Under Public Pressure, India Withdraws Draft Encryption Policy

An anonymous reader writes: The government of India withdrew its draft policy on encryption owing to public responses just a day after releasing the document. The Communications and Information Technology minister Ravi Shankar Prasad said — "I read the draft. I understand that the manner in which it is written can lead to misconceptions. I have asked for the draft policy to be withdrawn and reworded." While it is encouraging that the government recognized it mistake and withdrew, many fear that this is part of a larger problem when it comes to this government taking technology policy decisions. Recently, the government was in the dock for its lack of clarity on Net Neutrality.

Comments

Do the needful

[xxxJonBoyxxx]

They yanked the link posted yesterday, but how's this for a pretentious domain name?

>> "DIETY.gov.in" - http://deity.gov.in/sites/uplo...

Translation

[sjbe]

"I read the draft. I understand that the manner in which it is written can lead to misconceptions. I have asked for the draft policy to be withdrawn and reworded." .

Translation: "This was a blatant power grab and we got caught. I have asked for it to be reworded so that people won't notice the problem next time."

We didn't misunderstand

[Enigma2175]

Oh, it's not "yeah, this proposal a horrible thing, we shouldn't have thought that this was a good idea", it's "You misunderstood what we are trying to do, we will do it again with more obfuscated language this time". No, we fucking didn't misunderstand. Your stupid proposal makes a nationwide backdoor into anything encrypted. If this were to actually happen, it would certainly be abused - India's government is notoriously corrupt. The Indian people need to tell their government in no uncertain terms that this is unacceptable.

Misconceptions?

[sims 2]

What misconceptions? It seemed to be a pretty clear F U to anyone that might use encrypted communications as part of standard business practices.

Wouldn't just be abused by governments

[sjbe]

If this were to actually happen, it would certainly be abused - India's government is notoriously corrupt.

It wouldn't just be abused by the government. Backdoors cannot be restricted to just the groups you intend - i.e. just the "good guys". It's simply not possible. Governments find this fact to be highly inconvenient and keep trying to find some way to weasel around it. This is just one of the more blatant attempts at weaseling.

Nope

[sexconker]

It wasn't public pressure.
It was the realization that all the American companies that offshore tech work to India would have to offshore to somewhere else instead.

Re:Nope

[afidel]

Exactly, here is the email I sent yesterday:

Dear Mr. Krishnan,

I am writing you in response to the draft National Encryption Policy recently released by your department. As an IT professional responsible for the security of my companies systems and data I feel I must write to inform you that these proposals are unacceptable to my organization. Should the proposed rules become law I will be forced to immediately terminate the access credentials of everyone who accesses our systems from the country of India. This will result in the loss of several hundred high paying jobs which we have outsourced to a company in your country. I feel that I am not alone in this stance and that you will find that there is a very real hit to your countries GDP as a large number of international companies pull access and contracts from suppliers in India as a result of these unconscionable rules. For the sake of the people of India I hope you reconsider your broad overreach in this area.

selective enforcement ...

[Ungrounded Lightning]

I have never seen an example of the Indian state successfully enforcing anything....

Selective enforcement is worse than no enforcement.

Intermittent enforcement can give India all the downsides of the law without most of the (for them) benefits. The threat of occasional sporadic success, for instance, can cripple or kill outsourcing of anything with sensitive information to India, while the general failure of enforcement can still cause it to fail in its stated purpose of detecting planned attacks on the government and the like.

As someone whose employment prospects and pay levels are severely impacted by outsourcing of technology work to India, it's tempting to cheer them on in re-wording and re-promulgating the regulation, and spiking the outsourcing. But that would probably just push the work to an even riskier to secrets country like China, rather than bring it to the US.

Yes I know it's not a zero-sum game. But with the current US laws it's a massively sloped playing field, too.