws.