Introduction

With digital networks increasingly becoming the preferred conduit for commerce and personal correspondence, encryption is critical to maintaining security and trust in this medium. It involves scrambling readable text (plaintext) with a secret key to transform it into ciphertext, incomprehensible to anyone not in possession of the said key.^[i] This is a complex process with trillions of possible combinations depending on the key length and may be impossible to crack with conventional computers. Cryptography, however, predates technology. It has been around for as long as there has been information to protect. It is hardly surprising then, that some of the earliest references to encryption appear among pottery traders in 1500 B.C. Mesopotamia for the protection of trade secrets, and in 400 B.C. India for the protection of information relating to conjugal relations.^[ii] Communications during those times involved messages that were written down. These were hidden through rudimentary alphabet-substitution ciphers.

Encryption has since become ubiquitous. Google, for instance, has made the Secure Socket Layer (SSL) encryption the default standard for its Gmail service and Google searches since 2010 and 2011, respectively.^[iii] Internet users are also obtaining access to more sophisticated end-to-end encryption services for free, through applications like WhatsApp^[iv] and Telegram.^[v] Encryption is also available as built-in security for devices such as Apple’s iPhone.^[vi] This ubiquity has seen the resurgence^[vii] of claims by law enforcement agencies that their ability to ‘lawfully’ intercept communication for criminal and terrorism-related investigations has been hampered. Encrypted channels allow their users to “go dark,”^[viii] maintain law enforcement agencies. Thus, they demand that companies retain access to all user communications and data, including encrypted data, and extend that access to law enforcement entities upon request. These demands have been met with strong resistance from supporters of encryption in both industry and civil society. They argue that any deliberate weakening of encryption would not only affect user privacy but also set back the overall standard of security in the market by many years.

While no easy answers to the debate have emerged, it appears that the result of this latest iteration of ‘crypto wars’ will change the nature of online exchanges.^[ix] India, for its part, has taken steps to resolve this debate. In September 2015, the Indian government released a draft National Encryption Policy (hereinafter Draft Policy) that sought to set encryption standards and lay down conditions for decryption of information for lawful investigation. The draft was laudable in its intent to calibrate policy in response to rapid technological developments in India and abroad. However, the conditions set out under the Draft Policy were problematic enough that it drew widespread criticism, resulting in its swift withdrawal. The Indian government is now in the process of finalising a second draft of the National Encryption Policy and has solicited inputs from the ICT industry and civil society to make it more balanced and acceptable.

As complex as the issue of encryption is, its fundamental dilemmas can perhaps be encapsulated in one question: Is it paradoxical to seek secure law enforcement access to encrypted data? The answer, however, varies from one country to the next. ‘Preferable’ levels of encryption depend on a complex network of legal, political, economic and even social factors unique to each country. They will depend on how the country has traditionally treated privacy and what restrictions on free speech exist. They will also depend on the extent to which the country’s ICT industry is reliant on international services. Predominantly, they will depend on two things: the technological security and self-reliance of the country’s information infrastructure, and the expertise of cyber security personnel. The Indian narrative around encryption is one of considerable complexity.

Framing the “Going Dark” Debate in the Indian Context

The Draft Policy sought to establish the protocols and algorithms for encryption, key exchanges and digital signatures for all government entities, businesses and citizens. It allowed businesses and citizens to use encryption as long as they handed in the plaintext, encrypted text and the hardware/software used for encryption when such information was sought by law enforcement agencies. In what was among the most controversial provisions of the Policy, it mandated all businesses and citizens using encryption to retain the plaintext of encrypted communication for 90 days from the date of transmission or transaction. The Policy also mandated that every service provider (whether they were based in India or abroad) would need to enter into an agreement with the government to operate within the Indian market. The nature of this agreement and what it would entail was not clarified.

The Draft Policy, therefore, wanted to ensure lawful access to encrypted data through a combination of three measures. First, it imposed a quasi-licensing model where a vendor or encryption service provider would presumably enter into an agreement with the government to allow unrestricted access to data. Without complying with this provision, they will not be allowed access to Indian markets. This would have the effect of establishing a backdoor within the service for Indian law enforcement and intelligence agencies. The Indian government is known to have deployed this pre-condition at least once in the past, when it compelled Blackberry to allow special access to its Blackberry Messenger and Blackberry Internet Service email.^[x]

Second, the Draft Policy also required encryption service providers to provide the government with working copies of the software and hardware used for encryption. This ‘key recovery’ mechanism meant that even without the backdoor requirement, the government would probably retain the capability to decrypt all symmetric encryption that used the same key to encrypt and decrypt.

