Business Wire IndiaThe need for encryption was underscored by some of India’s top cybersecurity experts, and former law enforcement officers at the launch of the joint study by The Dialogue and DeepStrat on National Security implications of weakening encryption, released at an event held on January 12, 2022.
Lt Gen (Dr) Rajesh Pant, India’s National Cybersecurity Coordinator, who released the report, pointed out that encryption is critical to security and ensuring the confidentiality of data. He explained the importance of nurturing an ecosystem for developing homegrown algorithms while referring to the chapter on encryption debt. He expressed the Government’s intention of having a National Cryptology Mission as part of the National Cyber Security Strategy, which is currently under the review of the Prime Minister’s Office. He also congratulated the authors of the report and endorsed its recommendations.
He added: “When historically whenever there is digital communications, the old triad of CIA has always been at the forefront, and CIA I'm talking of the confidentiality, the integrity and the availability of information, during rest during motion and during processing. And the confidentiality of the information has basically been provided by encryption that has been the trend so far.”
“Current social media regulations require that large social media platforms should enable traceability, or at least the ability to provide the information concerning the originator of the online communications. Technology companies and privacy activists always opposed such a move on the grounds that traceability would require breaking of end-to-end encryption used by many online communication platforms, like Whatsapp, and therefore, would compromise the security of online communications on such platforms. So these are some of the issues you know which have to be seen from all perspectives, I mean the individual’s perspective, the national security perspective and how technology can make both ends meet.”
Mr. Saikat Datta, Founding Partner, DeepStrat and the editor of the report noted, “One problem with cyber warfare and cyber information security is that all citizens today are at the front lines of that battle because any one of us could be a target. So much of our lives is today online from our financial records to our emails etc, that encryption, at times, is the first and probably the only line of defence that we have against a bad actor or an enemy state.”
The study is based on qualitative inputs from veterans in law enforcement, intelligence agencies, the military and India’s tech community as well as a deep study of global legal and technical standards. The key recommendations of the report are:
- Developing an action plan for reducing encryption debt;
- Pausing the legislation of encryption hostile laws;
- Committing to surveillance reforms conforming with the Puttaswamy judgement;
- Launching a nationwide study to gauge the requirements of law enforcement & intelligence agencies.
Mr. Yashovardhan Azad IPS (Retd.), Chairman, DeepStrat and one of the principal authors of the report, iterated how Indian law enforcement agencies have not used metadata analysis to its full potential. He cited the investigation into the attack on the US Congress housed in Capitol Hill on January 6, 2021, as an example of how effective metadata analysis led to the arrest of the perpetrators. Mr. Azad highlighted the importance of utilising metadata while bearing the mandate in Puttaswamy judgement that adds the standards of necessity, proportionality and legality to accessing private data.
Mr. Nandkumar Sarvade IPS (Retd.), former CEO, ReBIT, pointed out the challenges associated with international cooperation in accessing metadata. He emphasised the need to transform the way law enforcement agencies consume and use technology and to evaluate non-tech solutions to these technical problems that have gone unaddressed in the past.
Given how the traceability mandate violates the Puttaswamy judgement on the right to privacy, the experts agreed that there is a need to reform the Indian surveillance projects to abide by this mandate and to protect the right to privacy of the users, along with building meta data analysis capabilities of the law enforcement agencies.
Ms. Tarunima Prabhakar, Co-Founder of Tattle Civic Tech, explained “We are trying to conflate various problems into one, and accordingly design a single solution. Traceability is not an algorithm, it’s not really a technical infrastructure. It's a desire, it's a statement of intent for what law enforcement wants. Of all the different methods that are proposed, such as the eight methods in the report, I think, traceability definitely feels like the greatest kind of mismatch in terms of what it aims for, and what it actually achieves.”
Explaining the importance of reassessing the policy debate around encryption Mr. Anand Venkatanarayanan, Strategic Advisor, DeepStrat and principal author of the report noted, “that some amount of metadata in order for investigation will get you to the place where you can legally ask for more information without having to break end-to-end encryption.” The report explains what metadata is available for law enforcement agencies at defined stages of investigation which would be crucial in catching criminals, without putting the security of the citizens and the State at risk by weakening encryption.
The experts expressed their agreement on the importance of end-to-end encryption in ensuring the informational privacy, safety and security of the citizens and the national security. Endorsing the key finding of the report, the experts called for more evidence-based research on encryption technology and more specifically on the modern technology requirements of the law enforcement agencies.
The PDF of the Report can be accessed here.
