---
layout: default
title: "A Comparison of Indian Legislation to Draft International Principles on Surveillance of Communications"
description: "A 31 January 2013 CIS post by Elonnai Hickok comparing Indian surveillance legislation, including the Indian Telegraph Act and Information Technology Act rules, against the Draft International Principles on Surveillance of Communications developed under the SAFEGUARDS project."
authors: ["Elonnai Hickok"]
categories: [Centre for Internet and Society, Elonnai Hickok]
date: 2013-01-31
source: "Centre for Internet and Society"
permalink: /elonnai/comparison-of-indian-legislation-and-draft-principles-on-surveillance-of-communications/
created: 2026-08-18
homepage_featured: true
---

{% include under-construction.html %}

**"A Comparison of Indian Legislation to Draft International Principles on Surveillance of Communications"** is a policy post by [Elonnai Hickok](/elonnai/) published by the [Centre for Internet and Society](/cis/) on 31 January 2013. It compares Indian legislation permitting governmental access to communications against the Draft International Principles on Surveillance of Communications, drafted as part of the SAFEGUARDS project undertaken with Privacy International and IDRC.

## Contents

1. [Article Details](#article-details)
2. [Full Text](#full-text)
3. [Context and Background](#context-and-background)
4. [External Link](#external-link)

## Article Details

<dl class="media-details">
  <dt>📰 Published by:</dt>
  <dd><em>Centre for Internet and Society</em></dd>

  <dt>📅 Date:</dt>
  <dd>31 January 2013</dd>

  <dt>✍️ Author:</dt>
  <dd>Elonnai Hickok</dd>

  <dt>📄 Type:</dt>
  <dd>Blog post</dd>

  <dt>🔗 Original Link:</dt>
  <dd>
    <a href="https://cis-india.org/internet-governance/blog/comparison-of-indian-legislation-and-draft-principles-on-surveillance-of-communications">Read the original post</a>
  </dd>
</dl>

## Full Text

<div class="highlighted-text" id="fulltext">

<p>This blog post is a comparison of the relevant Indian legislations allowing governmental access to communications and the Draft International Principles on Surveillance of Communications. The principles, first drafted in October 2012 and developed subsequently, seek to establish an international standard for surveillance of communications in the context of human rights.</p>

<hr class="article-separator">

<p>This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC.</p>

<p>The Centre for Internet and Society is contributing feedback to the drafting of the principles. The principles are still in draft form and the most recent version along with the preamble to the principles can be accessed at: <a href="https://necessaryandproportionate.net/">http://necessaryandproportionate.net/</a></p>

<h3>The Principles</h3>

<p><strong>1. Principle – Legality:</strong> Any limitation to the right to privacy must be prescribed by law. Neither the Executive nor the Judiciary may adopt or implement a measure that interferes with the right to privacy without a previous act by the Legislature that results from a comprehensive and participatory process. Given the rate of technological change, laws enabling limitations on the right to privacy should be subject to periodic review by means of a participatory legislative or regulatory process.</p>

<p><strong>Indian Legislation:</strong> In India there are two predominant legislations with subsequent Rules and Licenses that allow for access to communications by law enforcement and the government. Though the basic power of interception of communications are prescribed by law, the Rules and Licenses build off of these powers and create procedural requirements, and requirements for assistance.</p>

<ul>
<li>The Indian Telegraph Act, 1885</li>
<li>The Indian Telegraph Amendment Rules 2007: These Rules are grounded in section 419A of the Indian Telegraph Act and establish procedures and safeguards for the interception of communications.</li>
<li>License Agreement for Provision of Unified Access Services After Migration from CMTS (UASL): This license is grounded in the Telegraph Act, and details what types of assistance service providers must provide to law enforcement and the government.</li>
<li>License Agreement for Provision of Internet Services: This license is grounded in the Telegraph Act, and details what types of assistance service providers must provide to law enforcement and the government.</li>
<li>The Information Technology Act, 2000
<ul>
<li>Procedure and Safeguards for Interception, Monitoring, and Decryption of Information Rules 2009: These Rules were notified in 2009 and allow authorized governmental agencies to intercept, monitor, and decrypt information generated, transmitted, received, or stored in any computer resource.</li>
<li>Procedure and safeguard for Monitoring and Collecting Traffic Data or Information Rules 2009: These Rules were notified in 2009 and allow authorized agencies to monitor and collect traffic data or information that is generated, transmitted, received or stored in any computer resource.</li>
</ul>
</li>
</ul>

<p><strong>2. Principle – Legitimate Purpose:</strong> Laws should only allow access to communications or communications metadata by authorized public authorities for investigative purposes and in pursuit of a legitimate purpose, consistent with a free and democratic society.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are no specific provisions requiring that access by law enforcement must be for a legitimate purpose and consistent with a free and democratic society. Instead, Indian legislation defines and lays out specific circumstances for which access would be allowed.</p>

<p>Below are the circumstances for which access is allowed by each Act, Rule, and License:</p>

<ul>
<li>The TA Rules 2007: Interception is allowed in the following circumstances:
<ul>
<li>On the occurrence of any public emergency</li>
<li>In the interest of the public safety</li>
<li>In the interests of the sovereignty and integrity of India</li>
<li>The security of the state</li>
<li>Friendly relations with foreign states</li>
<li>Public order</li>
<li>Preventing incitement to the commission of an offence</li>
</ul>
</li>
<li>ITA Interception and Monitoring Rules: Interception, monitoring, and decryption of communications is allowed in the following circumstances:
<ul>
<li>In the interest of the sovereignty or integrity of India,</li>
<li>Defense of India</li>
<li>Security of the state</li>
<li>Friendly relations with foreign states</li>
<li>Public order</li>
<li>Preventing incitement to the commission of any cognizable offence relating to the above</li>
<li>For investigation of any offence</li>
</ul>
</li>
<li>ITA Monitoring of Traffic Data Rules: Monitoring of traffic data and collection of information is allowed for the following purposes related to cyber security:
<ul>
<li>Forecasting of imminent cyber incidents</li>
<li>Monitoring network application with traffic data or information on computer resources</li>
<li>Identification and determination of viruses or computer contaminant</li>
<li>Tracking cyber security breaches or cyber security incidents</li>
<li>Tracking computer resource breaching cyber security or spreading virus's or computer contaminants</li>
<li>Identifying or tracking of any person who has breached, or is suspected of having breached or being likely to breach cyber security.</li>
<li>Undertaking forensic of the concerned computer resource as a part of investigation or internal audit of information security practices in the computer resource.</li>
<li>Accessing stored information for enforcement of any provisions of the laws relating to cyber security for the time being in force.</li>
<li>Any other matter relating to cyber security.</li>
</ul>
</li>
<li>UASL License: Assistance must be provided to the government for the following reasons and times:
<ul>
<li>Reasons defined in the Telegraph Act. (Section 41.20 (xix))</li>
<li>National Security. (Section 41.20 (xvii))</li>
<li>To counteract espionage, subversive act, sabotage, or any other unlawful activity. (Section 41.1)</li>
<li>Trace nuisance, obnoxious or malicious calls, messages or communications transported through his/her equipment. (Section 40.4)</li>
<li>In the interests of security. (Section 41.7)</li>
<li>For security reasons. (Section 41.20 (iii))</li>
</ul>
</li>
<li>ISP License: Assistance must be provided to the government for the following reasons and times:
<ul>
<li>To counteract espionage, subversive act, sabotage, or any other unlawful activity. (Section 34.1)</li>
<li>In the interests of security. (Section 34.4)</li>
<li>For security reasons. (Section 34.28 (iii))</li>
<li>Reasons defined in the Telegraph Act. (Section 35.2)</li>
</ul>
</li>
</ul>

<p><strong>3. Principle – Necessity:</strong> Laws allowing access to communications or communications metadata by authorized public authorities should limit such access to that which is strictly and demonstrably necessary, in the sense that an overwhelmingly positive justification exists, and justifiable in a democratic society in order for the authority to pursue its legitimate purposes, and which the authority would otherwise be unable to pursue. The onus of establishing this justification, in judicial as well as in legislative processes, is on the government.</p>

<p><strong>Indian Legislation:</strong> Relevant Indian legislation do not contain provisions mandating that access to communications must be demonstrably necessary, and do not give details of the criteria that authorizing authorities should use to determine if a request is a valid or not. Relevant Indian legislation does require that all directions contain reasons for the direction. Additionally, excluding the ITA Procedure and safeguard for Monitoring and Collecting Traffic Data or Information Rules, relevant Indian legislation requires that all other means for acquiring the information must be taken into consideration before a direction for access can be granted.</p>

<p>Below are summaries of the relevant provisions:</p>

<ul>
<li>TA Rules 2007: Any order for interception issued by the competent authority must contain reasons for the direction (Section 2). While issuing orders for direction, all other means for acquiring the information must be taken into consideration, and directions can only be issued if it is not possible to acquire the information by any other reasonable means (Section 3).</li>
<li>ITA Interception and Monitoring Rules: Any direction issued by the competent authority must contain reasons for such direction (Section 7). The competent authority must consider the possibility of acquiring the necessary information by other means and the direction can be issued only when it is not possible to acquire the information any other reasonable means (Section 8).</li>
<li>ITA Traffic Monitoring Rules: Any direction issued by the competent authority must contain reasons for the direction (Section 3(3)).</li>
<li>UASL & ISP License: As laid out in the Telegraph Act and subsequent Rules.</li>
</ul>

<p><strong>4. Principle – Adequacy:</strong> Public authorities should restrain themselves from adopting or implementing any measure of intrusion allowing access to communications or communications metadata that is not appropriate for fulfillment of the legitimate purpose that justified establishing that measure.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are provisions that require direction for access to be specific, but there are no provisions that specifically prohibit government agencies from collecting and accessing information that is not appropriate for fulfillment of the stated purpose of the direction.</p>

<p><strong>5. Principle – Competent Authority:</strong> Authorities capable of making determinations relating to communications or communications metadata must be competent and must act with independence and have adequate resources in exercising the functions assigned to them.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation it is required that directions for access to be authorized by "competent authorities". The most common authority for authorizing orders for access is the Secretary to the Government of India in the Ministry of Home Affairs, but authorization can also come from other officials depending on the circumstance. The fact that authorization for access to communications content is not from a judge has been a contested topic, as in many countries a judicial order is the minimum requirement for access to communication content. It is unclear from the legislation if adequate resources are assigned to the competent authorities.</p>

<p>Below are summaries of relevant provisions:</p>

<ul>
<li>The TA Rules 2007: Under the Telegraph Act the authorizing authorities are:
<ul>
<li>The Secretary to the Government of India in the Ministry of Home Affairs at the Central Level</li>
<li>The Secretary to the State Government in charge of the Home Department in the case of the State Government.</li>
<li>In unavoidable circumstances an order for interception may only be made by an officer not below the rank of a Joint Secretary to the Government of India who has been authorized by the Union Home Secretary or the State Secretary.</li>
<li>In remote areas or for operational reasons where obtaining prior directions for interception is not feasible the head or the second senior most officer of the authorized security agency at the Central level and the officers authorized in this behalf and not below the rank of Inspector of General Police. (Section 1(2)).</li>
</ul>
</li>
<li>ITA Interception and Monitoring Rules: Under the ITA Rules related to the interception, monitoring, and decryption of communications, the competent authorities for authorizing directions are:
<ul>
<li>The Secretary in the Ministry of Home Affairs in case of the Central Government.</li>
<li>The Secretary in charge of the Home Department, in case of a State Government or Union Territory.</li>
<li>In unavoidable circumstances any officer not below the rank of the Joint Secretary to the Government of India who has been authorized by the competent authority.</li>
<li>In remote areas or for operational reasons where obtaining prior directions is not feasible, the head or the second senior most officer of the security and law enforcement agency at the Central level or the officer authorized and not below the rank of the inspector General of Police or an officer of equivalent rank at the State or Union territory level. (Section 3).</li>
</ul>
</li>
<li>ITA Monitoring and Collecting Traffic Data Rules: Under the ITA Rules related to the monitoring and collecting of traffic data, the competent authorities who can issue and authorize directions are:
<ul>
<li>The Secretary to the Government of Indian in the Department of Information Technology under the Ministry of Communications and Information Technology. (Section 2(d)).</li>
<li>An employee of an intermediary may complete the following if it is in relation to the services that he is providing including: accessing stored information from computer resource for the purpose of implementing information security practices in the computer resource, determining any security breaches, computer contaminant or computer virus, undertaking forensic of the concerned computer resource as a part of investigation or internal audit. Accessing or analyzing information from a computer resource for the purpose of tracing a computer resource or any person who has contravened or is suspected of having contravened or being likely to contravene any provisions of the Act that is likely to have an adverse impact on the services provided by the intermediary. (Section 9 (2)).</li>
</ul>
</li>
<li>UASL & ISP License: As laid out in the Telegraph Act and subsequent Rules.</li>
</ul>

<p><strong>6. Principle – Proportionality:</strong> Public authorities should only order the preservation and access to specifically identified, targeted communications or communications metadata on a case-by-case basis, under a specified legal basis. Competent authorities must ensure that all formal requirements are fulfilled and must determine the validity of each specific attempt to access or receive communications or communications metadata, and that each attempt is proportionate in relation to the specific purposes of the case at hand. Communications and communications metadata are inherently sensitive and their acquisition should be regarded as highly intrusive. As such, requests should at a minimum establish a) that there is a very high degree of probability that a serious crime has been or will be committed; b) and that evidence of such a crime would be found by accessing the communications or communications metadata sought; c) other less invasive investigative techniques have been exhausted; and d) that a plan to ensure that the information collected will be only that information reasonably related to the crime and that any excess information collected will be promptly destroyed or returned. Neither the scope of information types, the number or type of persons whose information is sought, the amount of data sought, the retention of that data held by the authorities, nor the level of secrecy afforded to the request should go beyond what is demonstrably necessary to achieve a specific investigation.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are no comprehensive provisions that ensure proportionality of the surveillance of communications but there are provisions that contribute to ensuring proportionality. These include provisions requiring: time frames for how long law enforcement can retain accessed and collected material, directions to be issued only after there are no other means for acquiring the information, requests to contain reasons for the order, the duration for which an order can remain in force to be limited, and requests to be for specified purpose based on a particular set of premises. All of these provisions are found in the Telegraph Rules issued in 2007 and the ITA Procedures and Safeguards for Interception, Monitoring, and Decryption of Information Rules. None of these requirements are found in the UASL or ISP licenses, and many are missing from the ITA Safeguards for Monitoring and Collecting Traffic Data or Information Rules.</p>

<p>Though the above are steps to ensuring proportionality, Indian legislation does not provide details of how the proportionality of requests would be measured as recommended by the principle. For example, it is not required that requests for access demonstrate that evidence of the crime would be found by accessing the communications or communications metadata sought, and that information only related directly to the crime will be collected. Furthermore, Indian legislation does not place restrictions on the amount of data sought, nor the level of secrecy afforded to the request.</p>

<p>Below is a summary of the relevant provisions:</p>

<ul>
<li>TA Rules 2007:
<ul>
<li>Service providers shall destroy record pertaining to directions for interception of message within two months of discontinuing the interception. (Section 19).</li>
<li>Directions for interception should only be issued only when it is not possible to acquire the information by any other reasonable means. (Section 3).</li>
<li>The interception must be of a message or class of message from and too one particular person that is specified or described in the order or one particular set of premises specified or described in the order. (Section 4).</li>
<li>The direction for interception will remain in force for a period of 60 days, or 180 days if the directions are renewed. (Section 6).</li>
</ul>
</li>
<li>ITA Interception and Monitoring Rules:
<ul>
<li>Any direction issued by the competent authority must contain reasons for such direction. (Section 7).</li>
<li>The competent authority must consider all other possibilities of acquiring the information by other means, and the direction can only be issued when it is not possible to acquire the information by any other reasonable means. (Section 8).</li>
<li>The direction of interception, monitoring, or decryption of any information generated, transmitted, received, or stored in any computer resource etc., as may be specified or described in the direction. (Section 9).</li>
<li>The directions for interception, monitoring, or decryption will remain in force for a period of 60 days, or 180 days if the directions are renewed. (Section 10).</li>
</ul>
</li>
<li>ITA Traffic and Monitoring Rules:
<ul>
<li>Any direction issued by the competent authority must contain reasons for such direction. (Section 3(3)).</li>
<li>Every record including electronic records pertaining to such directions for monitoring or collection of traffic data shall be destroyed after the expiry of nine months by the designated officer. Except when the information is needed for an ongoing investigation, the person in charge of a computer resource shall destroy records within a period of six months of discontinuing the monitoring. (Section 8).</li>
</ul>
</li>
</ul>

<p><strong>7. Principle – Due process:</strong> Due process requires that governments must respect and guarantee an individual's human rights, that any interference with such rights must be authorized in law, and that the lawful procedure that governs how the government can interfere with those rights is properly enumerated and available to the general public.<sup id="ref-9"><a href="#note-9">9</a></sup> While criminal investigations and other considerations of public security and safety may warrant limited access to information by public authorities, the granting of such access must be subject to guarantees of procedural fairness. Every request for access should be subject to prior authorization by a competent authority, except when there is imminent risk of danger to human life.<sup id="ref-10"><a href="#note-10">10</a></sup></p>

<p><strong>Indian Legislation:</strong> In the relevant Indian legislation the only guarantee for due process is that every request for access must be subject to prior authorization by a competent authority.</p>

<ul>
<li>TA Rules 2007:
<ul>
<li>All orders for interception must be issued by the Secretary to the Government of India in the Ministry of Home Affairs.</li>
</ul>
</li>
<li>ITA Interception and Monitoring Rules:
<ul>
<li>All orders for interception must be issued by the Secretary to the Government of India in the Ministry of Home Affairs.</li>
</ul>
</li>
<li>ITA Monitoring of Traffic Rules:
<ul>
<li>The Secretary to the Government of India in the Department of Information Technology under the Ministry of Communications and Information Technology is the competent authority for authorizing orders.</li>
</ul>
</li>
</ul>

<p><strong>8. Principle – User notification:</strong> Notwithstanding the notification and transparency requirements that governments should bear, service providers should notify a user that a public authority has requested his or her communications or communications metadata with enough time and information about the request so that a user may challenge the request. In specific cases where the public authority wishes to delay the notification of the affected user or in an emergency situation where sufficient time may not be reasonable, the authority should be obliged to demonstrate that such notification would jeopardize the course of investigation to the competent judicial authority reviewing the request. In such cases, it is the responsibility of the public authority to notify the individual affected and the service provider as soon as the risk is lifted or after the conclusion of the investigation, whichever is sooner.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are no provisions that require the government or service providers to notify the user that a public authority has requested his or her communication data.</p>

<p><strong>9. Principle – Transparency about use of government surveillance:</strong> The access capabilities of public authorities and the process for access should be prescribed by law and should be transparent to the public. The government and service providers should provide the maximum possible transparency about the access by public authorities without imperiling ongoing investigations and with enough information so that individuals have sufficient knowledge to fully comprehend the scope and nature of the law, and when relevant, challenge it. Service providers must also publish the procedure they apply to deal with data requests from public authorities.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are no requirements that access capabilities of the government and the process for access must be transparent to the public. Nor are service providers required to publish the procedure applied to handle data requests from public authorities.</p>

<p><strong>10. Principle – Oversight:</strong> An independent oversight mechanism should be established to ensure transparency of lawful access requests. This mechanism should have the authority to access information about public authorities' actions, including, where appropriate, access to secret or classified information, to assess whether public authorities are making legitimate use of their lawful capabilities, and to publish regular reports and data relevant to lawful access. This is in addition to any oversight already provided through another branch of government such as parliament or a judicial authority. This mechanism must provide – at minimum – aggregate information on the number of requests, the number of requests that were rejected, and a specification of the number of requests per service provider and per type of crime.<sup id="ref-11"><a href="#note-11">11</a></sup></p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are requirements for a review committee to be established. The review committee must meet on a bi-monthly basis and review directions to ensure that they are in accordance with the prescribed law. Currently, it is unclear from the legislation if the review committees have the authority to access information about public authorities' actions, and currently the review committee does not publish aggregate information about the number of requests, the number of requests that were rejected, and a specification of the number of requests per service provider and per type of crime. These standards are recommended by the principle.</p>

<p>The relevant provisions are summarized below:</p>

<ul>
<li>TA Rules 2007:
<ul>
<li>A review committee will be constituted by a state government that consists of a chief secretary, secretary of law, secretary to the state government. The review committee shall meet at least once in two months. If the committee finds that directions are not in accordance with the mandated provisions, then the committee can order the destruction of the directions. (Section 17). Any order issued by the competent authority must contain reasons for such directions and a copy be forwarded to the concerned review committee within a period of seven working days. (Section 2).</li>
</ul>
</li>
<li>ITA Interception and Monitoring Rules:
<ul>
<li>Any direction issued by the competent authority must be forwarded to the review committee within a period of seven working days from issuing. The review committee is the same as constituted under rule 419A of the Indian Telegraph Rules, 1951. The review committee must meet bi-monthly and determine whether directions are in accordance with the ITA Act. If the review committee finds that the directions are not in accordance with the Act, it may issue an order for the destruction of the copies of accessed information and set aside the directions. (Section 22).</li>
</ul>
</li>
<li>ITA Traffic Monitoring Rules:
<ul>
<li>Any direction issued by the competent authority must be forwarded to the review committee within a period of seven working days from issuing. The review committee is the same as constituted under rule 419A of the Indian Telegraph Rules, 1951. The review committee must meet bi-monthly and determine whether directions are in accordance with the ITA Act. If the review committee finds that the directions are not in accordance with the Act, it may issue an order for the destruction of the copies of accessed information and set aside the directions. (Section 7).</li>
</ul>
</li>
</ul>

<p><strong>11. Principles – Integrity of communications and systems:</strong> It is the responsibility of service providers to transmit and store communications and communications metadata securely and to a degree that is minimally necessary for operation. It is essential that new communications technologies incorporate security and privacy in the design phases. In order, in part, to ensure the integrity of the service providers' systems, and in recognition of the fact that compromising security for government purposes almost always compromises security more generally, governments shall not compel service providers to build surveillance or monitoring capability into their systems. Nor shall governments require that these systems be designed to collect or retain particular information purely for law enforcement or surveillance purposes. Moreover, a priori data retention or collection should never be required of service providers and orders for communications and communications metadata preservation must be decided on a case-by-case basis. Finally, present capabilities should be subject to audit by an independent public oversight body.</p>

<p><strong>Indian Legislation:</strong> In relevant Indian legislation there are a number of security measures that must be put in place but these are predominantly actions that must be taken by service providers, and do not pertain to intelligence agencies. Furthermore, many provisions found in the ITA Procedure and Safeguards for Interception, Monitoring, and Decryption of Information Rules, and the ISP and UASL licenses include requirements for service providers to provide monitoring facilities and technical assistance, require information to be retained specifically for law enforcement purposes, and require service providers to comply with a-priori data retention mandates. In the ISP and UASL license, service providers are audited and inspected to ensure compliance with requirements listed in the license, but it unclear from the legislation if the access capabilities of government or governmental agencies are audited by an independent public oversight body. This standard is recommended by the principle.</p>

<p>Relevant provisions are summarized below:</p>

<ul>
<li>TA Rules 2007: The service provider must put in place internal checks to ensure that unauthorized interception of messages does not take place. (Section 14) Service providers are also responsible for actions of their employees. In the case of unauthorized interception or a breach in security, service providers can be held liable for up to three years in prison, fines, and revocation of the service providers licenses depending on the nature and scale of the violation. (Section 20, 20A 21, 23).</li>
<li>ITA Interception and Monitoring Rules: The intermediary or person in charge of the computer resources must put in place adequate and effective internal checks to ensure that unauthorized interception of communications does not take place and extreme secrecy is maintained and utmost care and precaution taken in the matter of interception or monitoring or decryption of information as it affects privacy of citizens and also that it is handled only by the designated officers of the intermediary. (Section 20).</li>
<li>ITA Traffic Monitoring Rules: The intermediary or person in charge of the computer resources must put in place adequate and effective internal checks to ensure that unauthorized interception of communications does not take place and extreme secrecy is maintained and utmost care and precaution taken in the matter of interception or monitoring or decryption of information as it affects privacy of citizens and also that it is handled only by the designated officers of the intermediary. (Section 5&6).</li>
<li>UASL License: The intermediary or service provider is responsible for ensuring the protection of privacy of communication and to ensure that unauthorized interception of messages does not take place. (Section 39.1, Section 39.2, Section 41.4).</li>
<li>ISP License: The ISP has the responsibility of ensuring that unauthorized interception of messages does not take place. (Section 32.1) The ISP must take all necessary steps to safeguard the privacy and confidentiality of an information about a third party and its business and will do its best endeavor to ensure that no information, except what is necessary is divulged, and no employee of the ISP seeks information other than is necessary for the purpose of providing service to the third party. (Section 32.2) The ISP must also take necessary steps to ensure that any person acting on its behalf observe confidentiality of customer information. (Section 32.3).</li>
</ul>

<p>Provisions requiring the provision of facilities, assistance, and retention:</p>

<ul>
<li>ITA Interception and Monitoring Rules:
<ul>
<li>The intermediary must provide all facilities, co-operation for interception, monitoring, and decryption of information mentioned in the direction (Section 13(2)).</li>
<li>If a decryption direction or copy is handed to the decryption key holder to whom the decryption direction is addressed by the nodal officer, the decryption key holder must disclose the decryption key or provide the decryption assistance. (Section 17).</li>
</ul>
</li>
<li>ITA Monitoring of Traffic Rules:
<ul>
<li>The intermediary must extend all facilities, co-operation and assistance in installation, removal and testing of equipment and also enable online access to the computer resource for monitoring and collecting traffic data or information. (Section 4(7)).</li>
</ul>
</li>
<li>UASL License:
<ul>
<li>The service provider cannot employ bulk encryption equipment in its network, and any encryption equipment connected to the licensee's network for specific requirements must have prior evaluation an approval of the licensor. (Section 39.1).</li>
<li>The service provider must provide all tracing facilities to trace nuisance, obnoxious or malicious calls, messages or communications transported through the equipment and network to authorized officers of the government for purposes of national security. (Section 40.4).</li>
<li>Suitable monitoring equipment as may be prescribed for each type of system used will be provided by the service provider for monitoring as and when required by the licensor. (Section 41.7).</li>
<li>The designated person of the Central/State Government as conveyed to the Licensor from time to time in addition to the licensor or its nominee shall have the right to monitor the telecommunication traffic in every MSC/Exchange/MGC/MG. The service provider must make arrangements for the monitoring of simultaneous calls by Government security agencies. In case the security agencies intend to locate the equipment at the service provider's premises for facilitating monitoring, the service provider should extend all support in this regard including space and entry of the authorized security personnel. The interface requirements as well as features and facilities as defined by the licensor should be implemented by the service provider for both data and speech. Presently, the service provider should ensure suitable redundancy in the complete chain of monitoring equipment for trouble free operations of monitoring of at least 210 simultaneous calls for seven security agencies. (Section 41.10).</li>
<li>The service provider must also make the following records available: called/calling party mobile/PSTN numbers, Time/date and duration of interception, location of target subscribers, telephone numbers if any call-forwarding feature has been invoked by the target subscriber, data records for even failed attempts, and call data record of roaming subscribers. (Section 41.10).</li>
<li>The service provider shall provide the facility to carry out surveillance of Mobile Terminal activity within a specified area. (Section 41.11).</li>
<li>The complete list of subscribers must be made available by the service provider on their website to authorized intelligence agencies. This list must be updated on a regular basis. Hard copies of the list must also be made available to security agencies when requested. (Section 41.14). The database of subscribers must also be made available to the licensor or its representatives. (Section 41.16).</li>
<li>The service provider must maintain all commercial records with regard to the communications exchanged on the network. All records must be archived for at least one year. (Section 41.17).</li>
<li>Calling Line Identification must be provided and the network should also support Malicious Call Identification. (Section 41.18).</li>
<li>Information about bulk connections must be forwarded to the VTM Cell of DoT, DDG (Security) DoT, and any other officer authorized by the Licensor from time to time as well as Security Agencies on a monthly basis (Section 41.19).</li>
<li>Subscribers having CLIR should be listed in a password protected website with their complete address and details so that authorized Government agencies can view or download for detection and investigation of misuse. (Section 41.19(iv)).</li>
<li>The service provider must provide traceable identities of their subscribers. If the subscriber is roaming from another foreign company, the Indian Company must try to obtain traceable identities from the foreign company as part of its roaming agreement. (41.20 (ix)).</li>
<li>On request by the licensor or any other agency authorized by the licensor, the licensee must be able to provide the geographical location (BTS location) of any subscriber at any point of time. (41.20 (x))</li>
<li>Suitable technical devices should be made available at the Indian end to designated security agency/licensor in which a mirror image of the remote access information is available on line for monitoring purposes. (41.20 (xiv)).</li>
<li>A complete audit trail of the remote access activities pertaining to the network operated in India should be maintained for a period of six months and provided on request to the licensor. (Section 41.20 (xv)).</li>
<li>For monitoring traffic, the service provider should provide access of their network and other facilities as well as to books of accounts to the security agencies. (Section 41.20 (xx)).</li>
</ul>
</li>
<li>ISP License:
<ul>
<li>The ISP must ensure that Bulk Encryption is not deployed by ISPs. Individuals/groups/organizations can use encryption up to 40 bit key length without obtaining permission from the licensor. If encryption equipments higher than this limit are deployed, individuals/groups/organizations must obtain prior written permission from the licensor and deposit the decryption key. (Section 2.2(vii)).</li>
<li>The ISP must furnish to the licensor/TRAI on demand documents, accounts, estimates, returns, reports, or other information. (Section 9.1).</li>
<li>The ISP will provide tracing facilities to trace nuisance, obnoxious or malicious calls, messages or communications transported through his equipment and network when such information is necessary for investigations or detection of crimes and in the interest of national security. (Section 33.4).</li>
<li>The ISP will provide the necessary facilities for continuous monitoring of the system, as required by the licensor or its authorized representatives. (Section 30.1).</li>
<li>The ISP shall provide necessary facilities depending upon the specific situation at the relevant time to the Government to counteract espionage, subversive acts, sabotage or any other unlawful activity. (Section 34.1).</li>
<li>In the interests of security, suitable monitoring equipment as may be prescribed for each type of system used, which will be provided by the licensee. (Section 34.4).</li>
<li>The designated person of the Central/State Government or its nominee will have the right to monitor the telecommunication traffic. The ISP will make arrangements for monitoring simultaneous calls by Government security agencies. (Section 34.6).</li>
<li>The ISP must install infrastructure in the service area with respect to: Internet telephony services offered by the ISP for processing, routing, directing, managing, authenticating the internet telephony calls including the generation of Call Details Record (CDR), called IP address, called numbers, date, duration, time and charges of internet telephony calls. (Section 34.7).</li>
<li>ISPs must maintain a log of all users connected and the service that they are using (mail, telnet, http etc.). The ISPs must log every outward login or telnet through their computers. These logs as well as copies of all the packets originating from the Customer Premises Equipment of the ISP must be made available in real time to the Telecom Authority. (Section 34.8).</li>
<li>The ISP should provide the facility to carry out surveillance of Mobile Terminal activity within a specified area. (Section 34.9).</li>
<li>The complete list of subscribers must be made available by the ISP on their website so that intelligence agencies can obtain the subscriber list at any time. (Section 34.12).</li>
<li>The list of Internet leased line customers and sub-costumers must be placed on a password protected website with the following information: Name of customer, IP address allotted, bandwidth provided, address of installation, date of installation, contact person with phone number and email. This information should be accessible to authorized Government agencies. (Section 34.13).</li>
<li>Monitoring of high UDP traffic value and to check for cases where upstream UDP traffic is similar to downstream UDP traffic and monitor such customer monthly with physical verification and personal identity. (Section 34.15).</li>
<li>The licensor will have access to the database relating to the subscribers of the ISP. The ISP must make available at any instant the details of the subscribers using the service. (Section 34.22).</li>
<li>The ISP must maintain all commercial records with regard to the communications exchanged on the network for at least one year and will be destroyed unless directed otherwise. (Section 34.23).</li>
<li>Every international gateway with a route/switch having a capacity of 2Mbps must be equipped with a monitoring Centre at the cost of the ISP. The cost of meeting the requirements of the security agencies, the cost of maintenance of the monitoring equipment and infrastructure must be borne by the ISP. (Section 34.27 (a(i)).</li>
<li>Office space of 10 by 10 feet with adequate power supply and air-conditioning must be provided by the ISP free of cost. (Section 34.27 (a(ii)) One local exclusive telephone must be made available by the ISP at the monitoring centre at the cost of the ISP. (Section 34.27 (a(iii)).</li>
<li>Each route/switch of the ISP should be connected by the LAN operating at the same speed as the router/switch; the monitoring equipment will be connected to this network. (Section 34.27 (a(v)).</li>
<li>The ISP must provide traceable identity of their subscribers. In the case of roaming subscribers the ISP must try to obtain the traceable identity of roaming subscribers from the foreign company. (Section 34.27 (ix)).</li>
<li>On request of the licensor or any other authorized agency, the ISP must be able to provide the geographical location of any subscriber (BTS location of wireless subscriber) at a given point of time. (Section 34.27 (x)).</li>
<li>Suitable technical devices should be made available to designated security agencies in which a mirror image of the remote access information is available on line for monitoring purposes. (Section 34.27 (xiv)).</li>
<li>A complete audit trail of the remote access activities pertaining to the network operated in India should be maintained for a period of six months and provided on request. (Section 34.27 (xv)).</li>
<li>ISPs must provide access of their network and other facilities, as well as books to security agencies. (Section 34.27 (xx)).</li>
</ul>
</li>
</ul>

