A narrow path for India and China: de-risking engagement for a cautious peace

by Ajit Ranade, Nitin Pai, Ajay Shah.

The relationship between India and China is at its most difficult point in decades. A foundation of political and military hostility, marked by violent border clashes and a strategic rivalry across Asia, makes any notion of a simple partnership untenable. China’s authoritarian state, its ambition for regional dominance, and its use of economic power as a tool of statecraft present clear and present dangers to India’s national interest. In this environment, a policy of naive engagement is not optimal.

Yet, a policy of complete economic decoupling is equally problematic. China is central to the global economy, an important force in manufacturing, technology, and trade. There is a shared border with India, and with the two countries adding up to 40% of humanity, there are natural opportunities for many kinds of partnerships between Chinese persons and Indian persons. A self-imposed isolation from the world’s second-largest economy carries an opportunity cost for us in India. We need capital to fuel our growth and build infrastructure. The current policy framework reflects this unresolved tension. Measures such as Press Note 3, which mandate government screening for all investment from bordering countries, have hindered new streams of Chinese capital. As of April 2024, 200 of the 526 FDI proposals received under PN3 were awaiting approval. This has its merits, but we do need to find some unfreezing as part of long-term strategy.

The policy question is not whether to engage, but how. How can India interact with a hostile neighbour in a way that captures economic benefits without incurring unacceptable security risks? The debate has been trapped in a false binary between total engagement and total isolation. The intellectual challenge is to design a third way: a policy of "quarantined engagement," where economic inputs like capital can be accepted while the associated strategic risks are neutralized at the point of entry. As Adam Smith said, Trade with barbarous nations requires forts, trade with other nations requires ambassadors.

This article resurrects old ideas that help find this path. We argue in favour of a highly constrained, de-risked channel for Chinese capital into Indian infrastructure. This is not a call for a broad reopening or a return to a more optimistic era. It is a pragmatic, narrow, and carefully controlled mechanism designed for an adversarial relationship. The core proposition is that it is possible to surgically separate Chinese capital from the control, technology, and geopolitical leverage that usually accompany it. Under a strict framework of safeguards, Chinese investment can be transformed from a strategic threat into a simple financial commodity, one that can serve India’s developmental needs while building, over the long term, a small but tangible stake in a stable peace. Such an arrangement would be win-win for both sides: This is good for China also.

Any credible proposal for engagement must begin with a clear-eyed assessment of the risks. The case for a narrow channel of economic contact is not born of optimism, but of a sober understanding of the multifaceted threat China poses. These threats are not discrete; they form an integrated strategy where economic, technological, and military actions are mutually reinforcing. Any Indian counter-policy must therefore be equally integrated.

Strategic and military hostility

The foundation of distrust is geopolitical. The 2020 Galwan Valley clash was the most violent manifestation of a pattern of Chinese military aggression along the Line of Actual Control. This hostility is not confined to the Himalayas. Beijing’s strategic support for Pakistan, its expanding military and economic footprint in nations across South Asia -- from Sri Lanka to Bangladesh and the Maldives -- and its explicit of achieving uni-polarity in Asia are all inimical to Indian interests. This sustained pattern of behaviour demonstrates that China is not a benign competitor but a strategic adversary.

The weaponisation of economic interdependence

China has repeatedly demonstrated its willingness to use economic interdependence as a coercive tool. India’s reliance on Chinese supply chains for critical goods, from active pharmaceutical ingredients (APIs) to electronic components, creates a significant vulnerability. Beijing has the ability to "pull the plug" on these supplies, as it has done with certain restricted exports, weaponizing trade to exert political pressure.

This risk is compounded by China’s internal economic troubles. A structural problem of overproduction, rooted in weak domestic demand and a collapsing real estate sector, has led Beijing to manage its economy by exporting its unemployment. A flood of cheap, often subsidized, Chinese goods—from solar panels to electric vehicles—threatens to overwhelm and destroy nascent Indian industries. This is not merely market competition; it is a strategic economic offensive that requires a defensive response.

The technological trojan horse

The third vector of threat is technological. There are well-documented security hazards associated with Chinese electronics and software. Global security agencies have long held concerns that telecommunications equipment and other hardware contain embedded spyware or backdoors, giving the Chinese state a potential lever for espionage or sabotage. Chinese manufacturers often do not provide full specifications of algorithms, making it nearly impossible to screen for malicious code. This creates an unacceptable risk, particularly in critical infrastructure. The recent weaponisation of social media platforms like TikTok to conduct influence operations in Taiwan serves as a stark reminder of how apparently civilian Chinese technology is deployed to achieve Chinese state objectives.

An old idea for a harsher time

The three problems described above are not separate challenges. A state that exerts military pressure on the border is the same state that will use economic supply chains and technological dependencies as levers of power. A policy that addresses only the trade deficit or only military preparedness is incomplete. A sound strategy must be holistic, designed to neutralize all three threat vectors simultaneously. We think there is a clear possibility in infrastructure financing.

The proposal to channel Chinese capital into Indian infrastructure is not new. Its intellectual foundations were laid over a decade ago, in a very different geopolitical climate. In 2013, one of us (Ajit Ranade) first articulated the synergy that exists between China’s problem of a chronic current account surplus, and India’s infrastructure financing gap. At the time, China’s reserves stood at around \$3 trillion, much of it earning low yields in US treasury bonds. India, meanwhile, needed over \$1 trillion to fund its infrastructure development. A direct investment alliance was proposed, suggesting that even a small fraction of China’s capital -- just 1% annually -- could make a material difference to Indian infrastructure investment.

This economic logic was developed by one of us (Nitin Pai), with the idea that such investments should be directed towards specific, low-risk assets. The insight was that "concrete infrastructure, such as highways and bridges," would be in both countries' interests, providing China with decent long-term returns and India with low-cost financing. Crucially, such assets "do not undermine national security, nor do they lock us into Chinese technology." The key insight was that while India should be open to such investment, it must never be treated as an "ordinary economic relationship".

These ideas were conceived in an era of cautious optimism, a time when some observers still spoke of an "evolving maturity" in the relationship. The reality of the subsequent decade, with enhanced nationalism and militarism in China, with the journey from Doklam to Galwan to Operation Sindoor on the Indian relationship, makes us more cautious. However, the failure of that optimism does not invalidate the underlying economic logic. If anything, the fundamental asymmetry has grown more pronounced. China’s internal economic model has produced an even greater capital surplus in search of stable returns, while India’s infrastructure needs have expanded on its path to becoming a \$5 trillion economy.

The logic of the transaction is stronger than ever. What has changed is the risk assessment. Therefore, the task today is not to discard this old idea but to harden it. It must be adapted for the present moment of hostility by encasing it in a robust framework of security protocols, transforming it from a tool of hopeful engagement into a mechanism for de-risked, pragmatic co-existence.

A framework for safe capital: The three locks

For Chinese capital to be acceptable, it must be rendered strategically inert. This requires a framework of safeguards -- a system of "three locks" -- designed to strip the investment of any potential for geopolitical leverage, espionage, or strategic entrapment. This transforms the nature of the transaction from a potential vector of hostile influence into a simple commodity purchase, where India is procuring capital under tight conditions.

The first and most critical safeguard is the separation of ownership from control. Under this rule, Chinese entities may act as pure financial investors -- either as equity holders or debt providers -- but they should be explicitly and legally denied any role in the management, operation, or maintenance of the infrastructure asset. Their role should be purely passive and financial.

The rationale for this lock is to prevent the weaponization of critical infrastructure. A cautionary tale comes from Europe’s recent experience with Russia. Gazprom, the Russian state-owned energy giant, was not just a supplier of gas to Germany; it also owned and operated critical gas storage facilities on German soil. In the months leading up to the 2022 invasion of Ukraine, Gazprom strategically ensured these storage tanks were left empty, deliberately manufacturing an energy scarcity within Germany that amplified Russia’s blackmail potential and left Germany more exposed. Allowing a strategic adversary operational control over critical infrastructure is an invitation to disaster. The operational lock is designed to prevent such a scenario from occurring in India.

The second safeguard is a ban on Chinese-origin technology within the funded asset. This means no Chinese-made hardware, software, sensors, control systems, or any other networked components. All procurement for technology, from surveillance cameras on a bridge to the software running a water treatment plant, should be sourced from approved, non-hostile jurisdictions.

This lock neutralizes the threat of technological Trojan horses. The global security establishment has consistently raised alarms about the risk of embedded spyware and hidden backdoors in Chinese-made equipment, from telecom networks to military sub-assemblies. Given the opacity of the technology and the near impossibility of conducting foolproof screening, the only truly secure approach is a blanket prohibition. The technology lock ensures that an infrastructure asset funded by Chinese capital cannot become a listening post or a vector for cyber-attacks.

The third safeguard is a risk-based, incremental approach to implementation. Engagement must not begin with a broad opening, but with a carefully phased and probationary process. The initial phase should be strictly limited to what can be termed "dumb infrastructure" -- assets with minimal technological sophistication and low strategic vulnerability. This category includes projects like roads, bridges, irrigation canals, and water and sanitation plants. These are physical assets where compliance with the operational and technology locks is easiest to monitor and enforce.

Only after a decade or two, during which Chinese investors demonstrate consistent and verifiable compliance with the first two locks, could India consider expanding the scope to more complex areas. This phasing creates a crucial probationary period, allowing India to observe behaviour, build confidence in its regulatory capacity, and retain an off-ramp if Chinese entities fail to adhere to the rules. India’s existing FDI screening mechanism, institutionalized in Press Note 3, provides a legal and administrative precedent for managing such a structured, approval-based process. More work is required on the Indian side to achieve institutional quality in such screening.

