Interception records to be destroyed half yearly: Rules

All records related to interception must be securely and “with extreme secrecy” destroyed, the new Telecommunications rules notified by the Centre said

: All records related to interception, including the orders and the intercepted messages, must be securely and “with extreme secrecy” destroyed by the government’s review committee, as well as the authorising entities — Union or state home secretary — and law enforcement agencies, every six months, according to the new interception rules notified by the Centre, with experts raising questions about accountability and transparency.

Interception records to be destroyed half yearly: Rules

The Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules, 2024 — which replace Rule 419 and 419A of the Telegraph Rules, 1951 — were brought into effect by the department of telecommunications (DoT) on Friday. The draft rules were released for public consultation on August 29.

They have been issued under the Telecommunications Act, 2023, which allows the Centre to specify one or more agencies to intercept messages for five reasons — in the interest of sovereignty and integrity of India, defence and security of the state, friendly relations with foreign states, public order, and preventing incitement to the commission of any offence.

“While under the earlier rule, one could still hope to get some information about the interception orders by filing RTIs related to the Review Committee, that is also now gone. It will be as if the interception never existed. Where is then the scope for oversight and accountability?” Namrata Maheshwari, senior policy counsel and encryption policy lead at Access Now, said.

Interception records that law enforcement agencies are required to maintain include details of the intercepted messages, person whose messages have been intercepted, officer or agency to whom the message has been disclosed, number of copies of message made, date of destruction of copies, and duration for which the interception order was in force.

The composition of the review committees that must confirm the interception orders at central and state level also remains the same. For Maheshwari, this is a problem as this means the review committee is not independent from the executive. “Independent judicial oversight or parliamentary oversight over surveillance orders, as in many other regions, should be the norm,” she added.

DoT and the telecommunication entity must also destroy records within two months of discontinuation of interception, as is the case now and was reiterated in the draft rules.

According to the rules, the interception order must specify: the authorised agency that will intercept; and one or more of the five reasons for which interception can be ordered and will limit use of intercepted messages to these reasons only. Unless revoked earlier, the order will remain in force for a maximum of 60 days but can be renewed. No order can remain in force for more than 180 days.

Interception orders cannot be passed if the information can be acquired through “other reasonable means”, the rules say.

An interception order can be issued by the Union or state home secretary. In “unavoidable circumstances”, a duly authorised joint secretary-level officer may issue the order.

Lower threshold for orders

The notified rules lower the threshold for circumstances where officers other than the Union or state home secretary, or the joint secretary-level officer, can issue interception orders. Earlier, in “emergent cases in remote areas” or “for operational reasons” when it was not feasible for the home secretaries to issue the order, the head or second senior-most officer of an authorised law enforcement or security agency, not below the rank of inspector general of police, could issue the order.

Now, an officer not below the rank of an IGP at state level, or the head or second senior-most officer of an authorised agency at the Central level, in “remote areas or for operational reasons” can issue an interception order. By removing the requirement for “emergent cases”, the threshold is lowered.

What constitutes an “emergent case” depends on the interpretation of the executive, Nikhil Narendran, partner at Trilegal, said, adding: “Public emergency could be one standard.”

These orders will need to be confirmed by the home secretary (union or state) within seven working days from the date of issue. If not confirmed, the interception must immediately stop, the intercepted messages cannot be used for any purpose, including as evidence in court, and copies must be destroyed within two days.

“There is no judicial remedy spelt out for persons affected by the orders that were not confirmed by the home secretary,” Maheshwari said. “So it is possible that an interception takes place, is then halted, and the persons affected never find out. Notice and intimation, as feasible under different circumstances, and judicial remedy are key to any surveillance framework in a democracy.”

All interception orders must be sent to the relevant review committee within seven working days of being issued or confirmed.

The notified rules exclude demonstration and testing of lawful interception systems and monitoring facilities that telecom entities might be required to put in place by the government, a departure from Rule 419A.

The provision to fine or suspend/revoke the licence of service providers for not maintaining secrecy and confidentiality of such orders or for unauthorised interception has been removed in the notified rules. Telecom entities will now be responsible for the actions of both their employees and their vendors that result in any unauthorised interceptions.

Ambiguity over entities covered

As is the case with the parent act, it is not clear whether telecommunication services, and thus telecom entities, include online communication services such as WhatsApp, Signal, FaceTime, and potentially even email services such as Gmail and Outlook. While the then communications minister Ashwini Vaishnaw, after the bill was passed in Parliament in December 2023, had said that online communication services are not included within the ambit of the Act, he did not make this statement on the floor of either house, and the definitions within the act remain ambiguous enough to allow for the regulation of such services. In case of end-to-end encrypted services such as WhatsApp and Signal, the act and the interception rules thus have significant implications.

“While the minister had publicly stated that OTT services would not fall within the purview of the Act, this statement is not legally binding, and the definition of telecom services in the Act is broad enough to facilitate a range of interpretations,” Maheshwari said.

This ambiguity has been a significant point of confusion, so much so that in the TRAI open house discussion on how authorisations (the regime that replaces the extant system of granting licenses to telecom entities) should work, telcos like Jio and Airtel repeatedly disagreed with associations like Broadband India Forum that represent the technology companies on whether or not services such as WhatsApp need specific authorisations from the government to operate in India.

The notified rules also empower the government to exempt certain telecom entities from needing to comply with obligations related to interception. “The scope of this remains unclear. How will the government exercise this exemption? Will it be determined by size of the entity? Their technical ability? This needs to be clearly defined for predictability which is expected from every policy,” Maheshwari said.

How will an interception ordered

Once the home secretary (or other authorised officers) issues an interception order, it will be sent to the authorised agency (the law enforcement agency doing the interception). The authorised agency will send the order either “in writing or using other secure mode of communication” determined by the central government to the DoT or the telecom entity. Orders can be physically delivered only by officers who are at least sub-inspectors.

The DoT or the telecom entity must acknowledge receipt of an interception order within 2 hours.

The rules require confidentiality, “extreme secrecy”, and “utmost care and precaution” to be maintained by the law enforcement agency, the DoT, and the telecom entity while dealing with interception orders. Only authorised nodal officers in each of these entities are allowed to handle any matters related to interception.

The authorised agency must appoint two nodal officers, at least at the rank of superintendent of police, to send the order to the nodal officer of the DoT (two such officers in every service area) or the telecom entity (like an Airtel or a Jio).

Each telecom entity is required to notify the central government of the details of two senior employees in every service area of its operation who will act as nodal officers to implement the interception orders, a requirement that Maheshwari says might prove to be too onerous for smaller entities.

The notified rules require the nodal officers in DoT and the telecom entity to submit fortnightly reports on the first and sixteenth of each month. These reports must have a list of interception orders received, reference number, date of issuance or confirmation, date and time or receipt of orders, and date and time of implementation of orders.