<p><strong>12. Principle – Safeguards for international cooperation:</strong> In response to changes in the flows of information and the technologies and services that are now used to communicate, governments may have to work across borders to fight crime. Mutual legal assistance treaties (MLATs) should ensure that, where the laws of more than one state could apply to communications and communications metadata, the higher/highest of the available standards should be applied to the data. Mutual legal assistance processes and how they are used should also be clearly documented and open to the public. The processes should distinguish between when law enforcement agencies can collaborate for purposes of intelligence as opposed to sharing actual evidence. Moreover, governments cannot use international cooperation as a means to surveil people in ways that would be unlawful under their own laws. States must verify that the data collected or supplied, and the mode of analysis under MLAT, is in fact limited to what is permitted. In the absence of an MLAT, service providers should not respond to requests of the government of a particular country requesting information of users if the requests do not include the same safeguards as providers would require from domestic authorities, and the safeguards do not match these principles.</p>

<p><strong>Indian Legislation:</strong> India currently has signed 32 MLAT treaties with other countries, each with its own provisions and conditions relating to access to information. The provisions of the Information Technology Act 2000 apply to any contravention of the Act that is committed outside of India, thus the Rules related to interception, monitoring, decryption etc. would apply to any contravention of the Act outside of India. The provisions of the Indian Telegraph Act only apply to communications within India, but the licenses do specify when information held by service providers cannot be transferred across borders.</p>

