15 ms·
Indian government to intercept, monitor, and decrypt citizens’ computers
- JadeNB 8y agoThe first few lines of the story make it clear that there is not (necessarily) some physical seizing of computers going on here; it is the data that are being intercepted, monitored, and decrypted.
- draugadrotten 8y ago...and 7 years of prison if the service provider does not hand the authorities the encryption keys... MITM for iMessage, Whatsapp etc seems to be guaranteed here.
- mkagenius 8y ago> Whatsapp etc seems to be guaranteed here It is end to end encrypted
- g45y45 8y agoWhich means that authorities can force the providers to inject public keys into the directory services, thus allowing the authorities access to the cleartext. End-to-end is a buzz word. What is important is key distribution, which is set to be subverted by governments everywhere...
- InGodsName 8y agoDon't think they will deploy great firewall for blocking telegram which operate from offshore.
- g45y45 8y agoI dont know why people bring up telegram. A vast majority of chat messages is sent directly in the clear to Telegram servers. Telegram can spy on your conversations. If they can, anyone can. It is NOT an encrypted messenger. It is a crappy plaintext messenger that has an encrypted feature that nobody uses. Also - Stop using telegram. IT IS NOT ENCRYPTED LIKE YOU AND YOUR FRIENDS THINK IT IS.
- InGodsName 8y agoIt does have secret chats, which are supposed to be E2E encrypted
- NedIsakoff 8y agoChina will glady sell the Indian government GFW technology.
- birksherty 8y agoIt's still not secure. Read the 1st comment and the reply: https://news.ycombinator.com/item?id=18479567 https://news.ycombinator.com/item?id=18479567
- andai 8y agoSummary: WhatsApp aggressively pushing online chat backups, to which they do have the keys.
- mkagenius 8y agoSo, are we safe if we disable the backups?
- birksherty 8y agoNo, whatsapp is not open source. You have to trust facebook on whatever they tell you. Nobody can say for sure that there are no backdoors inside it. If someone says that than they are lying.
- birksherty 8y agoDoesn't "any computer" means personal devices that citizens own and agencies can ask you to hand over keys and password?
- nutcracker46 8y agoIt is easy to task authorities with intercept and decryption duties; actually doing it successfully is another matter entirely. Mathematics works both ways, friends.
- onetimemanytime 8y ago>>It is easy to task authorities with intercept and decryption duties; actually doing it successfully is another matter entirely. Mathematics works both ways, friends. Actually if Apple, Goog, FB etc are forced to surrender the key--at the penalty of being excluded from 1.x billion people in India--math works only one way...
- gruez 8y agothey can't surrender keys they don't have (e2e). the only issue is that they may be forced to do a key change. one way around this would be to show a prominent notice if your peer changed keys, which would make it immediately obvious what was going on.
- j0hnM1st 8y ago> Actually if Apple, Goog, FB etc are forced to surrender the key--at the penalty of being excluded from 1.x billion people in India--math works only one way... They did that with Blackberry few years ago
- onetimemanytime 8y agoIf India wants and if they can do it (maybe trade agreements prohibit them...not sure,) there's no way around. You want to do business in India? Yes? OK, then should have the key and must give it to India's police. Otherwise a ban on your business in India, $billion fines and arrests warrants for entire line of execs. Apple has great hopes for India https://www.msn.com/en-us/finance/companies/its-been-a-rout-apples-iphones-fall-flat-in-worlds-largest-untapped-market/ar-BBR7ZD7 https://www.msn.com/en-us/finance/companies/its-been-a-rout-...
- stanleydrew 8y ago
- macawfish 8y agoModi.
- sundar4344 8y agoBJP
- j0hnM1st 8y agoMitron
- sidcool 8y agoAs an Indian, this is scary. In the name of national security, this can go either way.
- y-c-o-m-b 8y ago> In the name of national security This is detrimental to national security. It's irresponsible and negligence at best. There is no such thing as bullet-proof cyber-security measures and all these data leaks in the last several years are evidence of that. The more data that is mined, the more information for intruders (foreign and domestic) to have access to. For example Russia could have penetrated America's NSA and used the data mined there to create profiles of people they could effortlessly manipulate in America's 2016 elections.
- techie128 8y ago> For example Russia could have penetrated America's NSA and used the data mined there to create profiles of people they could effortlessly manipulate in America's 2016 elections. How do you know they haven't already done exactly that?
- Dravidian 8y ago>national security is a sham Now the chinese would just need to infiltrate single infrastructure. What did the Indian govt do when it was revealed that the Huawei was siphoning off data from BSNL (state run ISP)? Other countries have started to ban Huawei telecom products.
- magesh_magi1 8y agoTL;DR This is a a decade old directive . This was a 2009 directive, if at all anything that has changed now it is instead of open ended notification in 2009 which said any company can access the data, this directive limits the number of companies to specific 10 agencies that can access that too after getting necassary permission. Details in https://www.opindia.com/2018/12/fact-check-congress-lies-mha-circular-access-to-computers-says-bjp-wants-to-snoop/ https://www.opindia.com/2018/12/fact-check-congress-lies-mha...
- j0hnM1st 8y agoIt just said monitoring and collection - there is no mention of tampering private owned properties and complete invasion into privacy.
- Dravidian 8y agoTo western readers clicking on the above 'opindia' article, it is a right-wing media outlet like 'Breitbart'. It is well known to propagate fake news in support of the ruling right wing political party.
- nonamechicken 8y agoIs FirstPost rightwing? >The Ministry of Home Affairs on Friday clarified that its recent order authorising 10 agencies to snoop on any computer in the country in the interest of national security is based on the UPA-era IT Act and the IT Rules 2009 that allow for surveillance by a competent authority and said all cases of surveillance will be placed before a review committee headed by the cabinet secretary. https://www.firstpost.com/india/mha-says-snooping-order-based-on-upa-era-it-rules-no-new-powers-conferred-on-any-security-agencies-5771621.html https://www.firstpost.com/india/mha-says-snooping-order-base... I know for sure that "give password or spend 7 years in jail" is not a new rule. It was there for at least a while. >Section 69 of the Information Technology Act, as amended by the Information Technology (Amendment) Act, 2008, empowers the central and state governments to compel assistance from any "subscriber or intermediary or any person in charge of the computer resource" in decrypting information. Failure to comply is punishable by up to seven years imprisonment and/or a fine. https://en.wikipedia.org/wiki/Key_disclosure_law#India https://en.wikipedia.org/wiki/Key_disclosure_law#India >A major amendment was made in 2008. It introduced the Section 66A which penalized sending of "offensive messages". It also introduced the Section 69, which gave authorities the power of "interception or monitoring or decryption of any information through any computer resource". It also introduced for child porn, cyber terrorism and voyeurism. It was passed on 22 December 2008 without any debate in Lok Sabha. The next day it was passed by the Rajya Sabha. It was signed by the then President (Pratibha Patil) on 5 February 2009. https://en.wikipedia.org/wiki/Information_Technology_Act,_2000 https://en.wikipedia.org/wiki/Information_Technology_Act,_20... UPA ruled India in 2008.
- j0hnM1st 8y agoIn India people call this "Mitron" MITRON 1. A large group of unsuspecting people, about to be hit by something they will take a long time to recover from. https://www.urbandictionary.com/define.php?term=MITRON https://www.urbandictionary.com/define.php?term=MITRON
- iliekcomputers 8y agoNot to ruin the joke, but I'll just clarify that "mitron" is actually Hindi for "friends" and is used by our Prime Minister a lot (especially in speeches).
- formatkaka 8y agoDoes using an app like cloudflare 1.1.1.1 protect us from this ? Cloudflare app link - https://blog.cloudflare.com/1-thing-you-can-do-to-make-your-internet-safer-and-faster/ https://blog.cloudflare.com/1-thing-you-can-do-to-make-your-...
- jammygit 8y agoThe article was vague. How does this law compare to other countries? Is it NSA or Hemisphere level data dragnets, is it Australian style "Australian law > mathematical law", or is it something different?
- mkagenius 8y agoNot sure how its done in other countries, but It will be like this in India: Police to person: Give password. Police to company: Give data.
- Dravidian 8y agoAtleast in developed countries individual rights are well enforced, so NSA atleast requires permission from secret court & Australian anti-encryption law at least was passed in their parliament (or equivalent). In India govt just used a loophole to give several government aagencies to access any computer without limitations or hurdles. I certainly believe this is intended for data analysis for elections & for abuse of people critical oof the government; especially journalists.