Third, in cases of information sent through end-to-end encryption and other methods that used asymmetric public-private keys — the government would not be able to obtain the plaintext through the service provider because the information is not retained on the service provider’s servers — the policy mandated that senders of such information would have to retain the unencrypted plaintext for 90 days. This would enable the government to bypass the service provider and obtain the content of communication straight from the source.

The threat of creating backdoors in information systems has been the focal point of controversy in the recent past. The Apple v. FBI^[xi] case involving the iPhone 5C of the San Bernardino shooter was, in many ways, the flashpoint for a global conversation on encryption. In the matter, Apple resisted the FBI’s request to develop a new operating system that would allow it to bypass the phone’s passcode to access the encrypted content within. Among other things, Apple raised the concern that being compelled to write such code would be a violation of the company’s First Amendment right to freedom of speech.^[xii] The company also raised concerns that a backdoor such as this, once created, would compromise the security of all devices. This ‘GovtOS’ would be a generic software patch that could be adapted for any iPhone. Even if the leak of that particular piece of code was prevented, the knowledge that the creation of such a code was possible would undermine security. It could also make Apple employees targets for extortion.^[xiii]

This becomes doubly important in the Indian context due to the existence of precedent in the Blackberry matter. While it is known that Blackberry provided special access to law enforcement to its devices, the means through which it was granted remains unknown.^[xiv] This uncertainty may have even catalysed the decline of Blackberry’s market share in the country since 2012.^[xv] If a similar provision regarding a clandestine agreement between the government and an encryption provider, similar to that in the Draft Policy, is retained in the second draft, it would erode considerable trust in the cyber security market. It would prompt state-of-the-art encryption providers to either exit the Indian market or, at the very least, reconsider their engagement with the country. In the long run, the lack of access to advanced encryption products and tools is likely to hinder India’s projection of itself as a robust digital economy.

One of the arguments that Apple offered in its resistance of the FBI’s demands was that necessitating the writing of additional software was an arbitrary deprivation by the government of its liberty under the Fifth Amendment to the United States Constitution. The Fifth Amendment also protects a person from being compelled in any criminal case to be a witness against herself. A complementary provision has been provided under Article 20(3) of the Indian Constitution which reads, “No person accused of any offence shall be compelled to be a witness against himself.”^[xvi] If the second iteration of the encryption policy contains a provision mandating the retention of plaintext of encrypted information for 90 days, it may abrogate the right against self-incrimination under Article 20(3). The right against self-incrimination covers both oral as well as documentary evidence.[xvii] Plaintext of one’s encrypted communication would be considered documentary evidence.

While Article 20(3) does not cover testimony in the form of a handwriting or DNA sample, or blood spatter, among others, this would not apply to decrypted copies of one’s messages or email. This finds support in a three-judge bench ruling of the Supreme Court in Selvi v. State of Karnataka. The court, while deliberating on the legality of an admission obtained through narco-analysis, expanded the remit of Article 20(3). It was held that any process that “impedes the subject’s right to choose between remaining silent and offering substantive information,” cannot be allowed.

The court expanded this further by urging the need to respect the privacy of mental processes. It explains, “While the scheme of criminal procedure as well as evidence law mandates interference with physical privacy through statutory provisions that enable arrest, detention, search and seizure among others, the same cannot be the basis for compelling a person to impart personal knowledge about a relevant fact.” Besides, search and seizure must be statutorily empowered. An executive policy on encryption cannot mandate the production of decrypted communications. If the new draft of the policy retains the requirement of the 90-day plaintext retention policy, it is likely to be challenged in courts and liable to be struck down.

The Draft Policy of 2015 had other concerning provisions. It was withdrawn because it failed to account for the additional vulnerabilities that would arise as a result of centrally retaining the tools to decrypt information. It also ignored the fact that creation of ‘exceptional access’ for law enforcement would compromise forward secrecy. Dynamic standards (such as OpenSSL and Transport Layer Security) ensure forward secrecy through the use of a non-deterministic algorithm to generate a new set of public-private keys for each session. This set of public-private keys is used only to generate the session key for that particular session and is never used again. The loss or theft of one private key does not compromise information exchanged in a past or future transaction. If a universal decryption key is created for the government, then its accidental compromise would leave all past conversations on a certain platform open to whoever is in possession of the key.