<p>Below is a summary of the relevant provisions:</p>

<ul>
<li>ITA 2000: The Act will extend to the whole of India, and applies to any offence or contravention committed outside India by any person. (Section 1(2))</li>
<li>UASL License: The service provider cannot transfer any accounting information relating to the subscriber or user information to any person or place outside of India (this does not restrict a statutorily required disclosure of financial nature. (section (41.20 (viii))</li>
<li>ISP License: For security reasons, domestic traffic of such entities as identified by the licensor will not be hauled or route to any place outside of India. (Section 34.28 (iii)) ISPs shall also not transfer accounting information relating to the subscriber or user information to any person or place outside of India (this does not restrict a statutorily required disclosure of financial nature) (Section 34.28 (viii))</li>
</ul>

<p><strong>13. Principle – Safeguards against illegitimate access:</strong> To protect individuals against unwarranted attempts to access communications and communications metadata, governments should ensure that those authorities and organizations who initiate, or are complicit in, unnecessary, disproportionate or extra-legal interception or access are subject to sufficient and significant dissuasive penalties, including protection and rewards for whistleblowers, and that individuals affected by such activities are able to access avenues for redress. Any information obtained in a manner that is inconsistent with these principles is inadmissible as evidence in any proceeding, as is any evidence derivative of such information.</p>

<p><strong>Indian Legislation:</strong> Though relevant Indian legislation does provide penalty for unauthorized interception or access, the penalty applies only to service providers, and does not hold governmental agencies responsible. Currently there are no avenues of redress for the individual, and there are no protections or rewards for whistleblowers. Both of these safeguards are recommended by the principle.</p>

<p>The relevant provisions are summarized below:</p>

<ul>
<li>TA Rules 2007: The Telegraph Act: The service provider must put in place internal checks to ensure that unauthorized interception of messages does not take place. (Section 14) Service providers are also responsible for actions of their employees. In the case of unauthorized interception or a breach in security on the part of the service provider, service providers can be held liable with penalty of imprisonment from 1 to 3 years and or a fine of rs.500–1000 depending on the exact violation. (Section 20, 20A, 23, and 24 Indian Telegraph Act).</li>
<li>ITA Interception and Monitoring Rules: The intermediary must be responsible for the actions of their employees and in the case of violation pertaining to the maintenance of secrecy and confidentiality of intercepted material or unauthorized interception, monitoring, or decrypting of information – the intermediary will be held liable under the relevant provisions of the laws in force. (Section 21).</li>
<li>ITA Traffic Monitoring Rules: The intermediary must be responsible for the actions of their employees and in the case of violation pertaining to the maintenance of secrecy and confidentiality of intercepted material or unauthorized interception, monitoring, or decrypting of information – the intermediary will be held liable under the relevant provisions of the laws in force. (Section 6).</li>
<li>UASL License:
<ul>
<li>In order to maintain privacy of voice and data, monitoring must be done in accordance with the 2007 Rules established under the Indian Telegraph Act, 1885. (Section 41.20 (xix)).</li>
<li>Any damage arising from the failure of the service provider to provider tracing assistance to the government for purposes of national security is payable by the service provider. (Section 40.4).</li>
</ul>
</li>
<li>ISP License:
<ul>
<li>In order to maintain the privacy of voice and data, monitoring can only be carried out after authorization by the Union Home Secretary or Home Secretaries of the State/Union Territories. (Section 34.28 (xix)).</li>
<li>The ISP indemnifies the licensor against all actions brought against the licensor for breach of privacy or unauthorized interruption of data transmitted by the subscribers. (Section 8.4).</li>
<li>Any damages that occur from non-compliance on the part of the ISP must be paid by the ISP. (Section 33.4).</li>
</ul>
</li>
</ul>

<p><strong>14. Principle – Cost of surveillance:</strong> The financial cost of providing access to user data should be borne by the public authority undertaking the investigation. Financial constraints place an institutional check on the overuse of orders, but the payments should not exceed the service provider's actual costs for reviewing and responding to orders, as such would provide a perverse financial incentive in opposition to user's rights.</p>

<p><strong>Indian Legislation:</strong> In India, the ISP and the UASL licenses specifically state that the cost of providing facilities must be borne by the service provider. Though the ITA Interception and Monitoring Rules do require intermediaries to provide facilities, it is not clear from the Rules where the burden of the cost will fall. Currently, there are no requirements that the cost of access to user data should be borne by the public authority undertaking the investigation. This standard is recommended by the principle.</p>

<p>Below are summaries of relevant provisions:</p>

<ul>
<li>UASL License:
<ul>
<li>Any damage arising from the failure of the service provider to provider tracing assistance to the government for purposes of national security is payable by the service provider. (Section 40.4).</li>
<li>Suitable monitoring equipment as may be prescribed for each type of system used will be provided by the service provider for monitoring as and when required by the licensor. (Section 41.7).</li>
<li>The hardware and software required for the monitoring of calls must be engineered, provided/installed, and maintained by the service provider at the service providers cost. However the respective Government instrumentality must bear the cost of the user end hardware and leased line circuits from the MSC/Exchange/MGC/MG to the monitoring centers to be located as per their choice in their premises. (Section 41.10).</li>
<li>The service provider must ensure that the necessary provision (hardware/software) is available in their equipment for doing the Lawful Interception and monitoring from a centralized location. (Section 41.20 (xvi)).</li>
</ul>
</li>
<li>ISP License:
<ul>
<li>Any damages that occur from non-compliance on the part of the ISP must be paid by the ISP. (Section 33.4).</li>
<li>The hardware at the ISP end and the software required for monitoring of calls must be engineered, provided/installed, and maintained by the ISP. (Section 34.7).</li>
<li>Every international gateway with a route/switch having a capacity of 2Mbps must be equipped with a monitoring Centre at the cost of the ISP. The cost of meeting the requirements of the security agencies, the cost of maintenance of the monitoring equipment and infrastructure must be borne by the ISP. (Section 34.27 (a(i)).</li>
<li>Office space of 10 by 10 feet with adequate power supply and air-conditioning must be provided by the ISP free of cost. (Section 34.27 (a(ii)) One local exclusive telephone must be made available by the ISP at the monitoring centre at the cost of the ISP. (Section 34.27 (a(iii)).</li>
</ul>
</li>
</ul>