- manquer 8y agoThis is just an inter departmental circular circular blown out of proportion by click bait media coverage, the law has not changed. Legally you still need a magistrate sign off, which is not a private court like FISA is. This isn't to say that the Indian intelligence agencies do not try and monitor outside the judicial purview ( who really noes ? Without Snowden we wouldn't know about NSA either). Even if they want, the Indian security apparatus simply does not have kind of resources (both money and tech) to implement a dragnet like NSA has, today. Of-course this may change in future as tech may become cheaper, expertise easier. The security threat for India is also considerably different than first world countries, two neighbors(Pakistan and China)with border disputes, both nuclear armed and not friendly, Pakistan is not exactly stable and also funds/controls proxy agents who use terror tactics and has significant active support and arms from the U.S. GPS. was disabled during last "war" in late 90's so an Indian system with local coverage was developed. If there is serious thought in the intelligence community that because monitoring is not good enough then it is tough not attempt any means necessary.
- billfruit 8y agoThings like this is why I think India has a very flawed political system, the executive is having too much power, and the Constitutional guarantees to citizens are flimsy, and courts including the Supreme Court are temperamental and inconsistent. Civil law protections are insufficient as they are presently. Govt can put you in jail on flimsy grounds, but you can't sue for damages on wrongful imprisonment, etc. Most things are governed by criminal laws, where only remedy is punishment for the convicted, instead of having a strong tort law, where the aggrieved parties can extricate monetary damage claims.
- worldexplorer 8y agoNSA has been doing this for decades.
- pas 8y agoThis is more like the FISA courts and NSLs. Not the dragnet stuff. Though usually the lines are a bit blurry, sometimes secret warrants are issued to access already dragneted data. But those warrants are very far from real oversight.
- m23khan 8y agoEven if I take the headline with grain of salt and assuming it's meant to capture reader's interest, it is rather surprising the Nation involved is not your run-of-the-mill authoritarian/repressive nation but one that bills itself as the 'World's largest democracy'.
- Dravidian 8y agoThis is much worst than what we saw in Australia, current Indian govt headed by right wing political party with track record of human rights abuses have passed this order without passing through Parliament using a loop hole in the IT ACT. This is likely aimed at upcoming elections for data analyses via ISP & to target journalists critical of the current govt in India. But I feel that the International community isn't going to rally up for India like they did for Australia; I doubt even if expats would.
- techie128 8y agoSpreading FUD about India?
- Dravidian 8y agoNo,stating opinions based on factual information on the present Indian govt.
- fuckofidiot 8y ago"Current Indian govt headed by right wing political party with track record of human rights abuses have passed this order without passing through Parliament using a loop hole in the IT ACT". It's your opinion without any fact. The law was introduced by UPA.https://m.hindustantimes.com/india-news/in-arun-jaitley-s-stinging-counter-on-snooping-order-a-reference-to-upa-s-2009-rule/story-Qofgl1aJ7J6RZX2Nn9JnxO.html https://m.hindustantimes.com/india-news/in-arun-jaitley-s-st...
- antgly 8y agoNot the most useful bot. CTRL/Cmd + F “analys”
- nonamechicken 8y agoAccording to the below link, this is not a new rule, but something the UPA government passed. This new order just lists out the agencies that can access the data, where as the original rule didn't list anyone specifically. I remember the "provide password or 7 years jail" was a thing for a while. https://www.firstpost.com/india/mha-says-snooping-order-based-on-upa-era-it-rules-no-new-powers-conferred-on-any-security-agencies-5771621.html https://www.firstpost.com/india/mha-says-snooping-order-base...
- eps 8y agoAs someone on /r/sysadmin has correctly remarked - if you are outsourcing to India, you should assume that all data they have access to it is now also freely accessible to the Indian government.
- russh 8y agoI never thought anything else of any data that leaves my network.
- swebs 8y agoAnd if you're using Windows 10, your personal data is harvested and sent back to Microsoft... who overwhelmingly outsources to India.