A better bet for Beijing

A skeptical reader might ask: why would China agree to such restrictive terms? The answer lies in a rational assessment of its own self-interest. From a purely financial perspective, a de-risked, passive investment in Indian infrastructure is a far superior proposition to many of the high-risk ventures China is currently entangled in across the developing world. China has a big and structural current account surplus: the economic system suppresses consumption and lacks good investments at home, so capital must go out. Their choices for destinations for this capital -- from financial assets in the West to infrastructure assets in developing countries -- are all problematic.

China’s flagship Belt and Road Initiative (BRI) has a deeply troubled track record. Beijing is now navigating the uncomfortable role of being the world's largest official debt collector. An astonishing 80% of its overseas lending portfolio in the developing world is supporting countries already in financial distress. Overdue repayments are soaring, and many borrower nations, which have poor credit ratings and unstable political environments, are at high risk of default. The result is that for the next decade, China is set to be more of a debt collector than a banker to the developing world, facing a "tidal wave" of repayments from countries that simply cannot pay.

Investing in India under the proposed framework offers a different risk-return profile. India has maintained its investment-grade credit rating for nearly two decades, has a consistent history of honoring its sovereign and commercial commitments, and possesses a stable political system anchored by some rule of law. While returns might be more modest than the nominal rates on risky BRI loans, they would be predictable, secure, and denominated in a relatively stable currency. For Chinese state-owned banks and funds seeking to diversify their portfolios and secure safe, long-term yields, a passive financial stake in the growth of one of the world's fastest-growing major economies is a rational choice. The proposal is not a concession asked of Beijing; it is a superior financial opportunity offered to it.

Conclusion: Building a stake in stability

This proposal is not a policy of friendship. It is a strategy of pragmatic, self-interested, and de-risked engagement designed for a world of wary rivals. The immediate goal is to build Indian infrastructure with low-cost capital. But the long-term strategic objective is more subtle and more significant. It is to give China a tangible, financial stake in India's economic success and, by extension, in regional stability.

In international relations, particularly between rival powers, the creation of mutual interdependencies -- even highly constrained ones -- can act as a stabilising force. The current India-China relationship is almost entirely a zero-sum game, where a gain for one side is perceived as a loss for the other. This framework introduces a small but meaningful positive-sum element. By creating a channel where Chinese state-owned entities can profit directly from India’s continued economic growth, it adds a new variable to Beijing’s strategic calculus. It introduces a direct financial cost for actions that might destabilize India and the region. Chinese ownership of \$100B of bridges in the Indian Himalayas changes the logic of a next invasion.

This will not resolve the fundamental strategic conflict between the two nations. It will not end the border dispute or erase the deep-seated mistrust. What it can do, however, is build a small constituency within the Chinese state whose interests are aligned with a stable and prosperous India. Over a decade, as such a portfolio could potentially grow, the cost of conflict for Beijing would rise. This is the long-term payoff: not a chimerical peace, but a measure of calculated, self-interested restraint born from a tangible stake in the status quo. It is a modern, economic form of deterrence. To dream of a better peace over a ten-year or twenty-year horizon, we must lay the foundation through safe, feasible, and mutually beneficial steps today. This is one such step.

Bibliography

Bambawale, Gautam. Modi’s SCOpe of influence, The Times of India, 30 August 2025.

Pai, Nitin. How India should deal with economic investment from a politically hostile China, The Quint, 5 May 2020.

Ranade, Ajit. China can fund India’s infrastructure", Livemint, 13 May 2013.

Shah, Ajay. A pivot to China?, 2 September 2025.

Shah, Ajay and Ila Patnaik. The case for trade barriers against Chinese imports, Business Standard, 24 June 2024.

Data localisation in India: Questioning the means and ends

by Rishab Bailey and Smriti Parsheera.

Data localisation has become a recurring topic in Indian public policy debates. This has been prompted by moves such as the RBI directive in April 2018 mandating local storage of all payments-related data; the proposals in the draft Personal Data Protection Bill, 2018; and localisaton proposals in other sectors such as e-commerce and health. Calls for localising data are increasingly tied together with the narrative of "data colonisation", with localisation being seen as an antidote to control of global data sets by large multi-national corporations. At the same time, there are broader concerns about the growing relevance of the digital economy, its diverse socio-economic impacts and the limited ability of states to effectively regulate this space. In the absence of a global compact on issues such as privacy, cyber security, surveillance, and cross border data flows, data localisation is being seen as a tool, although a contested one, to exert national control over the digital ecosystem.

Much of the conversation around localisation has been centered around economic arguments, in terms of its compliance costs, impacts on the industry and overall economic growth. In a recent paper on this subject, we try to broaden this debate by classifying the arguments around localisation into three perspectives -- the civil liberties perspective, with a focus on expression and privacy rights; the government functions perspective, focusing on data access by state agencies for regulatory and law enforcement purposes; and the economic perspective referred to above.

Following an exploration of these different perspectives, we note that the overall costs of across the board data localisation norms are likely to outweigh its expected benefits. Yet, there may indeed be circumstances where a narrowly-tailored localisation requirement might be justified. Therefore, rather than implementing far reaching, but poorly thought out, solutions mandating data localisation, the current focus should be on building a transparent process for weighing the trade-offs of data localisation in different contexts. At the same time we must be equally cautious of sweeping "free flow of data" provisions in international trade agreements, which may amount to giving up the ability to adopt specific measures as and when a need is identified.

What is data localisation?

The term data localisation generally refers to requirements for the physical storage of data within a country's national boundaries although it is sometimes used more broadly to include any sort of restrictions on cross border data flows (Chander and Le, 2015). Ferracane (2017) categorises such restrictions into two broad heads -- strict and conditional. The former category includes requirements of local storage or processing of data or, in stricter cases, a complete ban on transferring the data abroad. In case of conditional restrictions, the transfer of the data is made subject to the satisfaction of certain conditions, such as obtaining the consent of the user before transferring the data.

In the paper, we use the term in its commonly understood sense, implying the mandatory requirements of local data storage. This could be in the form of exclusive retention norms, which mandate that the data should be retained only on domestic servers, or the slightly less stringent version of data mirroring that compels at least one copy of the data to be stored locally.

Despite the attention it has garnered in recent times, the data localisation debate in not something new. As per a study conducted by the European Centre for International Political Economy, over 80 different localisation measures were introduced in the 64 countries studied by them in the last 50 odd years (Ferracane, Lee-Makiyama & de Marel, 2018). Links can however be drawn between the surge in data localisation measures in the last ten to fifteen years and the rise of the data-driven economy with accompanying social, economic and political consequences.

While some countries, like Russia, China, Vietnam and Indonesia, have opted for relatively broad based localisation requirements, most others tend to apply differential standards based on the nature of the data and the sector to which it pertains. To take a few examples, sectoral localisation norms are found in Australia (health data), France (data relating to judicial proceedings) and Germany (telecommunications metadata and tax accounting data) (Cory, 2017). It is also common to find localisation requirements for government and public sector data. India has also adopted localisation norms for certain specific types of data, such as public records as well as data held by telecommunications providers. Pursuant to the RBI's directive in 2018, all payments sector data is also required to be stored "only in India". The paper criticises the manner in which this decision was brought into effect, without sufficient articulation of the objectives; inadequate justification for choosing exclusive localisation as the most appropriate response; and absence of any public consultation.

In the sections that follow we outline the implications of localisation measures from the civil liberties, government functions and economic implications perspectives.

Civil liberties perspective

While localisation may affect a number of rights, including those relating to business, property and association, the primary rights affected are that of privacy and freedom of speech and expression.

Privacy and security of data: The increasing privacy awareness in India, particularly after the Supreme Court's judgment in the Puttaswamy case and the Cambridge Analytica-Facebook incident, is often used as a peg to demand the localisation of personal data. This is also reflected in the Personal Data Protection Bill, 2018, which mandates the creation of local copies of all personal data (subject to certain exceptions). The Bill also requires exclusive domestic processing of certain categories of data, which are to be notified in the future. Given the increasing volumes of user data being generated and captured in the digital ecosystem and the possible harms that may occur from unauthorised uses of personal data, there is little doubt about the need for having appropriate legal and technical frameworks for data protection. It is, however, questionable whether merely locating data within the territory of India would actually make it any safer or less likely to be misused, particularly in the absence of a modern and well-functioning data protection law.

There are three sets of issues to be considered in this context:

1. Architectural issues: The first set of questions relate to whether localisation would lead to greater centralisation or decentralisation of data; and which of these would be preferable from a security and data protection perspective? Some argue that forced localisation would cause providers to spread their resources over a large number of locations, with reduced security at each level (Cohen et al., 2017). It is also argued that domestic enterprises may lack access to the necessary infrastructure and technical or human capacity to implement strong data security measures (compared to bigger, globally competitive entities based in jurisdictions of their choice) (Chander & Le, 2015). Kuner (2015) however points to the "jackpot problem" -- that hackers often target large global players, precisely because of their size and the quantity of user information they store. In addition, there is also the question of how data localisation requirements will be monitored and enforced and what this may mean from a civil liberties perspective.
2. Adequacy of current laws: While privacy has been recognised as a fundamental right, the institutional framework for enforcing this right still remains inadequate. Indian law also continues to grant wide powers of interference with privacy rights to the Government. Notably, the Government has broad powers to call for information under the Criminal Procedure Code and other surveillance related laws. In the absence of broader legal or regulatory reform, it is therefore questionable whether localisation will actually enhance privacy and security of personal data of Indians. It is worth noting in this respect that instead of insisting on mandatory localisation, alternative and less intrusive measures could also be considered to ensure the safety of data irrespective of its location. The European GDPR, for instance, utilises measures such as binding contractual rules and adequacy decisions to ensure that data is protected irrespective of its location.