The response to the Draft Policy, in no small part owed to its executive overreach, was largely reactionary and not constructive. Concerns regarding security are important as it affects not just the state but citizens and businesses that operate within it. The government needs access to information in order to be able to investigate and prosecute crime. It also needs to monitor information exchanges in a timely manner to thwart threats to national security. However, information gathering must align with the rights of the very citizens that the state is safeguarding.  It is now well established within the technical community that the security provided by encryption is a prerequisite for the development of e-commerce and online banking.^[xviii] It is also a critical tool for investigative journalists and whistleblowers. Any policy that stops short of actively encouraging the adoption and proliferation of secure communications will hinder the growth of information and communication technologies. The new policy must, therefore, find a middle ground between the need to access data and the need to maintain security of ICT architecture.

The encryption policy is likely to have far-reaching effects. At a time when India is deliberating on a Constitutional recognition of the right to privacy^[xix] and the data protection regulations have been found wanting in handling international data,^[xx] the policy represents an opportunity to strengthen India’s information security landscape.

Encryption and Data Vulnerability in India

The crypto wars in India may have lessons to learn from the conflict between Silicon Valley and the United States government. Still, there are many unique considerations that Indian policymakers must keep in mind. India’s domestic legal system, after all, suffers from a lack of privacy legislation, inadequate data protection rules, and a surveillance regime that is, for the most part, guided by colonial legislation. How the country regulates encryption will have implications on rights, commerce and national security. It will need to harmonise the regulatory landscape so that the multifarious interests of various stakeholders are balanced.

There is no explicit Constitutional recognition of the right to privacy in India. Instead, it has emerged through a series of (often contradictory) pronouncements by Indian courts to gain recognition as a penumbral right under other fundamental freedoms. This position, however, is tenuous at best. The government, through the Attorney General, has claimed that there is no right to privacy available to Indian citizens.^[xxi] The Supreme Court of India, in 2015, convened a Constitution Bench to adjudicate upon the issue.^[xxii] The apex court is expected to finally rule on the contours of the right within the next year. In the meantime, traditional privacy-based arguments against decryption of information by the government are not as readily applicable.

This is further complicated by India’s surveillance regime which lacks safeguards in the form of judicial review. Interception of communications in India is authorised by an executive order under Section 5(2) of the Telegraph Act, 1885 and Section 69B of the Information Technology Act, 2000 (hereinafter IT Act).^[xxiii] Orders of interception under Section 5(2) also follow improperly defined standards such as “on the occurrence of public emergency” or “expedient… in the interest of national security” as preconditions.^[xxiv] Similarly, under Section 69B, the government can order collection of information from any computer resource to “enhance cyber security.” Without the guidance of a privacy law, orders for surveillance are left to the subjective determination of a non-judicial authority. These broad powers of interception can also include access to encrypted information.

The Data Protection Rules drafted under Section 87(2)(ob) of the IT Act classify passwords as “sensitive personal data or information”.^[xxv] Password, in turn, has been defined to include encryption and decryption key.^[xxvi] However, the rules also mandate that a body corporate that collects this sensitive data will share it with a government agency upon receiving a request in writing.^[xxvii] As a result, India’s data protection laws have faced criticism both at home and overseas.^[xxviii] The European Union, for one, views Indian data protection regulation as being inadequate for European data. A recent survey by the Data Security Council of India (DSCI) estimates that this may have resulted in an opportunity loss of USD 2-2.5 billion.^[xxix]

Even technical standards that are available for data protection do not prescribe a high standard for encryption. Earlier, the licensing agreement between the Indian Department of Telecommunications and Internet Service Providers (ISPs) stipulated that no ISP would be permitted to use encryption standards higher than 40-bit symmetric keys.^[xxx] Any use of higher encryption would involve obtaining express approval from the government and the submission of decryption keys. The license agreement also prohibited the use of bulk encryption by ISPs. Curiously, the Unified Licensing Agreement that replaced the erstwhile service-specific licensing agreements dropped the upper limit mandating 40-bit encryption. It, however, retained the prohibition on bulk encryption and specified that the use of encryption by the ISP’s subscriber will be governed by a policy drafted under the Information Technology Act.^[xxxi] The absence of the 40-bit standard has removed an upper ceiling on what is permissible encryption, but the rule has not been supplanted by any provision that clarifies the issue.

