Slashdot Mirror
India's Worrying Draft Encryption Policy
knwny writes: The government of India is working on a new National Encryption Policy the contents of which have raised a few alarms.Among other things, the policy states that citizens and businesses must save all encrypted messages (including personal or unofficial ones) and their plaintext copies for 90 days and make them available to law enforcement agencies as and when demanded. The policy also specifies that only the government of India shall define the algorithms and key sizes for encryption in India. The policy is posted on this website.
What happens if, by accident or malicious intent, the storage medium you are using is destroyed? Or ironically enough, if you are attacked with malware that encrypts your drive. How do you explain that you can't decrypt the drive to so they can decrypt your messages? Or that the cloud solution provider you were using is down for a undetermined amount of time?
Restore the madness of youth's lechery
... or can you simply store some arbitrary log, and tell them it's your actual communication data?
the use of Indian consultants is about to drop dramatically.
And here we go with yet another example of politicians and other assholes with no technical understanding deciding to legislate "solutions" for their needs without the barest understanding of reality.
Yet another country who has decided their need to spy magically changes how technology works.
And, as usual, this will never work in practice.
Lost at C:>. Found at C.
It's this kind of foolishness which means that countries like India and China will never advance into the first rank of nations. It is part of a pattern of meddling, obstructiveness, distrust and plain lack of freedom that causes backwardness. I chuckle whenever a pundit proclaims that India is the future.
I hasten to add that American politicians, regulators and the general public now seem intent on thrusting the US backwards, by the same means. America will never be overtaken, but it may fall by the wayside.
Prove anything by multiplying Huge Number times Tiny Number
This'll just drive the use of steganography, and then the government won't even know when there ARE messages.
If I'm accessing an https website in India that would mean that I would have to copy everything I typed in and save it for 90 days. That's every web search, amazon review, etc.
I see nothing about the number of iterations. There are going to be an awful lot of pissed off spys when they find that decrypting a messages gives them another encrypted message
I wonder how this'll affect the companies that outsource stuff over to India and how badly this screw over their customers. I mean, I would imagine many of these outsourced services will need access to customer records and stuff from the company that hired them, but if the government insists on downgrading encryption and stuff it'll make it much easier for attackers to gain unauthorized access or for them to eavesdrop on stuff.
In case of war, your encryption will be drafted.
Look, I would be the first person to criticize Indian standards of hygiene and make one of those "Fix your problems X before doing Y, India" posts: after traveling around India for half a year, and just before I was supposed to fly out, I ended up spending nearly a month in a Delhi hospital after either drinking bad water or eating food that wasn't prepared in a sanitary fashion. The country has a big problem with ensuring treated water, disposing of sewage, and washing hands well when serving food.
But where foreigners have no right to criticize Indians is bathing. Indians bathe regularly, and I've been impressed to see even the poorest of the poor using any public source of water they could to thoroughly scrub every morning. Indians know how much sweat and odor a tropical or sub-tropical climate could produce. It is often Westerners who are considered the unwashed there.
It will be ineffective and it will be wielded against people who haven't even abused the law.
What's interesting about this proposal is that it actually includes a proviso that makes some sense. They want you to retain the unencrypted copy so that they can sniff through it, but shockingly, they don't want you to retain it forever. That seems like an admission that there are some secrets which should be protected by cryptography.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
...always trying to invade the privacy of their citizens. I'm just thankful that I Iive in the U.S.A. where that kind of thing... Oh, wait...
Steganography in cow pictures?
Have gnu, will travel.
So, the Indian Govt thinks that intentionally weak crypto and forced plain text long term storage is a good idea? Never mind what the US might do with this. India's strategic and economic competitor is China, which will thus get so much more info product with so much less effort.
On the flip side, this may be so unacceptable to the business sector that it'll become another source of graft for officials to look the other way. Aka, The "Bureaucrat Bonus" Bill. Something for everyone.
Luke, help me take this mask off
Governments have no rights. . They only have power and authority and chains of obedience.
They're authoritarian morons, like most politicians and government officials in the security theater industry. Simpering, contemptible, evil morons.
The world's burning. Moped Jesus spotted on I50. Details at 11.
too late for me, I already burned my rot13 card.
try getting THAT data back, suckers!
--
"It is now safe to switch off your computer."
Stopping a law like this is probably expensive to some major industrialist out there. A fair few Crores Rs I would wager :)
India is a democracy, government has all the rights the people give it.
No. Democracies with no constitutional restrictions on government presume to possess all possible powers, limited only by The People getting outraged over something and demanding revokation.
The People haven't given them a damned thing -- those in power just took it.
A proper government is formed by granting a list of powers to it, "and none others".
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Waitaminute. If an Indian watches a DRMed movie, he'll be required by law to have cracked it and ripped it? If I sell DRMed media to Indians, am I going to automatically be a conspirator, if my customer doesn't crack it?
There needs to be a DRM exception.
And I'd rather not discuss the consequences of such an exception. ;-)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
You just prove my point, my man. The issue isn't whether you are comfortable with your body odour, it's about how the people around you feel. Even when millions of people have limited access to water, they still think about other people.
It would appear that India is choosing to squander its immense talent pool, and forego its future as a major world IT player. (Or, as others have pointed out, it's covertly encouraging a new boom in steganography technology.)
-- In the beginning was the WORD, and the WORD was UNSIGNED, and the main(){} was without form and void...
so you are not arguing if its a democracy.. just not one you consider proper... again power is still with the people, what they choose to do with it... then again encryption is not really on the radar for most indians and much more immediate quality of life issues probably are... not much traction on those either. so ... lets just blame the culture :)
Why have [key size and algorithm limitations] When they have enforced key escrow and mandated plaintext retention of said encrypted data?
1) So they can eavesdrop without warning the target.
2) So they can (try to) crack the saved info when somebody says the dog ate his retained data.
3) So they can have evidence to bust people who don't provide "retained data" that matches what was sent.
4) The two sets of requirements are belt-and-suspenders. The retention/delivery requirements help cover for times the wiretap decryption fails or the data is lost through some mishandling, equipment failure, or failure to get the wiretap started in time to capture what was of interest to law enforcement.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Tell Narenra Modi regime to fuck off https://www.change.org/p/prime...
Casteism