Given the requirements for an interference with the fundamental right to privacy, as articulated by the Supreme Court in the Puttaswamy case, the onus would be on the state to demonstrate the proportionality and necessity of any localisation measures. This would involve demonstrating that no alternative, less intrusive means are available to reach the same end, which will be hard to justify in case of sweeping localisation measures.

3. Domestic and foreign surveillance: In the absence of adequate checks and balances in the law, localisation can enable more intrusive information gathering by local intelligence and law enforcement agencies (LEAs). While acknowledging this concern, it is sometimes argued that localisation would also limit the ability of foreign intelligence agencies to spy on Indian data. However, the sufficiency of this reason as a ground for localisation can be contested on three fronts. First, as noted above, localisation would make it easier for local agencies to carry out surveillance, both through legal as well as extra-legal means. Increased surveillance by domestic agencies would constitute a greater immediate threat to citizens compared to surveillance by foreign agencies. Second, legal developments such as the passage of the CLOUD act in the United States (US) authorise US agencies to access data stored abroad by US companies. Finally, given what we know about the pervasive and sophisticated nature of intelligence tactics used by several agencies, localisation may not actually stop them from accessing local data. To fully safeguard domestic data against any such interference will require a level of isolation from the Internet, which is not desirable or even possible in a modern democratic setup.

It therefore appears that localisation may increase domestic surveillance while the benefits with respect to foreign surveillance remain unclear. However, in this context one also has to keep in mind that while a citizen may have some protections against surveillance conducted domestically, this would be much harder in case of surveillance by foreign actors.

Ultimately, the degree of protection afforded to data depends on the effectiveness of the data protection regime and the technical measures being implemented. India is currently lacking on both parameters. Without such frameworks in place, using privacy or security of data or the possibility of a data breach as an explanation to mandate localisation appears far-fetched or, at best, premature. In general, the interests of Indian users would be better served by making sure that the relevant data is adequately protected, irrespective of its location, by putting in place a comprehensive law covering issues of data retention, access by regulators, courts and LEAs and safer mechanisms for cross border data transfers.

Freedom of speech and expression: As far as the effects of localisation on expression rights are concerned, one must keep in mind that an essential characteristic of the Internet is the ability to send and receive information freely across borders. This global access enables the Internet's generativity -- the capacity to enable unforeseen innovation; which could be harmed by broad localisation norms. While merely locating data in a country does not in itself make it vulnerable to censorship (or surveillance); data would certainly be more vulnerable if the country the data was located in had laws that gave the state greater powers of restricting access to content, or if it lacked the capacity or will to ensure proper oversight of its executive agencies.

The Indian state has been increasingly resorting to broad based censorship measures in the digital space. Examples of this include the proposal of requiring Internet intermediaries to undertake proactive monitoring of content on their platforms (Bailey, Parsheera and Rahman, 2019); and the increasing number and duration of Internet shutdowns. These instances indicate that localisation may provide yet another tool for the state to carry out censorship more easily and effectively.

Localisation could also mean that smaller entities or those that do not consider India to be a significant enough market to justify the financial and transactional costs of localisation could pull out their services. This is known to have happened in the European context post the enactment of the GDPR, which resulted in some online multiplayer games and foreign news websites becoming inaccessible to European users. It is also worth remembering that censorship of localised content could make it inaccessible all over the world (not just domestically).

One of the arguments put forth by the Justice Srikrishna Committee in support of localisation is that it would reduce the vulnerabilities that India may face in case of any breach in undersea cables and resulting disconnection from the Internet. We believe that the benefits to speech rights, which may result in that (low probability) circumstance, are offset by the real threat of increased censorship and denial of access to media and services on an ongoing basis.

Government functions perspective

It is the duty of a state to ensure that individuals are adequately protected and have an effective remedy for breach of their rights. This requires state agencies to have appropriate tools for the investigation and take down of illegal content, in accordance with the procedure established by law. Equally, regulatory entities also have genuine requirements to access data in connection with the discharge of their functions. It has however been noted that jurisdictional and other barriers often make it difficult for domestic agencies to gain legitimate access to the required data. The absence of broader international agreements on cross-border data sharing and complexity or delays in the processes under mutual legal assistance treaties (MLATs) further complicate this problem.

On the face of it, it therefore appears that localisation would aid law enforcement and other domestic institutions to implement local laws more effectively. It would also not be a stretch to argue that companies are far more likely to respond to requests from local authorities in circumstances where these agencies are in a position to take punitive action against physical infrastructure or personnel. However, a closer examination may lead one to question whether localisation will indeed help enforce laws or secure regulatory access on account of the factors listed below.

1. Location not the only determinant: Location is not the only determinant of lawful access by LEAs and regulatory agencies. A significant amount of data flows are encrypted in nature. In fact, regulatory entities such as the RBI themselves mandate encryption of certain forms of data. This implies that even if the data is stored locally, authorities have to go through the process of making lawful decryption requests before the data is accessible to them in a usable form. The Apple-FBI situation where the company refused to decrypt data for the FBI illustrates the kind of barriers that may be faced in this process.
2. Need for proportionate measures: Localisation may not always be the proportionate or least intrusive measure to ensure regulatory access or compliance with local laws. For instance, the entities captured by the RBI directive for the payment sector, already have various reporting and access requirements by virtue of being licensed service providers. These could be made more stringent without a need to localise the data. Similarly, tax laws are also evolving to account for cross-jurisdictional activities -- for example, through the "equilisation" levy adopted in 2016 and the more recent development on taxation based on "significant economic presence" irrespective of having a place of business in India.
3. Legitimacy of requests: The apparent unwillingness on the part of global intermediaries (such as Google and Facebook) to comply with government requests for information, does not necessarily imply a recalcitrance on the part of these business to comply. It may for instance indicate vague or improper requests being made by the Government and its agencies. That said, anecdotal evidence, whether in the form of the Snowden revelations or otherwise, does reflect a significant mismatch in the information sharing by large Internet intermediaries with Governments in their home countries compared to countries such as India.

To the extent that legitimate Government access remains a problem, the existence of less intrusive measures that could achieve the same ends needs to be explored. For instance, the Telecom Regulatory Authority of India had noted in its cloud computing recommendations that India should try and sign more MLATs and more holistic ones, which could also include mechanisms for electronic processing of requests. The private sector could also be encouraged to adopt electronic reporting mechanisms for government requests. For instance, reports suggest that Apple is already working on such a platform. At the same time, more work needs to be done on identifying the specific problems being faced by law enforcement or other agencies in accessing any specific types of data; the responsible stakeholders and targeted interventions that may be adopted. Where necessary, such measures may include limited localisation. This may, for instance, mean requiring specific categories of providers to keep a copy of the data within the country, if it can be clearly demonstrated that immediate and on-demand access to specific types of data is necessary for the discharge of specific state functions and the same cannot be achieved through other less intrusive means.

Economic perspective

The third set of arguments one sees in the context of localisation relate to issues of the Internet economy and costs of localisation measures. We consider three issues in this context: first, the macro and micro economic costs of localisation; second, the effects on the local economy in terms of inviting reciprocal measures, boosting competition in the sector or aiding local manufacturing or AI industries; and finally, we examine how localisation related measures are increasingly becoming a part of the international trade discourse.

Costs and impacts on the economy: One of the main arguments against mandatory localisation stems from the cost that it is likely to impose on businesses and consequently, consumers and the economy as a whole. Widespread localisation norms will mean that businesses and other users -- both domestic and foreign -- will no longer have the flexibility to choose the most cost-effective or task-specific location to store their data. In addition to reducing the benefits made possible through economies of scale, companies will also need to duplicate infrastructure in multiple jurisdictions. The global nature of the Internet has also enabled numerous cross-jurisdictional services, platforms and functions - ranging from high-end cloud based services to detection of fraud in credit card systems using cross-jurisdictional data. These costs / efficiency losses will ultimately be passed onto consumers in the form of higher costs of service or reduced functionality.

While several sources refer to the cost implications of localisation, there are only a handful of studies that actually attempt to quantify the potential economic gains or losses. The most oft quoted (though not uncontested) study on this subject has been released by the European Centre for International Political Economy. This predicts a reduction of the Indian GDP by almost a percentage point should broad localisation measures be introduced (Bauer et all, 2014). The authors note that any gains stemming from data localisation are too small to outweigh losses in terms of welfare and output in the general economy. Another study points to how forced data localisation laws would require companies to pay 30-60 percent more for their computing needs (Leviathan, 2015). Two newer studies however demonstrate that while restrictions on cross border data flows inhibit trade and services, policies targeting the uses of data, which include measures ranging from data retention requirements to government access and data breach notification norms, have a much larger negative impact on productivity (Ferracane and van der Marel, 2018; Ferracane, van der Marel & Kren, 2018)

Looking at the digital ecosystem in India, it appears that the costs imposed by broad localisation measures would be non-trivial, given the underdeveloped state of India's data center infrastructure. A part of this is due to the costs involved in building large data centres, the absence of proper downstream infrastructure such as uninterrupted power supply as well as weather conditions in India which necessitate greater expenditure on cooling. Notably, a Gartner study in 2015 found that India held just about 1.2 percent of the world's data center infrastructure and 5.23 percent in the Asia-Pacific region (IAMAI, 2016). Taking into account factors like energy cost, international bandwidth, ease of doing business and taxation provisions, the Cushman and Wakefiled (2016), Data Center Risk Index score placed India at thirty sixth position, with a score of 47.84 (out of a highest score of 100). Essentially, present conditions make it uneconomical and inefficient to host large quantities of data in India. The now abandoned report of the draft e-Commerce Task Force (2018), also acknowledged this fact. It highlighted the need for capacity development in terms of infrastructure for data centres, improvements in power supply and tax benefits before mandating full data localisation.