Taken together, the absence of a privacy law, excesses of surveillance powers, and the inadequacy of data protection norms create inconsistent policies that are not conducive to investments and growth in technology.  The Draft Policy was a reflection of these inconsistencies.

Shortly after the release of the Draft Policy in 2015 the government issued a clarification that mass-market encryption products would be excluded from the ambit of the policy; that effectively excluded services like WhatsApp and standards like OpenSSL from the policy’s effects. It is unclear whether the second iteration of the encryption policy will apply to mass-market encryption tools. It, however, should. A “good” encryption policy can have the effect of harmonising the regulatory landscape around information security, in turn triggering changes to decades-old laws.

It is noteworthy that this time around, the Ministry of Electronics and Information Technology is seeking inputs from industry bodies and civil society while drafting the policy. This is an opportunity to avoid the same pitfalls that the Draft Policy suffered from. It is also a time to analyse and learn from other jurisdictions that have seen similar debates.

Policy Recommendations

To truly emulate best-in-class security standards that encourage not only the entry of state-of-the-art communications providers but also the growth of competing domestic services, the policy must conform to the test of necessity and proportionality while setting decryption mandates. The UN Special Rapporteur for Freedom of Speech and Expression has urged state governments to not ban any comprehensive protections on encrypted services and to impose restrictions on a case-by-case basis. He has also urged them to resort to court orders for imposing specific limitations.^[xxxii] India’s encryption policy must, however, go beyond merely setting decryption mandates. Rather, the policy must aim to:

1. Update existing laws and regulations to deal with the proliferation of secured communication services.
2. Upgrade the overall standard of security in cyberspace to enhance free speech and stimulate e-commerce.
3. Encourage the growth of research and development in cyber security and cryptographic tools domestically.
4. Identify and adapt international best practices in information security and data protection.
5. Prescribe limits on lawful access to encrypted communication that are proportionate and effective.

The encryption policy that is drafted now is likely to set the market standards for the coming 25 years. In that time, it is hoped that the Indian market will have replaced foreign communication providers with those that are developed domestically. It will be essential to ensure that information belonging to Indian citizens is not compromised by foreign intelligence agencies and non-state actors. To that end, the policy must keep in mind safeguards such as the Roots of Trust^[xxxiii] standard proposed by National Institute of Standards and Technology and the guidelines suggested by the Reserve Bank of India.^[xxxiv] In addition to these, the Policy should strengthen the security of the internet ecosystem by ensuring the following:

1. Mandating Forward Secrecy in the Transmission Layer

Mass-market tools like email clients and web browsers are some of the most frequently used web-based services by internet users. They are also especially vulnerable to exploitation through man-in-the-middle attacks, where an attacker intercepts encrypted communications and is then able to decrypt it by stealing a private key. The encryption policy should mandate that all providers of mass-market services transition to secure encryption protocols such as SSL/TLS. This will involve generating a new set of encryption keys for every transaction and will ensure forward secrecy. Encrypting the transmission layer will ensure that even if a user is exploited, her past transactions would remain secure and the level of potential damage would be restricted.

2. Encouraging Hardware Security-by-Design

Storing sensitive data on mobile computing devices, smartphones and portable storage drives presents an inherent vulnerability for data. Some of the more prominent data breaches and cyber-attacks in recent memory like the Office of Personnel Management hack and Stuxnet are said to have been made possible through unsecured end-devices. It is essential that the encryption policy address this lacuna in network security. The policy should mandate that employees of the government as well as the private sector, who handle sensitive data, use protective measures such as the RSA SecurID. The RSA SecurID is an authentication mechanism consisting of a hardware or software token that generates a random authentication code every 60 seconds. This helps protect data of employees that use personal/remote devices to connect to official networks. For devices such as smartphones that connect to a cloud, encryption helps protect data across devices in cases of theft. Most users do not modify the security configuration on their devices, preferring to keep the default configuration that the devices come with.^[xxxv] Products like the Apple iPhone are considered more secure precisely because of their encrypted-by-default feature. In markets like India, where the proliferation of cheap smartphones poses a threat to network security, it would be prudent for the policy to recommend a shift towards a secure-by-design framework.