<h3>Footnotes</h3>

<ol class="references-list">
<li id="note-9">
As defined by international and regional conventions referenced in the Draft International Principles on Communications Surveillance and Human Rights.
<a href="#ref-9" aria-label="Return to reference 9">↩</a>
</li>

<li id="note-10">
Where judicial review is waived in such emergency cases, a warrant must be retroactively sought within 24 hours.
<a href="#ref-10" aria-label="Return to reference 10">↩</a>
</li>

<li id="note-11">
One example of such a report is the US Wiretap report, published by the US Court service. Unfortunately this applies only to interception of communications, and not to access to communications metadata. The UK Interception of Communications Commissioner publishes a report that includes some aggregate data but it does not provide sufficient data to scrutinise the types of requests, the extent of each access request, the purpose of the requests, and the scrutiny applied to them.
<a href="#ref-11" aria-label="Return to reference 11">↩</a>
</li>
</ol>

</div>

{% include back-to-top.html %}
## Context and Background

Published on 31 January 2013, this post by Elonnai Hickok applies the Draft International Principles on Communications Surveillance and Human Rights to the Indian legal framework governing access to communications. The comparison examines whether Indian legislation and related rules and licence conditions provided safeguards corresponding to the fourteen principles under consideration at the time.

The analysis covers the Indian Telegraph Act, 1885, the Indian Telegraph Amendment Rules 2007, the Unified Access Services Licence (UASL), and the Internet Services licence, alongside the Information Technology Act, 2000 and its 2009 rules concerning interception, monitoring, decryption, and traffic data. Hickok compares these instruments with principles including legality, legitimate purpose, necessity, adequacy, competent authority, proportionality, due process, user notification, transparency, oversight, system integrity, international cooperation, safeguards against illegitimate access, and the cost of surveillance.

A recurring issue in the comparison is the extent to which Indian law specifies substantive safeguards in addition to establishing powers and procedures for access. The post notes that Indian legislation does not expressly require access to communications to be demonstrably necessary or to satisfy the broader legitimate-purpose standard set out in the draft principles. Some rules do require reasons to be recorded and require other means of obtaining information to be considered before interception is authorised, but the post finds that these requirements do not fully correspond to the proposed necessity principle.

The question of competent authority is another significant point of comparison. Indian rules provide for authorisation by specified executive officials, including the Secretary to the Government of India in the Ministry of Home Affairs in relevant circumstances. The post notes that the absence of judicial authorisation for access to communications content was a contested issue and contrasts the Indian arrangement with the draft principle's emphasis on competent, independent authorities.

The comparison also examines proportionality and procedural safeguards. Certain Indian rules contain limits on the duration of interception, requirements concerning the reasons for orders, and restrictions concerning the information or premises covered by an order. However, the post observes that Indian legislation does not comprehensively require authorities to demonstrate that evidence would be obtained through the requested access, that only information relevant to the investigation would be collected, or that the amount of data and secrecy surrounding a request would remain within demonstrably necessary limits.

User notification and public transparency are identified as further gaps. The post finds no provisions requiring users to be notified that a public authority has requested their communications data, and no general requirements for governments or service providers to publish information about their surveillance capabilities or procedures for handling government requests. Review committees are provided for under relevant rules, but the post notes that they do not publish aggregate information of the kind contemplated by the draft principles.

The article also examines the technical and financial obligations placed on service providers. The UASL and ISP licences require providers to supply various forms of monitoring facilities, technical assistance and subscriber information, maintain certain records, and in some circumstances bear the costs of surveillance infrastructure. The post compares these requirements with the draft principle that governments should not compel providers to build surveillance capabilities into their systems and that the public authority undertaking an investigation should bear the financial cost of providing access to user data.

Finally, the comparison considers safeguards against illegitimate access and international cooperation. While Indian law provides penalties and other obligations concerning unauthorised interception and the conduct of service providers, the post identifies the absence of corresponding statutory avenues of redress for affected individuals and protections or rewards for whistleblowers. It also examines India's mutual legal assistance arrangements and restrictions in the UASL and ISP licences concerning the transfer of certain information outside India.

Taken together, the post provides a point-in-time comparison of Indian surveillance legislation and the draft international principles as they stood in January 2013. Its focus is on identifying where Indian law corresponded with, or differed from, the safeguards proposed in the draft principles.

## External Link

- [A Comparison of Indian Legislation to Draft International Principles on Surveillance of Communications](https://cis-india.org/internet-governance/blog/comparison-of-indian-legislation-and-draft-principles-on-surveillance-of-communications) on CIS website

{% include navbox-elonnai.html %}

<style>
.media-details {
  background: #f9fbfe;
  border: 1px solid #d8e2f0;
  border-radius: 10px;
  padding: 1.2rem 1.4rem;
  max-width: 700px;
  margin: 1.2rem auto;
  font-size: 0.96rem;
  line-height: 1.5;
  color: #333;
  box-shadow: 0 2px 4px rgba(0,0,0,0.04);
}
.media-details dt {
  font-weight: 600;
  color: #1b2a49;
  margin-top: 0.7rem;
}
.media-details dd {
  margin: 0 0 0.3rem 0.3rem;
  color: #555;
}
.highlighted-text {
  background-color: #fffbea;
  border-left: 4px solid #f2ce61;
  padding: 1rem 1.2rem;
  border-radius: 8px;
  line-height: 1.65;
  color: #333;
  box-shadow: 0 1px 3px rgba(0,0,0,0.05);
  margin-bottom: 0.8rem;
}
.highlighted-text p {
  margin-bottom: 1rem;
}
.highlighted-text ul,
.highlighted-text ol {
  margin: 0 0 1rem 1.5rem;
}
.article-separator {
  border: none;
  border-top: 1px solid rgba(0,0,0,0.08);
  margin: 0.75rem 0 1rem 0;
}

.references-list {
  margin: 0 0 1rem 1.5rem;
  word-break: break-word;
}

.references-list li {
  margin-bottom: .8rem;
}

.references-list li:last-child {
  margin-bottom: 0;
}

.references-list a[href^="#ref-"] {
  margin-left: .35rem;
  text-decoration: none;
}
</style>