Effects on the domestic industry: While it is often claimed that localisation could provide a boost to local manufacturing and employment, this is contestable on the grounds that most equipment in data centres is imported and in any event, not much employment is generated by data centers. For instance, a $1 billion data center built by Apple in North Carolina, United States in 2011, created only 50 full-time jobs and another 250 support jobs in areas such as security and maintenance (Cory, 2017).

It is also unclear how localisation measures could act to aid competition (or reduce the reach of large dominant players) in the digital economy. Bigger companies are generally better placed to respond to and meet regulatory requirements. It is therefore possible that while the bigger companies can easily afford to set up data centers in India, smaller firms (whether Indian or foreign) may face relatively higher entry barriers on account of increased costs, thereby hampering competition in some sectors.

Another powerful narrative that has emerged in recent times is about the need for domestic mechanisms for the creation, sharing and use of data for the development of artificial intelligence (AI) development. To quote from the Justice Srikrishna Committee's report, "The growth of AI is heavily dependent on harnessing data, which underscores the relevance of policies that would ensure the processing of data within the country using local infrastructure built for that purpose". In this respect, it is not very clear how merely locating data in India will make it accessible for beneficial research, in the public or private domains.

One must also be aware of the possibility of retaliatory measures and the effects this could have on the vital information technology (IT) and related sectors. The IT sector contributed about 7.9 percent of India's GDP in the year 2017-18 (MeITY, 2018) and a sizeable part of export of India's IT services sector comes from the outsourcing / business process management industry (IBEF, 2018). Therefore, India's role in furthering a global push towards increased data localisation needs to be considered carefully, taking into account the likely consequences of reciprocal localisation measures by other countries.

Free trade agreements (FTAs): The growing importance of global e-commerce has placed data localisation debates at the heart of many international trade discussions. The US, in particular, has been at the forefront of pushing for the removal of various kinds of restraints on cross-border trade carried out through electronic means. Despite attempts by the US and other countries like Canada and Japan, the e-commerce conversation at the World Trade Organization (WTO) level is limited to discussions and has not achieved a rule-making mandate (Macleod, 2015). Many developing countries, including India, have resisted a broadening on this mandate. Many researchers also oppose this sort of "mission creep" at the WTO on the ground that it would require developing countries to sign away their right to strategically regulate the digital market and data flows (Gurumurthy and Chami, 2017).

While the global e-commerce discussions under the WTO have not managed to progress, provisions relating to cross-border trade and localisation of data have found their way into other multilateral arrangements. Prominent among these are the recently signed Comprehensive and Progressive Agreement for Trans-Pacific Partnership and the recently signed US-Mexico-Canada Free Trade Agreement. These arrangements contain fairly strong measures to support the free flows of data across borders.

The position adopted by those who seek to include data flow related issues in trade agreements appears to be based on the notion that personal data must be treated as any other commodity. Accordingly, free flows of data must be the de facto
position unless justified by overwhelming public policy concerns. What constitutes a legitimate public policy concern would be adjudicated at the international level, under the WTO framework (Hill, 2017). However, this approach has been challenged on three grounds. The first is a rights-based argument that sees personal data as being essential to a person's autonomy and identity, and therefore more than a tradeable commodity. Second, is the fact that commercial exploitation and trade in commodities of various kinds are in any case subject to various kinds of regulation or taxes. Third, is the concern that the use of WTO mechanisms for handling data flows would reduce democratic control over data (Hill, 2017).

Ultimately, irrespective of whether one considers trade negotiations to be an appropriate location to discuss cross-border data flows, a global resolution of the issue appears unlikely unless the rights based, economic and strategic concerns of developing nations are duly accounted for. The concern, however, remains that despite the absence of an agreement at the WTO level, widely worded data flow restrictions have already found their way into a number of bilateral and multilateral trade agreements.

Conclusions

The paper examines the key arguments that are generally used to make a case for data localisation under three heads. First, there is the claim that local hosting of data will enhance its privacy and security by ensuring that an adequate level of protection is given to the data. Second, it is argued that lack of government access to data (due to it being stored in another jurisdiction) impedes the law enforcement and regulatory functions of the state, which can be addressed through localisation. Third, there is the narrative on the economic benefits that will accrue to the domestic industry in terms of creating local data infrastructure, employment, and contributions to the AI ecosystem.

Following an assessment of each of these perspectives we find that the costs of introducing broad and sweeping data localisation norms are likely to outweigh its benefits, from a rights-based perspective as well as an economic one. India's approach to this question must also be informed by strategic thinking on whether a closed data economy or an open one would be more conducive to meeting its long-term social and economic goals.

However, this is not to suggest that data localisation can never qualify as a justified measure. There may indeed by circumstances where local storage (and even processing) of the data can be justified, particularly on certain normative grounds. In order to identify such instances and arrive at a narrowly tailored response, the policymaking process should ensure that any measures are adopted only pursuant to a well-defined and transparent evaluation process. The steps in this process would include (i) articulation of the specific problem(s) that are sought to be addressed: (ii) identification of the range of measures that could be used to combat the problem and assessment of the expected costs and benefits of each intervention; and (iii) evaluation of whether localisation is the least restrictive means to address the problem, with a graded approach of considering the least intrusive form of localisation before proceeding to stricter requirements. Importantly, this entire process should be carried out in an open and transparent manner allowing stakeholders the opportunity to question and strengthen the analysis.

References

Bauer et al, 2014: Matthias Bauer, Hosuk Lee-Makiyama, Erik van der Marel and Bert Verschelde, The costs of data localisation: Friendly Fire on Economic Recovery, ECIPE Occasional Paper, No. 3/2014.

Cory, 2017: Nigel Cory, Cross Border Data Flows: Where Are the Barriers and What Do They Cost?, Information Technology and Innovation Foundation, May 2017.

Chander & Le, 2015: A Chander and UP Le, Data nationalism, Emory Law Journal, 64(3).

Ferracane, 2017: MF Ferracane, Restrictions on cross-border data flows: a taxonomy, European Centre for International Political Economy.

Ferracane, Lee-Makiyama & de Marel, 2018: MF Ferracane, H Lee-Makiyami and EV der Marel, Digital trade restrictiveness index, European Centre for International Political Economy.

Goldsmith and Wu, 2006: J Goldsmith and Tim Wu, Who controls the internet: Illusions of a borderless world, Oxford University Press.

Baeur, 2016: M Bauer, MF Ferracane, E van der Marel & B Verschelde, Tracing the conomic impact of regulations on the free flow of data and data localisation, Centre for International Governance Innovation and Chatham House.

Gurumurthy and Chami, 2017: A Gurumurthy & AVN Chami, The grand myth of cross border data flows in trade deals, IT for Change.

Leviathan, 2015: Leviathan, Quantifying the costs of forced localisation, Leviathan Security Group.

IAMAI, 2016: Internet and Mobile Association of India, Make in India: Conducive policy and regulatory environment to incentivise data center infrastructure.

Ferracane & van der Marel, 2018: MF Ferracane & E van der Marel, Do data policy restrictions inhibit trade in services?, European Centre for International Political Economy.

Ferracane, van der Marel & 2018: MF Ferracane, E van der Marel & J Kren, Do data policy restrictions impact the productivity performance of firms and industries?, European Centre for International Political Economy.

IBEF, 2018: India Brand Equity Foundation, IT & ITeS Industry in India.

Macleod, 2015: J Macleod, E-commerce and the WTO: A developmental agenda, GEG Africa.

Hill, 2017: R Hill, Second contribution to the June-September 2017 Open Consultation of the ITU CWG-internet, why should data flow freely?, Association for Proper Internet Governance.

MeITY, 2018: Software and services sector, Ministry of Electronics and Information Technology.

Srikrishna Committee, 2018: Report of the Committee of Experts under the Chairmanship of Justice BN Srikrishna, A free and fair digital economy: Protecting privacy, empowering Indians.

Ecommerce task force, 2018: Electronic commerce in India: Draft national policy framework (non-official version), Medianama.

Cushman and Wakefield, 2016:Data center risk index, Cushman and Wakefield.

 

The authors are technology policy researchers at the National Institute of Public Finance & Policy. They thank Ajay Shah for valuable discussions.

Placing surveillance reforms in the data protection debate

by Rishab Bailey, Vrinda Bhandari, Smriti Parsheera and Faiza Rahman.

Introduction

On July 27, 2018, the Committee of Experts constituted by the Government under the chairpersonship of (Retd.) Justice B.N. Srikrishna (Srikrishna Committee) released its report and the Personal Data Protection Bill, 2018. The Committee's recommendations make some headway in proposing legal reforms governing the use of personal data by intelligence and law enforcement agencies (LEAs), but fall short of offering a comprehensive solution (Bhandari, 2018).

