India's Worrying Draft Encryption Policy

knwny writes: The government of India is working on a new National Encryption Policy the contents of which have raised a few alarms.Among other things, the policy states that citizens and businesses must save all encrypted messages (including personal or unofficial ones) and their plaintext copies for 90 days and make them available to law enforcement agencies as and when demanded. The policy also specifies that only the government of India shall define the algorithms and key sizes for encryption in India. The policy is posted on this website.

Comments

This should be interesting.

[allaunjsilverfox2]

What happens if, by accident or malicious intent, the storage medium you are using is destroyed? Or ironically enough, if you are attacked with malware that encrypts your drive. How do you explain that you can't decrypt the drive to so they can decrypt your messages? Or that the cloud solution provider you were using is down for a undetermined amount of time?

Re:This should be interesting.

[bigpat]

What happens if, by accident or malicious intent, the storage medium you are using is destroyed? Or ironically enough, if you are attacked with malware that encrypts your drive. How do you explain that you can't decrypt the drive to so they can decrypt your messages? Or that the cloud solution provider you were using is down for a undetermined amount of time?

It depends what you are accused of and how politically connected or rich you are. Seriously, a law like this is meant as a catch all that nobody will be able to ensure their compliance with. Basically it outlaws encryption for all practical purposes. So if you are accused of something, anything, and you happened to use encryption then at least they can jail or fine you on a technicality when they can't prove that any real crime has been committed.

In other news...

[Jon.Burgin]

the use of Indian consultants is about to drop dramatically.

Yet another failed attempt ...

[gstoddart]

And here we go with yet another example of politicians and other assholes with no technical understanding deciding to legislate "solutions" for their needs without the barest understanding of reality.

Yet another country who has decided their need to spy magically changes how technology works.

And, as usual, this will never work in practice.

Doesn't make sense

[Chrisq]

If I'm accessing an https website in India that would mean that I would have to copy everything I typed in and save it for 90 days. That's every web search, amazon review, etc.

Re:reactions

[U2xhc2hkb3QgU3Vja3M]

Agent 1: Wow, this guy sure likes sending photos of kittens.
Agent 2: Oh, look how cute this one is!

Any DRM exceptions?

[Sloppy]

Waitaminute. If an Indian watches a DRMed movie, he'll be required by law to have cracked it and ripped it? If I sell DRMed media to Indians, am I going to automatically be a conspirator, if my customer doesn't crack it?

There needs to be a DRM exception.

And I'd rather not discuss the consequences of such an exception. ;-)