3. Setting Strong Standards for Encryption Keys

One of the core issues in the encryption debate has been about whether states should regulate the strength of communications encryption. This paper has earlier discussed the inadequacy of the 40-bit encryption key that the Indian laws seem to currently prescribe. As early as 1995, three different teams of researchers at the Massachusetts Institute of Technology, the École Polytechnique, and the RSA Data Security Conference have demonstrated that the 40-bit encryption can be broken with little effort.^[xxxvi] It is therefore critical that the encryption policy mandate a higher standard of security for encrypting communications. The Reserve Bank of India^[xxxvii] and SEBI^[xxxviii] have recommended that for financial transactions, 256-bit encryption should be made the default standard. Financial services, however, are not the only points of vulnerability. Many other government services such as the Railways and Aadhaar unique identity database also handle vast amounts of information and have been targets of cyber-attacks in the past. This is only likely to intensify in the future. The policy must therefore mandate that all government-to-government; government-to-business; government-to-citizen communications adopt a 256-bit encryption standard. This should also be made mandatory for industries identified as Critical Information Infrastructure. The policy, however, should not aim to set any limits on encryption of business-to-consumer communication—rather these standards should be allowed to develop organically.

4. Registration of Encryption Service Providers

The encryption policy must require that every vendor of an encryption product and every encryption service provider register with a designated authority within the Indian government. The information sought during registration should only include the name and address of the cryptography provider; a description of the encrypted product/service; the strength of encryption used; and a designated point of contact within the service provider for law enforcement assistance. This registration must be purely declaratory in nature and must not involve an agreement between the service provider and the government. This provision must also not mandate sharing of, or modification to the source code to allow exceptional access to the encrypted product/service. In order to expedite the registration process, the government must endeavour to respond to a registration request (to seeking clarifications if any) within 30 days of submission of the information. If the appropriate authority fails to respond within the 30 days then the registration process should be deemed to have been successful.

5. Judicial Oversight for Decryption of Information

Requiring decryption of information involves a higher degree of intrusion than standard search and seizure of electronic documents. This is because encrypted information can generally be presumed to be sensitive material that the creator of the information would seek to protect. In this respect, India’s surveillance laws, that prescribe an administrative authorisation model for interception of communication, are inadequate. The encryption policy must mandate that every request for decryption of information be warranted by a judicial magistrate.

6. ‘Cryptographic Envelopes’ or a Two-factor Authentication for Decryption Orders

Even proponents of strong encryption acknowledge the legitimate need of law enforcement to access data. Key escrow systems and device backdoors are not considered viable solutions because they endanger data by centralising keys and weakening devices. There are, however, alternatives that the government could explore to ensure ‘lawful and secure’ access to encrypted data. Cryptographic envelopes are one such alternative.^[xxxix] A cryptographic envelope utilises existing technology such as PGP to securely store the decryption key to a device. The envelope can only be opened by the party whose public key was used to encrypt it. In order to decentralise the decryption process, multiple envelopes can be used, one inside the other, each encrypted with a different entity’s public key. These entities could be the manufacturer of the device and a designated law enforcement agency. Both the envelopes would have to be opened individually by each entity, thus preventing the unilateral misuse of a decryption key either by the government or the industry. It would also protect the data in case one of the entities’ private key is compromised. Using envelope encryption in conjunction with a judicial warrant requirement for decryption would greatly increase transparency. Law enforcement agencies would have to exhibit the public safety imperative for seeking the decryption of communications; the judiciary would test the legal validity of the claim; and the manufacturer of the device would ascertain whether the decryption violates the user’s privacy. Through this approach, every request for decrypting communications would undergo three layers of scrutiny. It would also minimise the threat of non-state actors gaining access to encrypted communications by exploiting backdoors.

Conclusion

With a plurality of actors and interests involved, encryption is perhaps the most complex issue of this decade. It implicates rights, commerce, law enforcement and intelligence. India’s Draft Policy only addressed law enforcement concerns while failing to truly address the multifarious issues at play. Privacy activists and the ICT industry have long favoured stronger encryption standards. However, one important stakeholder that has not yet weighed in on the debate is the intelligence community. Not unlike law enforcement agencies, espionage organisations also prefer easy access to information. Unlike law enforcement agencies, however, intelligence organisations are mandated with maintaining ‘information assurance.’ This involves protecting domestic data from being intercepted and exploited by foreign intelligence agencies and non-state actors. The Snowden revelations made it clear that many foreign espionage organisations like the National Security Agency and GCHQ are ready and willing to leverage their superior technological capability to monitor the activities of even democratically elected governments. India’s dual-use cyber-tech is not at par with its western competitors. India is also not a part of cooperative espionage networks like the Five Eyes. In this backdrop, sophisticated encryption is the only viable option to keep data secure both within domestic borders and without.

