The state of surveillance in India: the central monitoring system's chilling effect on self-expression.

• Published date: 22 December 2015
• Author: Litton, Addison
• Date: 22 December 2015

In June 2013, Edward Snowden shook the world's confidence in personal privacy when he leaked top-secret information about the United States National Security Agency's ("NSA") surveillance program, "Prism." (1) Snowden's leaks shattered the global perception that citizens of the world's leading democracy are free from government intrusion, (2) and it was no surprise that privacy issues took the international stage. At the time of Snowden's leaks, it was little known that, across the globe in India, the largest democracy on the planet had had its own massive surveillance program in the works since 2007 (3)--a program that would rival the NSA's. It would enable the Indian government to monitor in real time 900 million mobile and landlines and 160 million Internet users. (4) Interestingly, the scheduled launch of India's surveillance program in April 2013 received little attention from the press; (5) nonetheless, its rollout was timely in light of the global conversation on government surveillance that ensued just two months later.

This Note will attempt to contribute to the growing body of discussion on government surveillance, specifically with regard to India. This Note will explain why India's surveillance program, formally called the Central Monitoring System ("CMS"), poses a severe threat to privacy and democratic free expression. More specifically, this Note will discuss how CMS will prompt a paradigm shift in the way speech is regulated in India from its current system of "private censorship" through telecommunications providers to a system of widespread self-censorship among Indian citizens whose speech is chilled by CMS. Finally, this Note will identify potential barriers to public debate surrounding CMS that will inhibit popular demand for government accountability and reform.

I. India's Central Monitoring System ("CMS") & the IT Act

In order to understand the impending threat to privacy at hand, one must first understand how CMS will operate and what it is capable of. CMS utilizes powerful algorithms that are capable of sifting through data to identify patterns and users in invasive ways. (6) Once fully implemented, CMS will allow the government to "listen and tape phone conversations, read e-mails and text messages, monitor posts on Facebook, Twitter, or LinkedIn, and track searches on Google." (7) Essentially, every form of electronic communication will be under the government's microscope. Even partially written emails saved in draft folders will be vulnerable to government intrusion. (8) CMS will also enable the government to track an individual's movements through the use of location-based GPS monitoring. (9) It will be possible for the government to compile personal dossiers on users with the help of CMS through the collection of personal information that corresponds with target numbers assigned to those users. (10)

Nine government entities--including two spy agencies (11)--will have virtually unfettered access to the sensitive personal information collected through CMS with no court order required to monitor targets, (12) no parliamentary oversight, (13) and no formal privacy regime in place to protect individuals from government intrusion. (14) One expert group created to outline principles for an Indian privacy law described CMS as "an unclear regulatory regime that is nontransparent, prone to misuse, and that does not provide remedy for aggrieved individuals." (15)

The Indian government derives its expansive power to snoop on citizens from the Information Technology Act ("IT Act"). Originally enacted in 2000, and later amended in 2008, (16) the IT Act largely mirrors a law enacted during the colonial era, (17) which permitted the government to intercept communications in the "occurrence of public emergency, or in the interest of the public safety." (18) However, the IT Act "substantially lowers the bar for wiretapping" (19) by removing the requisite preconditions of public emergency or public safety. (20) The IT Act contains several provisions, discussed in later sections of this Note, that grant the central government complete, unfettered discretion to identify targets worthy of surveillance, (21) to mine private data about those targets, (22) and to prosecute them at will. (23) Unsurprisingly, the IT Act raised serious concerns among privacy activists (24) who claim it is repugnant to the Indian Constitution, (25) inconsistent with Supreme Court precedent, (26) in violation of global privacy standards, (27) and in contravention of international treaties to which India is a party. (28)

Activists are particularly concerned with the government's proclivity to stifle free expression under the IT Act. (29) The discussion that follows will identify two provisions of the IT Act that threaten freedom of expression in India. The first of these provisions, Section 69, (30) curtails speech through "private censorship" (31) by intermediary telecommunications providers. The second provision, Section 66A, (32) was repeatedly used by the government to prosecute citizens for their expression. The Indian Supreme Court struck down Section 66A on March 24, 2015 declaring the law unconstitutionally vague and prone to arbitrary prosecution of citizens' speech. (33) While the Court's decision eliminated Section 66A's formidable threat to free speech, other Indian laws are still subject to prosecutorial abuse. (34) Furthermore, the history of Section 66A is telling of the government's approach to limiting free speech.