- throwawaymjabba 8y agoDon't get me wrong, but I feel the /r/sysadmin folks are extremely pissed off at Indians, probably because of all the outsourcing. I find it amusing that they blame it on shitty coding by Indians whenever there is a breach or a website down incident, but keep quite on the nationality when the outage/breach has nothing to do with outsourcing.
- yogeshp 8y agoAll the agencies mentioned in the article are related to anti-terrorism, Investigations and Tax department. They could get any data previously too, with warrant but now they can track you without warrant. It doesn't means anything for normal IT work .
- imhoguy 8y agoIn less than decade both USA and EU will take lessons from these developing experiments (India, China, Russia, Australia) and will introduce the same locally. At first societies will be educated to stigmatise any resistance and ease the law change. Hiding data from govt will be like tax evasion or act of terrorism.
- escherplex 8y agoeducated ...reminiscent of contemporary video clip interviews with individuals saying I don't mind if the government reads my correspondence. I have nothing to hide. But for an historic contrarian view: Berlin 1931 (Weimar Republic): I don't mind if the government reads my letters. I've got nothing to hide. Berlin 1936 (national socialism): You writings make you an enemy of the state!
- PavlovsCat 8y ago"Nothing to hide", with the centers of power doing what they're doing, pretty much means "I'm obedient, I'm complicit, I swear allegiance.... you go on right ahead and rob that granny blind, take all the organs you want from that child... I'll be over here pretending to find the marble pattern on the wall terribly interesting". Ironically, they are hiding that from themselves.
- escherplex 8y agoExactly. And isn't it curious how many down votes the initial bland observation elicited? Strange.
- pm90 8y agoNah. There has been pretty strong backlash against FB. GDPR is (as imperfect as it is) a thing. I don't see the West going down that road, disregarding catastrophic failure modes.
- techie128 8y agoWhat do you call NSA surveillance? Pretty much all your life is online and NSA can get its hands on it in transit.
- sonnyblarney 8y agoI wonder what the implications will be for Western companies outsourcing there, anyone care to chime in?
- throwawaymjabba 8y agoI don't think Western companies really outsource important stuff to India. Its mostly brain dead work. Some of us call ourselves cyber coolies if we are working for the outsourcing companies. American companies are actually careful about employing Indians and other foreigners even in US. I remember one Indian colleague telling me how his US employer had to get approval from the US govt before hiring him full time in US. The employer had to show paperwork that he wouldn't have access to important information (trade secrets and the like). This employer makes things for agriculture. So I wonder have cautious the US govt would be for defense and related industries. I know they don't even allow non citizens to work in defense related projects even inside US. So, unlike the Chinese, we (Indians) don't really get to learn much from outsourcing, other than may be lessons on keeping the end customer happy by exploiting the employees.
- kvhdude 8y agoI am surprised they are not simply mandating a keylogging software in all laptops/phones and get it over with instead of trying to decrypt.
- dgzl 8y agoAnd here is the natural born right to privacy that Americans have, as well as the rest of the world in my own opinion: Bill of Rights, amendment 4: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
- deleted 8y ago[deleted]
- dragonwriter 8y agoDevotion to the quasi-religious idea of “natural rights” is not nearly as surprising as the belief that what are very clearly political compromises of the late 18th Century somehow perfectly captured such rights.
- dgzl 8y agoWell are you trying to be surprised, or are you trying to defend your natural born rights? It sounds like you're not interested simply because it's redundant.
- dragonwriter 8y ago> Well are you trying to be surprised, or are you trying to defend your natural born rights? False dichotomy much? I find the idea of natural rights to be of mixed value (beyond perhaps the case of a single natural right to something that might loosely be stated as that degree of liberty which does not intolerably impinge on the liberty of others), and the idea that the particular details of political compromises made by long-dead politicians define the proper scope of such rights actively harmful to efforts to appropriately balance liberty with other concerned for real live people living today. > It sounds like you're not interested simply because it's redundant. I'm not interested in efforts to treat political compromise as holy writ.