Against this backdrop, our working paper on "Use of personal data by intelligence and law enforcement agencies" provides an overview of the existing framework on surveillance in India followed by an inquiry into how these laws and practices fare against the tests that were endorsed by the judges in Puttaswamy, the Supreme Court's right to privacy verdict. As we have previously noted on this blog, India currently does not have a comprehensive law regulating intelligence agencies/ LEAs, including on aspects such as the creation, composition, powers, functions and accountability of such bodies. What we have instead are separate provisions contained in the Telegraph Act, the Information Technology Act (IT Act), and the Criminal Procedure Code that enable government agencies to initiate lawful search and interception activities, based on the fulfilment of certain parameters. While assessing these laws and practices against the tests of legality, legitimate aim, proportionality and procedural safeguards identified in the Puttaswamy decision, we find the existing framework to be lacking in many respects.

The inadequacies of our current system become all the more evident when examined against the laws and practices of other jurisdictions that have worked harder to strike a balance between the civil liberties of individuals and the State's requirement to pursue legitimate surveillance activities. The general practice across jurisdictions is that privacy and data protection laws are also applicable to state intelligence and security agencies, albeit subject to certain exceptions (ICDPPC Census, 2017). It is important to keep in mind however, that exceptions are not all-encompassing or generic, and are usually to be applied in a proportionate manner.

In this post we highlight what can be regarded as legitimate and fair surveillance practices that are appropriate for the functioning of a democratic system. Based on a review of the current framework against the Puttaswamy tests and identified fair practices, we offer some recommendations on the next steps towards implementing holistic surveillance reforms in India. We also map these recommendations against the recommendations in the Srikrishna Committee report and the provisions of the draft law, and delineate how the draft law needs to be strengthened.

Principles of fair surveillance: International experience

International frameworks on surveillance have seen considerable development over the last decade. This has been due to changing technology and law enforcement needs, as well as instances such as the Snowden revelations that have led to greater global awareness about the need to adapt surveillance laws and practices to the modern communication era. Attempts have been made, at both the global and national level, to enhance the respect for privacy rights, through changes to statutes as well as through advocacy instruments such as the Necessary and Proportionate principles. Nevertheless, as observed by the UN Special Rapporteur on the right to privacy, no single surveillance related legislation perfectly complies with, and respects privacy rights (Joseph Cannataci, 2018).

The most commonly seen mechanisms used to ensure that LEAs/intelligence agencies act within their remit and with due respect to privacy rights include:

1. Judicial oversight: As a general rule, countries such as the United States (US), the United Kingdom (UK), New Zealand, Australia, Germany and Canada require prior judicial authorisation for initiating surveillance activities. Often greater protections are put in place for the protection of rights of citizens as compared to foreign subjects, although both cases may require a certain level of judicial scrutiny. For instance, in the US designated courts under the Foreign Intelligence Surveillance Act have been created to authorise foreign surveillance activities. While this ensures a certain degree of oversight it should be kept in mind that these proceedings have been criticised for the lack of transparency and accountability.
2. Oversight by legislature and independant bodies: Institutions such as Parliaments and Congress generally have extremely wide powers of supervision over the activities of LEAs/intelligence agencies, often through specific committees of panels charged with oversight. For instance, the US Congress has general powers of review over intelligence agencies. In Germany, the Parliament has a panel known as the Kontrollgremiumgesetz, while the UK has established an Intelligence and Security Committee. Both these countries have also established independant regulators to oversee the activities of LEAs/ intelligence agencies - the Office of the Investigatory Powers Commissioner and the G-10 Commission, respectively. Importantly, in addition to having access to the activities of agencies (which can extend to ex-ante reporting requirements), these bodies also publish regular public reports in pursuance of their oversight role. Further, the LEAs/ intelligence agencies themselves may also be subject to reporting requirements. In addition, transparency reports are often put out by intermediaries who receive information requests from these agencies.
3. Implementation of redress mechanisms: While some countries such as Canada, Germany, Belgium and Austria, provide notice of surveillance to the subject in certain cases (thereby allowing processes to be challenged by the concerned individual), others create mechanisms to enable challenges to illegal surveillance through other means. For instance, the US, empowers electronic communications service providers to file petitions before the FISA Court to set aside directives issued by intelligence agencies under the FISA Act. In Europe however citizens may approach redress forums without concrete evidence of having been the subject of surveillance measures. (Klass v Germany, (1979-80) 2 EHRR 214).
4. Implementation of organisational safeguards: The US, Germany and the UK have also implemented various administrative and technical safeguards to ensure adherence to privacy norms - ranging from embedding privacy/ethics officers within agencies, to implementing masking and other technical measures to ensure intrusions into privacy are minimised.

Key design principles for India

On mapping the legal framework and practices on surveillance in India against the Puttaswamy tests and globally recognised surveillance principles, we find our current framework to be lacking in many respects. The present set up is not well suited to meet the requirements of a system that guarantees the constitutional right to privacy or, for that matter, one that has limited state capacity in carrying out effective surveillance activities. We therefore need a system that is designed in a manner where the resources of the surveillance machinery can be optimally utilised without undue infringements into the right to privacy. Addressing these issues requires both a reassessment of the current legal framework as well as a re-evaluation of the philosophy that drives surveillance related activities by intelligence agencies and LEAs in India.

A risk-based approach to surveillance

The broad path towards safeguarding civil liberties in a system with limited state capacity lies in adopting a risk-based approach to surveillance. Countries such as the US and the UK have already moved in this direction by embedding certain risk management techniques within their surveillance architecture (Omand, 2010). This approach recognises that any country's resources are limited and therefore the surveillance architecture should focus on credible risks, whether they be reputational or operational. Apart from calibrating responses to the risk posed by different threats, this sort of an approach also takes into account broader risks such as the risks to privacy and other civil liberties, reduction of international trust in domestic firms and the impact of intelligence operations on relationships with other countries (Clarke et al., 2013).

We recommend that the Indian surveillance framework should also adopt systematic risk management as a key design principle to balance national security and privacy on one hand and limited state capacity issues on the other. The report of the Srikrishna Committee also endorses this recommendation, although the draft Bill, notably, is silent on this aspect.

Changes to the legal framework

India needs to build a robust legal framework governing the functioning of intelligence agencies. This requires the creation of a statutory framework governing intelligence agencies and LEAs, including their constitution, composition, powers and the accountability measures expected to be followed by them. The Srikrishna Committee's report recommends that the "Central Government carefully scrutinise the question of oversight of intelligence gathering and expeditiously bring in a law to this effect". It then goes on to state that although these recommendations are not directly made a part of the data protection law proposed by the Committee, they are important for the effective implementation of data protection principles and must be urgently considered.

While a data protection law may not be an appropriate site for pursuing a comprehensive reform of intelligence agencies and LEAs, there are several critical changes that can be adopted through the data protection law as well as amendments to existing laws that impact surveillance. We set out below specific recommendations that will help to ensure that any intrusion into an individual's right to privacy by state surveillance is in consonance with the principles in the Puttaswamy case.