Following the implementation of CMS, India is poised to see a marked shift in the way speech is regulated. The former system of "private censorship" will give way to arbitrary monitoring through CMS and the subsequent prosecution of citizens. This will have a chilling effect on the Indian populace. Ultimately, the implementation of CMS will lead to widespread self-censorship and the suppression of ideas in the marketplace.

II. SECTION 69 & "PRIVATE CENSORSHIP" BY INTERMEDIARY SERVICE PROVIDERS

Section 69 of the IT Act empowered the Indian central government to create a system of "private censorship," whereby the Indian central government monitors and regulates speech through intermediary telecommunications service providers ("ISPs"). Under this system, the government issues orders to ISPs directing them to intercept data, to take down multimedia content, or even to block certain content altogether. (35) Section 69A grants governmental power to direct the blocking of public access to information through any computer resource. (36) Section 69B of the IT Act further provides that the competent authority may "direct any agency ... to intercept, monitor, or decrypt ... any information generated, transmitted, received or stored in any computer resource." (37) Should any subscriber, intermediary, or person empowered to intercept the information "fail[] to assist the agency," [S]ection 69 imposes a prison sentence of up to seven years. (38)

Section 79 of the Act reinforces the system of "private censorship" by exposing intermediaries to liability should they refuse to do the government's bidding. (39) Ironically, however, Section 79 is designed to limit intermediary liability. Under this section, an intermediary is immune from liability for third party content made available or hosted by them provided they observe 'due diligence' and follow prescribed norms. (40) In 2011, the Ministry of Communications and Information Technology issued a set of Rules--the Information Technology [Intermediaries Guidelines] Rules, also known as the 2011 IT Rules ("IT Rules"), in order to define and further standardize expectations for intermediaries' compliance with Section 79. (41) However, the 2011 IT Rules missed their mark because they failed to adequately define key terms in the "due diligence" process. (42) For example, Rule 3(2) bars intermediaries from hosting "objectionable," "hateful," "disparaging," and "defamatory" content. (43) Yet, the Rules do not concretize any of these terms. According to academic Malavika Prasad, this has resulted in "the introduction of an element of subjectivity that renders the whole process vague and ambiguous.... Even when intermediaries believe that they may qualify for immunity, the uncertain application of the principles has caused them to err on the side of caution by blocking the content." (44)

What is more, Rule 3(4) requires that the intermediary "disable" infringing content within thirty-six hours of receiving notice of a complaint. (45) Should the intermediary fail to do so, it is subject to criminal prosecution for any allegation flowing from the notice, and the penalty is harsh. (46) This narrow timeframe places a heavy burden on intermediaries to eliminate content without sufficient time to inquire about its legitimacy. (47) The difficulty of complying with the thirty-six hour window is compounded by the fact that ISPs lack both legal expertise and adequate resources to properly address every complaint that they receive. (48) The result is a haphazard, cursory system for reviewing complaints under which legitimate, lawful expression falls through the cracks. (49)

III. OUT WITH PRIVATE CENSORSHIP, IN WITH CMS

The system of intermediary takedowns, or "private censorship," under Sections 69 and 79 is on its way out with the advent of CMS. Speech will be moderated largely by Indian citizens themselves rather than by ISPs. Fearful of a "Big Brother" government vested with the authority to monitor and prosecute people at will, Indian citizens will begin to self-censor.

In effect, the CMS scheme cuts Indian ISPs from the equation. (50) The CMS infrastructure consolidates the existing "Lawful Interception Systems" installed on the network of all fixed and mobile telecommunications operators, ISPs, and International Long Distance Providers. (51) Furthermore, CMS mandates the installation of additional dedicated interception data servers in each private telecommunications network...