- ankit219 8y agoSlightly off topic, but this order kind of defines the state of India. Whatever the issue is, there are always two sides both of which try to shape the narrative in their favour. One side arguing through twitter and some of self owned websites, what the implications could be, and other saying that the order already existed, and this is limiting the scope to only 10 agencies and doing it to curb terrorist activities, as if that makes it all ok. The issue is that while this order is passed, there is no remedy for the citizens if their privacy is breached in any sense. The power is given to the home ministry, who at this point, think of themselves more as campaigner for next election, rather than an elected govt body, and hence it will be bad for political opponents in elections due in 2019. Since they made it concerning National Security, it is not covered under Right to Information either. (The order and notification says that the interception and monitor could only be for certain citizens, or group of citizens, if they are deemed a threat for national security. Even Apple might be asked to break the encryption in this case.)
- caymanjim 8y agoEvery country who can afford to already does this. They're simply admitting a little more about it than most.
- sunasra 8y agoFirst, it was Aadhaar and now this. Somehow Indian Govt wants to track every citizen and build their dictatorship.
- screye 8y ago> build their dictatorship. I highly doubt any Indian government wants or even thinks they can do this. India in all its diversity, consists of a huge number of separate factions. The Government only works due to a mutual compromise from enough factions to form a coalition. Also, the Indian judiciary and parliament hold genuine power and exercise it too. It is nearly impossible for a single person to gain enough momentum to even start being dictatorial. Admittedly, Modi's government has consolidated more power in one person than most of India's past governments. But, even then it only in comparison to the nearly dysfunctional mega coalitions of the INC.
- navait 8y agoWhile dictatorship is obviously absurd, what about Indira Gandhi and the Emergency?
- sbmthakur 8y ago> Admittedly, Modi's government has consolidated more power in one person than most of India's past governments. But, even then it only in comparison to the nearly dysfunctional mega coalitions of the INC. I don't like what is happening but it is far better than controlling the entire government from 10 Janpath.
- techie128 8y agoThis is basically part of a smear campaign against the government in power (NDA). The law was designed under the previous government and has been in existence before this government came to power. Nothing new was introduced since 2008. As far as constitutional protections go, Indians have a right to privacy which has been held up in the courts as recently as this year. This has been affirmed several times in the recent past. So, no, India does not have weak protections for its citizens. Finally, India is a place where mere WhatsApp forwards on the basis of rumors or made up stories cause people to go out and riot. Communal violence can be instigated using such means. So such laws are essential to track down the perpetrators. NSA, CIA also silently spy on Americans without much oversight in the name of security. In fact it is done at a mass scale.
- j0hnM1st 8y agoPrivacy Law is in the draft status ...
- closeparen 8y agoDenial, justification, and appeal to “everyone else is doing it” are a lot less compelling when used in the same breath that when deployed separately. “Uighur detention camps don’t exist and also aren’t that bad.”
- techie128 8y agoNothing in my post was even close to "Denial" or that everyone else is doing it. I was pointing out that my western counterparts are barking up the wrong tree when their own government is guilty of mass surveillance on not just their own people but everyone on this planet while India has stronger protections that have been held up in court. People in glass houses should not be pelting stones.
- dirkgently 8y agoYour Western counterparts also complain when Western government does this. You have a really huge chip on those shoulders.
- imhelpingu 8y agoOh my! Who can imagine living in an environment where the government is known to be intercepting, monitoring, and decrypting your digital activity as their perfectly acceptable MO!?
- LinuxBender 8y agoThis will be an unpopular opinion, but I personally like highly oppressive and intrusive governments trying to impose their will on the internet and technology. Usually when this happens, it results in substantial innovation around privacy, security and awareness. Such movements will ultimately force many people underground and into various forms of VPN's, non standard operating systems and custom hardware. To be clear, I am not condoning India's actions and I have no doubt many people will be hurt by this. I am merely pointing out that there will also be many unintended consequences and I personally believe that their government will ultimately lose more trust, control and visibility than they gain.
- shakna 8y agoThis is why I don't like laws like these. They're utterly ineffective at their stated goals. The targets are largely unaffected. However, the average person is affected. And can be deeply affected.
- Santosh83 8y agoYeah because the real purpose of these laws is to control the citizens, as ever more unrest in future is a given, for just about any country. Nothing except physically shackling every human being is going to stop crazy terrorists from ploughing through a crowd in a vehicle, but mark my words, you'll find western 'democracies' employing technology in literally every sphere of life to ostensibly control these 'terrorists' although the end result will be a dystopia of totally controlled citizenry that will find it impossible to break their chains unless they're prepared to die.