With more countries choosing to reflexively regulate encryption, it is important that India take a considered approach. International trends have shown that countries with influential governments and with opaque intelligence services are disfavouring end-to-end encryption.^[xl] These include countries like Russia,^[xli] Pakistan,^[xlii] Kazakhstan,^[xliii] Colombia^[xliv] and China.^[xlv] There are two essential reasons why India should not follow their lead in setting down standards on encryption that are more restrictive than market standards.

First, unlike, say, a Chinese citizen, an Indian internet user is heavily reliant on the services of companies that are based abroad. If India imposes data disclosure requirements that are not compatible with their domestic standards then there is a likelihood that these requests will fail (as they do under a Mutual Legal Assistance Treaty.) Given the fact that the United States and Germany are the clear market leaders in the number of encryption products,^[xlvi] Indian policymakers must keenly watch the approach that these governments take towards encrypted platforms.

Germany has already adopted a pro-encryption policy^[xlvii] and the United States Government has declined to endorse the controversial Burr-Feinstein Bill that favoured strong restrictions on encryption.^[xlviii] The United States government’s approach, however, is clear from the provisions of the Trans-Pacific Partnership (TPP) that it has spearheaded and endorsed. The TPP chapter on ‘Technical Barriers to Trade’ addresses cryptographic services head-on from a surveillance and access to decrypted data angle. The chapter does not prevent law enforcement agencies of member countries from legally demanding decrypted data from encryption service providers.^[xlix] In no uncertain terms, however, it restricts member countries from imposing onerous technical regulation on and demanding backdoors to encrypted products. It reads, “No Party shall impose or maintain a technical regulation or conformity assessment procedure that requires a manufacturer or supplier of the product… [to] transfer or provide access to a particular technology, production process or other information, for example, a private key or other secret parameter, algorithm specification or other design detail.”^[l] Critics have claimed, and reasonably so, that the provision is little more than lip service by the United States government to data integrity and that many other loopholes exist to force homegrown encryption providers to install backdoors.^[li] This, however, is a distinct advantage for countries that have an abundant number of domestic encryption services. This is a luxury that India cannot afford.

Second, as a corollary to India’s reliance on foreign encryption tools, it is important for the Indian industry to keep these services in circulation until such time that India’s domestic services are able to offer a similar standard of security. A restrictive encryption policy can cause the exit of state-of-the-art encryption services from the market. Consequently, the market that develops domestically will be technologically stunted from a lack of competition. In the long term, this will leave Indian data vulnerable to exploitation. In the short term, however, the exit of foreign encryption platforms from the Indian market would mean that even the metadata that assists law enforcement agencies would be lost. In essence, this would be a lose-all scenario for Indian law enforcement and intelligence agencies.

Whatever form the encryption policy finally takes, it must bear in mind the plurality of issues involved. It must address the needs of internet users, the ICT industry and the intelligence community in addition to law enforcement agencies. This will require a more direct engagement with multistakeholder platforms that discuss these issues. It must also follow technology neutrality by not treating services differently depending on their willingness to cooperate with law enforcement. Further, the policy must adopt principles that will stay relevant over the next few decades and are not rendered redundant by technology. Digital India’s increasing reliance on digital payments and the Aadhaar database means that the government will need to find technologically advanced ways to keep data safe. If India favours the adoption of technologies like Blockchain^[lii] for this purpose, it will need to be enabled by a strong encryption policy. Lastly, it must look inward and help develop a domestic cryptography industry that over the next five years is not only able to compete with its global counterparts but be sought after worldwide.

The policy recommendations in this paper offer a starting point towards that goal. They will, however, require engagement with the technical community to create an encryption policy that is truly future-proof.

---

Endnotes

• Cyber Security
• Cyber and Technology
• Privacy and Surveillance
• India
• ciphertext
• crypto wars
• cryptography
• encryption
• end-to-end encryption
• iPhone
• law enforcement
• National Encryption Policy
• plaintext
• privacy
• security
• SSL
• Telegram
• WhatsApp

The views expressed above belong to the author(s). ORF research and analyses now available on Telegram! Click here to access our curated content — blogs, longforms and interviews.