1. Prior judicial review: Present Indian laws confer wide powers on the executive in terms of deciding the scope and manner of surveillance. Intelligence agencies and LEAs initiate requests for surveillance, which are then authorised by another executive agency - the Home Secretary in the Central and State Governments). Oversight of authorisation is also done by an executive agency - the Review Committee established under the Telegraph Rules. The decision in Puttaswamy held that any intrusion by the state in an individual's privacy rights is permissible only if it is supported by a "fair, just and reasonable procedure established by law". A process that is driven solely by one arm of the state mitigates from the system of checks and balances that is necessary to satisfy this criteria. We therefore recommend that the current processes need to be amended to incorporate an element of prior judicial review (or post-facto judicial scrutiny in emergency cases). This review may be conducted through specialised courts designated for this purpose or by judicial members of an independent body, such as a Data Protection Authority. The role of this body would be to apply the principles of legality, lnecessity and proportionality in each and every case to ensure that the nature of surveillance, its duration and scope is in line with the purpose that is sought to be achieved. Further, a mechanism for filing an appeal against the decision of the judicial body must be provided. The adoption of the proposed structure would require corresponding amendments to the Telegraph Act, IT Act and the rules thereunder.
2. Reporting and transparency by LEAs: Current laws need to be amended to ensure appropriate reporting and transparency requirements are implemented pertaining to all surveillance activities. These requirements may differ depending on the nature of information and the entity to which it is being provided (for instance, to the Parliament or the public). Reporting must be on both ex-ante and post facto basis, as may be relevant to the circumstances. Further, oversight bodies must also be required to publish periodic reports of their activities and that of LEAs/ intelligence agencies under their supervision, while service providers must be permitted to publish aggregated statistics detailing volume and nature of surveillance requests.
3. Implementation of data retention norms, principles of fair processing: Principles of fair processing must be applicable even to data processed by intelligence bodies/LEAs. They must also ensure that as far as possible, personal data is up to date and accurate, while data retention norms need to be appropriately designed to ensure only relevant data is stored by the authorised agencies.
4. Notice to the data subject: In order to achieve a balance between the objectives of surveillance and the rights of the data subject, the law should provide for an obligation to ensure that the affected data subjects are notified after completion of the surveillance. However, the agency may seek the approval of the judicial body to delay or avoid the requirement of notice under certain exceptional circumstances, for instance if it can be established that such a disclosure would defeat the purpose of surveillance.
5. Right to seek redress: The requirement of notice to the data subject must be accompanied by a right to challenge and seek appropriate redress against surveillance activities. This right should extend to a person who is, or has reasonable apprehension of being, the subject of surveillance. In addition, intermediaries that are required by law to facilitate access to information by LEAs should also have the legal right to question the scope and purpose of the orders received by them.
6. Privacy officers in LEAs: Independent officials must be appointed to the intelligence agencies and LEAs to scrutinise requests for surveillance (before they are placed before the sanctioning judicial body). Such scrutiny must be recorded in writing and available to relevant oversight bodies (if not the public).
7. Technical measures to enhance privacy: Technical measures and privacy by design principles must be used to inform surveillance procedures and ensure proportionality and due process. This may imply for instance, the use of masking techniques to protect identities of citizens caught up in bulk surveillance of foreign intelligence, ensuring collected data is encrypted, acess controls, etc.
8. Evidentiary value of information collected in breach of data protection law: Illegality in conducting search and surveillance activities does not lead to a bar on the admissibility of that evidence in subsequent proceedings under Indian law. Consequently, the incentives of LEAs are not fully aligned with the objective of ensuring that the legal processes governing surveillance are strictly followed. This will continue to pose a challenge even if privacy safeguards are introduced in the law. We therefore recommend that relevant laws should be amended to bar the admissibility of any information that is obtained by the agencies in breach of the proposed data protection law and other surveillance related laws.
9. Revisiting telecom licenses: Telecom licenses contain specific provisions relating to the obligations of telecom service providers (TSPs) to facilitate lawful interception activities. We recommend that to the extent that any of the provisions contained in telecom licenses create additional restrictions on the privacy rights of individuals, these provisions need to adopted through legislative instruments. Further, we recommend that the terms of telecom licences also need to be revisited in so far as they contain restrictions on the encryption standards that can be adopted by TSPs, which in turn limits the privacy rights of their users. The Telecom Regulatory Authority of India's (TRAI) recent recommendations on data protection indicate a positive move in this direction. The regulator recommended that the Department of Telecommunication needs to reexamine the encryption standards laid down in the telecom license conditions. It noted the need for personal data of telecom consumers to be encrypted, both during storage and in motion. Further, TRAI recommended that decryption by authorised entities should be permitted on a needs basis, either with the consent of the consumer or in accordance with legal requirements.
10. Transparency regarding standard operating procedures (SOPs): We recommend that any SOPs formulated by the Government to give effect to the provisions governing surveillance must be made publicly available and stakeholders should also be given an opportunity to contribute to their framing. To the extent that the SOPs might create any independent obligations on individuals or intermediaries, we recommend that the same should be supported by a legislative instrument.
11. Amendments to other laws: Provisions of the Whistleblowers Protection Act, 2011 need to be revisited to ensure adequate protection is given to whistleblowers who expose mala fides or illegalities in surveillance procedures. In particular, the general exemptions granted under the statute (to matters impinging on sovereignty or strategic interests of the state, disclosures under the Official Secrets Act, 1923, etc) may need to be revisited. Similarly, revisions may be required to the generic exemptions granted under the Right to Information Act, 2005, to various LEAs.

Reviewing the Srikrishna Committee's proposals

The Srikrishna Committee's draft law proposes protections relating to the collection, processing and use of personal data of individuals (referred to as data principals) and offers remedies from related harms. The draft law defines "harms" to include (i) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; and (ii) any observation or surveillance that is not reasonably expected by the data principal.

Sections 42 and 43 of the draft law deal with the processing of personal data in the (i) interests of the security of the state; and (ii) for prevention, detection, investigation and prosecution of any offence or any other contravention of law, respectively. In both these cases the identified activities are exempted from the requirements under the draft law if they satisfy the requirements of legality, necessity and proportionality. The exemption, however, does not include the requirement to ensure that any personal data is processed in a fair and reasonable manner (Section 4) and in accordance with reasonable security standards, including methods such as de-identification and encryption of the data and prevention of misuse and unauthorised access (Section 31).

In drafting these provision, the Committee has reiterated the position laid down by the judges in Puttaswamy, but without addressing the related structural and procedural elements required to make these principles work. For instance, the requirement of legality is incomplete without a description on what constitutes legality in case of access by intelligence agencies/ LEAs. Should it include only legality of the means of access or also require the need for a legislative basis for the agencies to whom such access is provided? Similarly, what factors should be taken into account to judge whether a proposed intervention is "necessary and proportionate" in the facts of the case? Who should be making this determination?

In the context of discussing the exemption of measures taken to ensure "security of the state", the Committee proposes that the law should provide for ex-ante access controls by designating a district judge to hear requests for processing of personal information by intelligence agencies in closed door proceedings. It also proposes that such approvals should be time-bound and require periodic renewal, subject to the judge being satisfied that the purpose for processing remains relevant. Further, the report talks about ensuring accountability through ex-post periodic reporting and review by a parliamentary committee.

The recommendations of the Committee point in the right direction, but their effectiveness is marred by the suggestion that such measures be adopted if and when the Government decides to pursue a comprehensive law governing intelligence agencies. Given that surveillance activities are already taking place, the immediate requirement would be to make amendments to the laws that enable such access to personal information by intelligence agencies and LEAs, namely the Telegraph and IT Act and the rules thereunder. The draft law proposed by the Committee already suggests some amendments to provisions contained in the IT Act and the Right to Information Act, 2005. The logical step would have been to at least incorporate similar suggestions on amendments to existing surveillance related laws to build in the safeguards suggested in its report regarding ex-ante analysis and ex-post accountability for surveillance related activities.

In terms of our other suggestions, the draft law includes an obligation of fair and reasonable processing and ensuring security of data even when such processing takes place under the given exemptions. It, however, fails to recognise other important requirements like having data protection officers inside intelligence agencies and LEAs; (deferred) notice to the concerned individual, and the right to seek appropriate redress. Further, the draft law also fails to address the issue of the evidentiary value of information collected in breach of the proposed data protection law.

Conclusion

The draft law proposed by the Srikrishna Committee has tremendous scope for improvement, both in terms of strengthening the protections available to individuals who are subjected to surveillance activities as well as the structural and procedural safeguards governing such access. Having said that, we also believe that the recommendations contained in the report, particularly on ex-ante and ex-post safeguards against surveillance, are an important starting point for this discussion. To take these suggestions to their logical conclusion, it is important that corresponding amendments should be made to the draft before it shapes into a bill that can be placed before the Parliament.

References

Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians, 2018.

Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, Personal Data Protection Bill, 2018.

David Omand, Securing the State: A Question of Balance, Chatham House, 8 June, 2010.

International Conference of Data Protection Privacy Commissioners (ICDPPC), Counting on Commissioners: High level results of the ICDPPC Census 2017, September, 2017.

Joseph Cannataci, Working Draft Legal Instrument on Government-led Surveillance and Privacy, 2018.

Richard A. Clarke, Michael J. Morell, Geoffrey R. Stone, Cass R. Sunstein and Peter Swire, Report and Recommendations of The President's Review Group on Intelligence and Communications Technologies, Obama White House, 12 December, 2013.

TRAI, Recommendations on Privacy, Security and Ownership of the Data in the Telecom Sector, 16 July, 2018.

Vrinda Bhandari, Data Protection Bill: Missed Opportunity for Surveillance Reform, The Quint, 28 July, 2018.

 

Vrinda Bhandari is a practicing advocate in Delhi. Rishab Bailey, Smriti Parsheera and Faiza Rahman are researchers in the technology policy team at the National Institute of Public Finance & Policy.

India's communication surveillance through the Puttaswamy lens

by Vrinda Bhandari, Smriti Parsheera and Faiza Rahman.

"In an uncivilized society where there are no inhibitions, only physical restraints may detract from personal liberty, but as civilization advances the psychological restraints are more effective than physical ones. The scientific methods used to condition a man's mind are in a real sense physical restraints, for they engender physical fear channelling one's actions through anticipated and expected grove" --- Justice Subba Rao's minority view in Kharak Singh vs Union of India (1964).

Introduction

Post the Snowden leaks in 2013, the international political community has been faced with complex debates around the state's need to conduct surveillance activities and its impact on the privacy of individuals. In India, this debate has gathered steam with concerns around the surveillance capabilities of the Aadhaar framework and the Supreme Court affirming privacy as a fundamental right in KS Puttaswamy v. Union of India. However, the Court in the Puttaswamy case also clarified that the right to privacy, like any other fundamental right, is not absolute and the state may have an interest in placing reasonable restrictions on this right in pursuance of legitimate aims such as protecting national security, preventing and investigating crime, encouraging innovation, and preventing the dissipation of social welfare benefits. Apart from indicating the broad parameters for restrictions to the right to privacy, a majority of the judges (Chandrachud J. speaking for 4 judges and Kaul J.) endorsed a European law-style proportionality framework to balance the right to privacy against competing interests.

In his dissent in the Kharak Singh case, Justice Subba Rao un-tethered the concept of privacy from the home and extended it to the idea of "psychological restraint", a precursor to the chilling effect argument. The majority in Puttaswamy too, acknowledged the chilling effect of surveillance on speech, movement, and activities of individuals. This becomes particularly important in the context of surveillance in the digital age -- ready availability and ease of access to information should not become a source for indiscriminate or mass surveillance.

While the need for lawful access by law enforcement agencies (LEAs) cannot be denied, what we need is a legal framework that lays down clearly defined parameters around who can gain access to personal information, under what circumstances and the legal process for the same. In this post we discuss the extent to which India's current communication surveillance practices are likely to withstand scrutiny under the tests identified by the judges in the Puttaswamy case.