- LinuxBender 8y agoI would add that it aids criminals. Devious minds will adapt and work around such invasive laws. (excluding lazy criminals of course) The average person will not even research this. The end result will be petabytes of citizen data sitting on some government servers or amazon S3 buckets that will end up on the black market.
- vaylian 8y ago
- qwerty456127 8y agoAs far as I know elections work quite well in India and Australia (which is moving in the same direction), so how do things like this happen? Do the people consider government spying on them Ok?
- Santosh83 8y agoMajority of the people in India are too busy making ends meet to know or care. This may change as the relatively more educated/affluent younger generations replace the older ones, but for now there are other bigger problems on everyone's minds. Of course govts all over the world use precisely this strategy to push through draconian laws... if the people aren't too stressed out/distracted to care, the evergreen excuses of terrorism and national security are trotted out. We have general elections next year and the main deciding factors will probably be stuff like demonetisation, rising prices/taxes, perceived arrogance/authoritarianism etc. This issue will go almost unnoticed except by the techically aware minority, just as the wholesale decimation of India's environment by the current govt is also going unnoticed except by the small 'green' minority.
- sbmthakur 8y ago> This issue will go almost unnoticed except by the techically aware minority, just as the wholesale decimation of India's environment by the current govt is also going unnoticed except by the small 'green' minority. Would you care to expound to here? The last I checked this government has done more on renewable energy front than any other government.
- qwerty456127 8y agoIn general "the renewable energy front" is also a kind of populism. I would strongly prefer my government to invest in nuclear power plants maintenance, upgrading and building and in research in the nuclear area than in what is generally considered renewable.
- RaceWon 8y agoRoom 641A
- known 8y agohttp://www.linuxliveusb.com/ http://www.linuxliveusb.com/ + https://prism-break.org/en/all/ https://prism-break.org/en/all/ can insulate you.
- known 8y agoThe Indian journalist jailed for a year for Facebook posts https://www.bbc.com/news/world-asia-india-46631911 https://www.bbc.com/news/world-asia-india-46631911
- nonamechicken 8y agoPeople getting jailed for Facebook posts happen frequently in India. Looking at the arrests they have made so far, there are 3 categories of people whom you shouldn't criticize or make fun of in Facebook: politicians, religion and women.
- wtmt 8y agoIt's very worrisome how things have been going on in India, more so in the last two decades. Regardless of which party is in power, mass surveillance is increasing, and ways to preserve privacy have been under attack (the government tried to force Blackberry to allow interception of all messages when BBM was a thing; now it wants the same with WhatsApp and other platforms; and then there's the whole biometric based, unchangeable and irrevocable unique ID called Aadhaar...the list is long). Unfortunately, most politicians here don't understand (or don't care about) the impact of any of these even to protect themselves from attack or suppression by authoritarian and untrustworthy people in power. Most states also have laws that allow them to detain people without a court order or presenting them in a court of law for up to a year, and the police can also make several laws and enforce them. It's just a matter of time that immigration officials and police will start asking people to reveal their social media passwords, go through their personal and private information, etc. For all the positives that India as a country has, it has a lot to learn from other countries when it comes to privacy, freedom, freedom of speech, etc. I believe big technology companies have a role to play in India and around the world to help defeat such dangerous (and often futile) moves by governments.
- ilrwbwrkhv 8y agoAll governments do it. Some just do it in the open.
- crazybrain10 8y agoFrankly whether we agree or not, nearly all the government's are actively spying on it's citizens.. Buzzwords like Right to Privacy is just like that only a buzzword. So , if a government needs someone's data, they will somehow take it.
- known 8y agoIn 2014 Modi campaign promised honest/progressive govt. Now, 50% ministers in his cabinet are facing corruption/criminal charges in courts fulfilled just 9% poll promises http://www.electionpromisestracker.in/governments/central-government and utter contempt for truth and knowledge https://www.huffingtonpost.in/entry/smriti-irani-to-sharad-yadav-8-most-bizarre-statements-from-politicians-in-2018_in_5c18d2dfe4b08db990575cfc
- wpdev_63 8y agoIf you want to see where the USA will be politically in 10 years look no further than China and India with these draconian policies. We are in competition with them.