Over the last few weeks, we have seen a significant new showdown over the Indian government’s internet regulatory ambitions. What sparked it off is the Indian Computer Emergency Response Team (CERT-In) announcing cybersecurity directions in May without any previous public discussion or consultation. This has led to numerous Virtual Private Network (VPN) firms announcing removal of their servers from India, industry voices and Indian SMEs raising concerns about the challenges of being able to meaningfully implement these diktats, and civil society, cybersecurity experts, and technologists pointing out how they would harm cybersecurity while deepening government intrusion upon privacy and other fundamental rights online.
The temporary pause in the implementation of these cybersecurity directives announced by CERT-In and the Ministry for Electronics and IT is a small positive step, a temporary reprieve. But it is far from enough. We now need to have a meaningful, honest conversation instead of rushing through with the implementation of these rules.
Also Read: Here are ICICI Prudential Life Insurance’s ESG Report highlights
Let’s start by looking at the sticking points. The directions set out a list of cybersecurity incidents that must be mandatorily reported to CERT-In “within 6 hours of noticing such incidents or being brought to notice about such incidents”. First, the six-hour time period is too onerous and will almost definitely result in frequent non-compliance and widespread exposure to liabilities. Second, there is no provision mandating notification to affected individuals and entities whose data may have been compromised. And finally, there is no clarity on and oversight over the actions CERT-in is obligated to take to mitigate damage and protect data once an incident has been brought to their notice.
Arguably the most problematic aspect of the new rules is the extent to which it imposes data retention requirements. VPN providers and others would be under an obligation to retain user information for five years or longer. VPNs protect online privacy by masking the users’ IP address and most VPNs do not log any user information. This helps protect internet users from snooping, which is particularly useful when connected to public networks such as at airports, hotels and restaurants. It also helps circumvent internet shutdowns and enables people to stay connected to and, for instance, access information, education, and healthcare. This is particularly important in India. According to Access Now’s report published in April 2022, India was responsible for 106 of the 182 documented internet shutdowns in 2021, making it the internet shutdown capital of the world for the fourth consecutive year.
CERT-in’s mandate for extensive collection and retention of data in the manner stipulated amplifies the prevailing risk of unchecked surveillance in India. It creates a vulnerability that can be exploited by adversaries, ultimately jeopardising an individual’s right to privacy and collective cybersecurity. This is happening against the backdrop of growing surveillance impunity in India and a legal vacuum where there should be a robust data protection law. In 2021, the Pegasus project once again brought to light the opacity and lack of accountability surrounding surveillance in India. At a time when the central government should be initiating surveillance reform and implementing rights-respecting data protection legislation, there are instead an increasing number of efforts that seek to gather and retain more of people’s personal information. Indeed, even these CERT-In cybersecurity directions appear to have been more about seeking to force VPNs and other internet ecosystem players to play ball with government and law enforcement desires, rather than about improving the cybersecurity of all Indians.
Also Read: 72% of the overall ESG controversies are due to Business Ethics: Study
As the significant number of cybersecurity incidents and data breaches have shown, there is no question that we urgently need concerted action and clear policy at the government level. However, recognising that privacy and cybersecurity can be mutually reinforcing is key. The national cybersecurity policies adopted by other major democracies recognise this and explicitly state the need to safeguard human rights and ensure that cybersecurity regulation and data protection laws are constructively interlinked. India suffers in this regard. Despite Prime Minister Modi announcing in his Independence Day speech in 2020 that the publication of a National Cybersecurity Strategy was imminent, there is no sign of it yet. Nor does India yet have a data protection law; the bill for that purpose is pending in Parliament with no sign of the government prioritising its passage, let alone fixing the numerous shortcomings identified in its current form.
Coming back to CERT-in rules, since these have a significant impact on industry, people’s online freedom and safety, and the internet landscape at large, they must therefore be informed by consultation with all stakeholders. CERT-in should actively invite comments and, accordingly, incorporate amendments, prior to enforcement (Times of India)