How the proportionality standard works

Among other things, the Puttaswamy verdict is significant for its extensive reliance on the rich privacy and surveillance jurisprudence from the United States, Canada, Europe and United Kingdom and its endorsement of the International Principles on the Application of Human Rights to Communication Surveillance (Necessary & Proportionate Principles, 2013). These principle require the government to demonstrate that surveillance was absolutely necessary and there was no other less-restrictive means of achieving the legitimate aim. The principles include requirements of judicial oversight, due process, user notification (under certain circumstances) and transparency. Drawing from this body of work, the judges in the Puttaswamy case identify the following four steps to assess the constitutional validity of a law that infringes upon the privacy and personal liberty of an individual:

1. Legality: The existence of a law.
2. Legitimate goal: The law should seek to achieve a legitimate state aim (Chandrachud J.).
3. Proportionality: There should be a rational nexus between the objects and the means adopted to achieve them (Chandrachud J.). The extent of such interference must be proportionate and "necessary" to achieve its stated aim (Kaul J.). Justice Kaul's opinion can be read to espouse the European standard of least restrictive means.
4. Procedural guarantees: To check against the abuse of state interference (Kaul J.)

We take the example of three kinds of communication surveillance tools being deployed in India -- interception of phone calls under the Telegraph Act; direct access to communication flows by government agencies under the Centralised Monitoring System (CMS); and restrictions on encryption of data -- to assess how they would fare under the Puttaswamy tests.

Applying the Puttaswamy tests to communication surveillance in India

In India, basic powers to carry out surveillance-related activities flow from the provisions of the Indian Telegraph Act, 1885 (Telegraph Act), the Information Technology Act, 2000 (IT Act), the Code of Criminal Procedure, 1973 (CrPC) and the rules framed under those laws. These provisions empower the police as well as central agencies like the Intelligence Bureau, Narcotics Control Bureau, Directorate of Enforcement, National Investigation Agency, Research and Analysis Wing and others to gain access to a person's messages, calls and data transmissions for certain identified purposes. The processes laid down under the law are supplemented by "standard operating procedures" issued by the Ministry of Home Affairs and the Department of Telecommunications to LEAs and telecom service providers (TSPs), respectively.

As per a right to information (RTI) response sought by SFLC an average of 7500 - 9000 telephone-interception orders are issued by the central government each month. Add to this, the orders for data interception issued under the IT Act and orders issued by the state governments and the total figure is likely to be staggeringly high. Information revealed under Google's transparency report offers another indication of the volume of requests made by Indian authorities -- in 2017 Google received 8,351 user data disclosure requests from India, affecting about 14,932 user accounts.

The lack of a transparent mechanism to report the total volume of surveillance activities being undertaken by government agencies presents a major challenge. While some pieces of information can be sewn together from RTI requests, Parliament questions and initiatives like Google's transparency reports, this cannot substitute the need for direct information disclosures by the intelligence bodies themselves. The fact that many of these agencies and programmes have their basis in executive action, and do not have statutory legitimacy, only magnifies these concerns.

While the Government has recognised nine central LEAs and the state police authorities to conduct lawful interception activities, there is an absence of legal or institutional oversight over the exercise of these powers by the various agencies. An attempt to address this issue was made through a private members Bill, The Intelligence Services (Powers and Regulation) Bill, 2011, that sought to regulate the functioning and exercise of powers by Indian intelligence agencies, specifically the IB, RAW, and the NTRO. The Bill also provided for a Designated Authority for authorisation procedures and systems of warrants (for surveillance), a National Intelligence and Security Oversight Committee for oversight, and a National Intelligence Tribunal for investigating complaints against these three agencies. However, the Bill lapsed in October 2012, and these intelligence agencies continue to lack legislative backing, further raising questions about the proportionality of surveillance operations in India.

Lawful interception under the Telegraph Act

Section 5(2) of the Telegraph Act empowers the state to conduct lawful interception of phone calls and messages under certain specified circumstances. The constitutionality of this framework was upheld by a two-judge bench of the Supreme Court in PUCL v. Union of India (1997), subject to the adoption of appropriate procedural safeguards. This resulted in the subsequent amendment of the Telegraph Rules, 1951 to incorporate Rule 419A containing the procedure suggested by the Supreme Court. We examine below how the surveillance processes under this law are likely to be treated in case of a fresh challenge post the Puttaswamy verdict, specifically in light of the four tests identified by the judges.

Legality: The central and state governments clearly have the statutory authority to order lawful interception activities under the Telegraph Act and the rules under it. However, we argue that the principle of legality needs to be seen from a broader perspective -- it is not just about the existence of a law but also the context in which that legality was conferred. The Telegraph Act and rules were drafted in a context when bulk surveillance was not as easily possible and the discourse around privacy and surveillance was not as well defined. Since then, the capability of interception technologies at the disposal of government agencies and the volume of interceptions being carried out by them have increased exponentially. This merits a re-examination of the existing legal framework. The Necessary & Proportionate principles also state that given the pace of technological changes, legality vis-a-vis communication surveillance would entail laws that restrict the right to privacy to be subject to periodic review through a consultative legislative or regulatory process.

Legitimate aim: Section 5(2) of the Telegraph Act states that the central and state governments may, on the occurrence of any public emergency, or in the interest of the public safety, direct the interception of communications, in the interest of the sovereignty and integrity of India, the security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of an offence. Therefore, an order of interception will satisfy the requirement of legitimate aim so long as it is issued upon the occurrence of public emergency or in the interest of public safety and in pursuance of any of the six legitimate objectives listed above.

Proportionality: The third test requires that the means adopted should be proportionate for achieving the identified legitimate aim. In the context of communication surveillance, this would require the authority ordering interception to weigh the degree of the proposed intrusion against its anticipated gain. In the next section, we discuss some of the limitations of the present legal process, which hinder the due application of mind required for such a scrutiny.

The proportionality test also encapsulates within itself the principle of "necessity", which means that interception of communication should take place only when it is the least intrusive way of achieving the legitimate purpose. Rule 419A(3) of the Telegraph Rules adopts this principle by stating that relevant officer should issue an interception order only when it is not possible to acquire the information by any other reasonable means. While targeted surveillance based on evidence of suspicion may be the least restrictive way of achieving a legitimate aim, the current wording of the rules allows each interception order to cover "messages or class of messages" involving a "person or class of persons" or "relating to a particular subject". In doing so, it creates possibilities of bulk access to communications, which will inevitably intrude upon the privacy rights of several unsuspecting individuals.

Procedural safeguards: Rule 419A of the Telegraph Rules sets out certain procedural safeguards to govern the interception of communications, which emanated from the Supreme Court's decision in the PUCL case. Significant time has lapsed since that verdict and both the scope and the volume of surveillance activities has increased. For instance, the government has launched surveillance programmes such as the CMS, NETRA, NATGRID and made corresponding changes to telecom licenses to provide real-time access to the traffic flowing through TSP networks. Even without taking into account these developments, we find that the current procedure in the law would fail to constitute a "fair, just and reasonable" process on the following counts:

1. Rule 419A authorises members of the executive -- the Secretary to the Ministry of Home Affairs in the case of central government and the Secretary of the Home Department in the case of a state government (or in unavoidable circumstances, a Joint Secretary) -- to sanction orders of interception. Taking into account the volume of orders being issued by the government on a regular basis it is hard to make a case that the officers in charge of this function can ensure due application of mind to each and every request placed before them given their many other responsibilities.
2. The Telegraph Rules set up a Review Committee to check if interception orders were issued in accordance with the law. This committee comprises only of members from the executive such as the Cabinet/Chief Secretary along with Secretaries in charge of legal affairs and telecommunications. There is a conflict of interest in this review mechanism, as both the interception order issuing authority and the oversight authority comprise of members only from the executive.
3. There is no pre- or post-judicial oversight over the decision to place an individual under surveillance.
   

In contrast, surveillance legislations across democratic jurisdictions require that interception orders should be issued by a judicial authority. Other oversight mechanisms include bodies such as the Privacy and Civil Liberties Oversight Board in the U.S -- an independent statutory agency within the executive branch, which, among other things, reviews executive actions relating to counter-terrorism. Given the volume of interception requests and the technical nature of proportionality enquiry, the legal framework in India also needs to evolve accordingly. Elements of this framework should include (i) prior judicial scrutiny or post facto scrutiny, in emergency cases, for authorisation of interception requests; (ii) transparency requirements, such as the obligation to submit periodic reports to the Parliament detailing the volume and nature of the interceptions being carried out.

Centralised Monitoring System

Through a press release issued in 2009 the government announced its intention to set up "a centralized system to monitor communications on mobile phones, landlines and the internet in the country". This system would allow authorised LEAs to gain direct access to the traffic flows on the networks of TSPs. These plans were rolled out in 2013 when the telecom license agreement was amended to require TSPs to set up the prescribed infrastructure for their systems to be directly connected with regional monitoring centers (RMCs) of CMS through interception, store and forward servers. As per information placed before the Parliament in March, 2017, technology development and pilot trials of CMS had been completed and 18 of the 21 planned RMCs had been technically commissioned.

The CMS has been widely criticised for its all-encompassing nature, privacy threats and likely chilling effects (Litton, 2015). We question below how this system would fare under the specific tests under the Puttaswamy case.

Legality: The CMS project is not grounded in law (Datta, 2015). The only requirements relating to it emanate from the terms of the telecom license, which is in the nature of a contract between the government and TSPs. While a statutory requirement to ensure compliance with the licensing terms and conditions is contained under the Telecom Regulatory Authority of India Act, 1997, this is not a sufficient basis to attribute legality to CMS. Attempts to attribute legality to CMS may also be based on claims that it derives its powers from the existing provisions in the IT Act and the Telegraph Act. However, as we discuss below, the abilities of CMS extend far beyond the legislative intent of those laws which was to authorise interception of information only for certain specific purposes and after following a specified procedure.

