Sec 69 of the IT Act: Fears of violation of privacy may not be unfounded

The problem is not in the notification. It’s ingrained in this section of the IT Act, a loose piece of legislation

The December 2018 notification by the ministry of home affairs, which specified 10 agencies for interception, monitoring and decryption of information under the section 69 of the Information Technology (IT) Act in pursuance of Information Technology Rules 2009, turned into a hot topic of debate. The question the notification raises is: whether the circular diminishes or improves the protection of citizens against misuse of power for surveillance by the agencies.

To my mind, by specifying the list of agencies, the notification streamlines the process of surveillance and, hence, is a positive step. However, fears of unreasonable violation of privacy may not be unfounded.

The problem does not lie in the notification; it is ingrained in section 69 of the IT Act itself, which is a loose piece of legislation. According to the section 5(2) of the Indian Telegraph Act 1885, interception and monitoring is permitted under five conditions: in the interest of sovereignty and integrity of India; the security of the State; friendly relations with foreign States; to maintain public order; and prevent incitement to the commission of an offence. Further, under this Act, the communication on fly — when it is passing through the network of the telecom service providers — can be intercepted and monitored.

On the other hand, section 69 (1) of the IT Act has an additional sixth condition: ‘investigation of crime’. It includes not only the communication on fly but also the stored data, information and communication. It also enables the agencies to reach subscribers directly, besides through intermediaries.

The implications of these seemingly innocuous differences are gigantic. By including the ‘investigation of crime’, scope of the law increases many more times because eventualities covered under the five conditions of Indian Telegraph Act are far less than the eventualities covered under the additional sixth condition of IT Act, simply because there are lakhs of cases under investigation.

By including the provision of storing data, agencies’ reach increase both in scope and time-dimension. Although the time limit for the validity of an order has been prescribed as a maximum of 180 days under the rules notified in 2009. But there is nothing to prevent an agency from accessing the information and data once stored in the system irrespective of the time it was stored first.

Whereas the Indian Telegraph Act envisages the network of telecom service providers as the location for interception, the section 69 covers not only a large number of intermediaries but also subscribers, making it highly intrusive kind of surveillance as against the non-intrusive one under the Indian Telegraph Act. These differences make the section 69 of the IT Act a highly potent tool against privacy of individuals.

But the icing on the cake is making it a punishable crime with seven years of imprisonment for not assisting the agencies. Under the Indian Telegraph Act, illegal interception and monitoring do allow for punishment, but there is no mention of explicit imprisonment if cooperation is not extended. Telecom service providers are merely controlled by licensing terms and conditions which are reflected in rules of Interception and Monitoring notified vide notification dated 1st March 2007.

Political parties accuse each other of turningthecountryintoasurveillancestate but in power their policies remain same as that of the previous regime. This is probably because political parties have little role in drafting such legislations, and indeed in most of the legislations; they broadly get a brief on intent, and wording the legislation reflects mostly the bureaucratic thinking. Politicians having signed the document become an invested party and are left with no choice but to defend them — unless they are very bold.

The undercurrent of the country’s political system has changed a lot since Independence, but the undercurrent of the bureaucracy, still the de facto rulers of the country's large proportion and without much accountability, has not undergone any fundamental change with respect to governing the citizens of the country, resulting in such loose legislations.

As communication and information technology changes, if the section 69 is required or not, and the efficacy of checks and balances in interception, approval and review are the topics for another time. But it can be concluded that though the section 5(2) of the Indian Telegraph Act appears to pass the test of ‘necessity’ and ‘proportionality’ of surveillance, the section 69 in its present form does not appear to do so.