Is our Cyber Policy really "democratic"?

 

The Union Government of India on 1 July 2013 launched the National Cyber Security Policy 2013 at New Delhi with an aim to protect information and build capabilities to prevent cyber attacks. The aim of National Cyber Security Policy 2013 was to safeguard both physical and business assets of the country.It aims at protecting the public and private infrastructure from cyber attacks.The policy also intends to safeguard "information, such as personal information (of web users), financial and banking information and sovereign data".

The KPMG report identifies ten things one should know about India’s National Cyber Security Policy 2013:

1. Set up a 24×7 National Critical Information Infrastructure Protection Centre (NCIIPC) for protecting critical infrastructure of the country.

2. Create a taskforce of 5,00,000 cyber security professionals in next five years.

3. Provide fiscal schemes and benefits to businesses for adoption of standard security practices.

 4. Designate CERT-In as the national nodal agency to co-ordinate cyber security related matters and have the local (state) CERT bodies to co-ordinate at the respective levels.

5. All organizations to designate a CISO and allot a security budget.

6.Use of Open Standards for Cyber Security.

7. Develop a dynamic legal framework to address cyber security challenges (Note: The National Cyber Security Policy 2013 does not have any mention of the IT Act 2000)

8. Encourage wider use of Public Key Infrastructure (PKI) for government services.

 9. Engage infosec professionals / organizations to assist e-Governance initiatives, establish Centers of Excellence, cyber security concept labs for awareness and skill development through PPP - a common theme across all initiatives mentioned in this policy.

10. Apart from the common theme of PPP across the cyber security initiatives, the policy frequently mentions of developing an infrastructure for evaluating and certifying trustworthy ICT security products.

But the result…

Is the Indian Cyber Security Policy conducive to the Democratic Society? Let us look at some prevalent examples

1.       Ambikesh Mahapatra, In 2012, the chemistry professor was arrested for circulating by email a cartoon that poked fun at West Bengal Chief Minister Mamata Banerjee. The cartoon, which was a parody of a scene in a popular Indian movie, went viral on social media.He was charged with a range of offenses including defamation, insulting a woman and sending offensive messages from a computer.

2.       The two girls--Shaheen Dhada and Renu--were sent to 14-day judicial custody by a court. Dhada was arrested after she posted comments on the social networking site opposing the shutdown in Mumbai after Bal Thakre’s death. Dhada's friend Renu was arrested for 'liking' the post. "Police arrested both of them under section 505(2) (statements creating or promoting enmity, hatred or ill-will between classes).

The Cyber Laws whose misinterpretation makes us undemocratic

The Information Technology (Amendment) Act, 2008:  The main Indian act that addresses legal challenges specifically as they relate to the Internet is the Information Technology (Amendment) Act, 2008, or for short, the IT Act.

Section 66A: Do not send offensive messages: Section 66A of the Information Technology (Amendment) Act, 2008 prohibits the sending of offensive messages though a communication If you’re booked under Section 66A, you could face up to 3 years of imprisonment along with a fine.

Sections 67 and 67A: No nudity, please: The most important tools to curtail obscenity are sections 67 and 67A of the IT Act, prohibiting obscene and sexually explicit material respectively.

Section 69A and the Blocking Rules: Allowing the Government to block content under certain circumstances: Section 69A of the IT (Amendment) Act, 2008, allows the Central Government to block content where it believes that this content threatens the security of the State; the sovereignty, integrity or defence of India; friendly relations with foreign States; public order; or to prevent incitement for the commission of a cognisable offence relating to any of the above.

Section 79 and the IT Rules: Privatising censorship in India: Section 79 of the Information Technology (Amendment) Act, 2008 regulates the liability of a wide range of intermediaries in India. The section came in the limelight mostly because of the infamous Intermediary Guidelines Rules, or IT Rules, which were made under it. The IT Rules constitute an important and worrying move towards the privatisation of censorship in India.

Later this year, an Internet surveillance mechanism called NETRA -- an acronym for network traffic analysis -- is expected to go live. Its exact functions haven't yet been spelled out by the government, but it can be possibly used as a tool for untargeted, dragnet surveillance…

On one hand we have aspirations for digital India and then we also have programs like NETRA which is nothing but a large, massive surveillance project. With over 200 million internet users, soon going to cross half in billion in coming years, over 900 million mobile telephone subscribers, and a thriving and robust internet ecosystem, India is well poised and should play an important and constructive role in evolving the global internet governance ecosystem, and in the process, make it more credible. While our country has indeed benefited from the growth of the internet,we also cannot ignore several serious strategic and public policy challenges that this domain has presented, lack of truly representative and democratic nature of the existing systems of internet governance, including the management of critical internet resources, leads to "trust deficit" in the system.

It is beyond doubt that internet governance ecosystem has to be sensitive to the cultures and national interests but it cannot be to please the lunatic fringes just because of the political clout – one has to also measure its democratic nuances to evaluate the efficacy of such sensitive and crucial policies.