Legitimate aim: Lawful interception by LEAs to meet the specific objectives identified under the IT Act and the Telegraph Act would constitute a legitimate aim. However, the manner in which CMS is designed does not provide for sufficient checks and balances to ensure that its use will in fact be confined to the satisfaction of those aims.

Proportionality: By its very design, a system that provides LEAs with direct access to all communications can not meet the requirement of proportionality. While the government may argue that the system is intended to be used only for lawful interceptions, the existence of a system where all information flows through the CMS and can be collected on tap by enforcement agencies vitiates the concept of targeted surveillance. Therefore, irrespective of whether such excesses are actually committed, the logical possibility of such an outcome reflects a lack of proportionality. As noted by the UN Special Rapporteur on human rights and countering terrorism, bulk access to communications is incompatible with the normative understanding of privacy as the "very essence of the right to the privacy of communication is that infringements must be exceptional, and justified on a case-by-case basis".

Procedural safeguards: The benefits of CMS, as articulated by the government, include having secure and instantaneous access to data by avoiding any manual intervention particularly from TSPs. However, by eliminating TSPs from the process, the system is also removing a layer of third party verification of interception requests. For instance, the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 (2009 Rules) provide that an intermediary that receives a request for interception is required to provide a written acknowledgment of the request; maintain proper records relating to the same; and submit a list of all requests received by it to the nodal officer of the authorised agency every fifteen days. By removing TSPs and other intermediaries from the interception process CMS will ensure that the complete control over the decision making and implementation of interception is vested wholly within different wings of the executive.

The lack of independent judicial oversight has already been pointed out to be an issue in the context of wiretapping under the Telegraph Act. This issue is further compounded in case of CMS due to the sheer scale of data that it allows LEAs to access without any accompanying safeguards. However, as noted above, the design of CMS does not even satisfy the minimum safeguards that are currently provided under the IT Act and the Telegraph Act. Any interception activities being conducted under it, even if for pilot tests, would therefore fall foul of present laws.

Encryption restrictions and decryption on demand

The adoption of sophisticated encryption technologies is a clear path towards ensuring better privacy protections. However, encryption also makes it harder for LEAs to access this information, often leading government agencies to demand lower encryption standards or backdoor entries to encrypted software and devices. Section 69 of the IT Act, read with the 2009 rules, permits the central and the state governments to order the decryption of a computer resource upon satisfaction of certain specified conditions. Further, Section 84A of the IT Act states that central government can frame rules to prescribe encryption standards and methods to secure electronic communications. While the government has not yet prescribed any modes and methods of encryption under Section 84A, a draft national encryption policy was released by them in September 2015, which was retracted shortly afterwards. This draft policy had, among other things, proposed requirements that:

1. Users should be able to reproduce on demand plain text and encrypted text pairs using the software/hardware used to produce the encrypted text from the given plain text.
2. The information should be stored for 90 days from the date of transaction and made available to LEAs on request.

Restrictions on encryption also flow from telecom license agreements. For instance, the Internet Service Provider (ISP) License Agreement requires ISPs to obtain prior governmental approval to deploy encryption which is higher than 40 bits (Part 1, Clause 2.2(vii)). The Unified License agreement (Clause 37.1), the Unified Access Services License agreement (Clause 39.1), and the ISP license agreement (Part 1, Clause 2.2(vii)) all prohibit bulk encryption by TSPs. Therefore, in the context of encryption, state surveillance capacity is bolstered through both the banning of encryption or laying down low encryption standards, and by providing for decryption on demand. We examine below how both these stipulations fare under the four-pronged proportionality analysis:

Legality: While the authority to order decryption of computer resources flows from Section 69 of the IT Act and the 2009 rules, no comprehensive encryption policy or rules have been framed under Section 84A of the IT Act prescribing encryption restrictions. The encryption restrictions that flow from telecom license conditions do not have a statutory backing.

Legitimate aim: Section 69 of the IT Act empowers the state to order decryption of a computer resource if it is necessary or expedient to do so in the interest of the sovereignty or integrity of India, defence of India, security of the state, friendly relations with foreign states, public order, for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence. Therefore, any order of decryption will satisfy the legitimate aim test if it is in pursuance of the objectives listed under this provision. Given that there is no rule or statute laying down when and how the government can set out restrictions on encryption standards, it is unclear if banning encryption or prescribing unreasonably low standards of encryption, which can potentially jeopardise network security entirely, is likely to achieve even the general legitimate aim of national security.

Proportionality: A complete restriction on encryption or setting out unreasonably low encryption standards will not pass the necessity test because while it ensures access to communication by LEAs during emergency situations, it also makes the entire communication network vulnerable to attacks at all times and will not qualify as the least restrictive measure. Further, measures such as asking users to maintain a plain text copy of all encrypted material for 90 days would also vitiate the very purpose of encryption leading to the same issues as banning encryption and therefore not satisfy the necessity test under proportionality analysis.

In relation to the framework for decryption on demand, ordering decryption of a particular computer resource or resources based on evidence of suspicion, as was done in the Apple-FBI matter, qualifies as targeted interception and may be the least retrictive way of achieving a legitimate aim. However, requiring private companies to create backdoors within all systems to enable decryption when necessary, renders computer resources of several unsuspecting individuals vulnerable to interception by governments and hackers alike. Therefore, ordering private companies to create backdoors within all systems is not the least restrictive way of achieving a legitimate aim and does not satisfy the proportionality standard. Further, it is advisable for governments to build in-house capacity for decryption in order to provide LEAs with targeted access to encrypted systems during an emergent situation, rather than waiting for technological assistance from companies during such times or requiring them to weaken all systems by creating backdoors.

Procedural safeguards: The 2009 rules set out certain procedural safeguards and review mechanisms that are similar to the procedural framework under Rule 419A of the Telegraph Act. Therefore, the procedural inadequacies identified in the context of lawful interception framework under the Telegraph Act are applicable to the framework for decryption on demand as well. Further, given the absence of any legislative or regulatory framework prescribing encryption standards or methods of deploying encryption under Section 84A of the IT Act, no procedural safeguards are currently in place to check against arbitrary encryption restrictions issued by the executive.

Surveillance by non-state actors

Although we have largely focused on the application of the Puttaswamy standard to the state's varied surveillance frameworks, this post would be incomplete without a mention of the rise in private actors such as Facebook and Google, and the prevalence of surveillance capitalism (Zuboff, 2015). In this model, tech companies serve as data harvesting giants that constantly collect, analyse, and share user data, without informed consent, with the aim to alter/shape behaviour and preferences.

As has been discussed previously on this blog (here and here), India lacks a data protection law. Currently, the actions of private actors are only regulated by the IT Act and the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, which have also been acknowledged by the Srikrishna Committee White Paper as lacking "an effective enforcement machinery". In fact, it is these loopholes in the law that were exploited by Facebook and Cambridge Analytica to mine user data without their consent.

Acknowledging the challenges posed by big data to privacy, Chandrachud J. in Puttaswamy emphasised the importance of a data protection regime, that would also regulate the actions of private actors. Similarly, Kaul J. recognised the right of individuals to control the commercial use of their identity and to exclusively commercially exploit their identity and data. However, although the judges referred to the increased data collection and analysis capacity of non-state actors, the judgment in Puttaswamy did not grapple with the problems posed by commercial surveillance and private actors. This issue will have to be resolved in the new data protection law that is expected to be enacted after the Srikrishna Committee Report prepares a draft Bill.

Conclusion

The proportionality test, as laid out in Puttaswamy, and the extensive reliance on global privacy and search/surveillance jurisprudence has laid the groundwork for a re-examination of India's surveillance architecture. However, this was just the first step. The Court in Puttaswamy was not directly concerned with a surveillance claim, and thus, did not have to grapple with the application of its proportionality standard to the facts on ground. The Supreme Court has now reserved judgment in the Aadhaar case (Puttaswamy II), where extensive arguments on surveillance and chilling effect were made in the context of the centralised collection and storage of data, and the linking/seeding of various databases with the Aadhaar number. It is thus expected that the Court's judgment will further clarify the standard of proportionality, and its application in surveillance cases. We have to wait and see how the Court will balance these competing concerns of privacy and liberty with national security.

At the same time, we are looking towards the Justice Srikrishna Committee for specific recommendations to the government on how to introduce due process while providing exceptions for national security or other legitimate aims under the proposed data protection law. This will also entail a relook at the lawful interception provisions under existing laws.

References

Addison Litton, The State of Surveillance in India: The Central Monitoring System's Chilling Effect on Self Expression, 14 Wash. U. Global Stud. L. Rev. 799, 2015. The International Principles on the Application of Human Rights to Communications Surveillance ("Necessary & Proportionate Principles), July 2013. Software Freedom Law Centre, "India's Surveillance State: Communication Surveillance in India", 2014. Saikat Datta, Surveillance and Democracy: Chilling tales from around the world, International Network of Civil Liberties Organizations, 2015. Shoshana Zuboff, Big Other: Surveillance Capitalism and the Prospects of an Information Civilisation, 30 J. of Info. Tech. 75, 2015.

 

Vrinda Bhandari is a practicing advocate in Delhi. Smriti Parsheera and Faiza Rahman are researchers at the National Institute of Public Finance & Policy. We thank Saikat Datta for valuable discussions.