Telecom Act: Can the Government Intercept Your Calls and Messages?

Telecom Act 2023: Exploring Ambiguities and Privacy Issues

Prema Sridevi: Today with me on this episode of Unbreak the News is Tejasi Panjiar, the Associate Policy Counsel at the Internet Freedom Foundation (IFF). Tejasi has been advocating for digital rights for years. Tejasi, thank you for joining me.

Tejasi Panjiar: Happy to be here.

Prema Sridevi: In December 2023, when most of the opposition MPs were suspended in Parliament, the Lok Sabha passed the Telecommunications Bill 2023. This Bill replaces three archaic laws: the Indian Telegraph Act of 1885, the Indian Wireless Telegraphy Act of 1933, and the Telegraph Wire Act of 1950, bringing all telecom regulations under one Act. You have called the new telecom law outdated and archaic. What exactly do you mean by this?

Tejasi Panjiar: Thank you for the question and for setting the context. It's very important to remember the chaos in Parliament when the bill was passed. We've consistently called it outdated because we've seen two versions of this Bill: the 2022 version and the 2023 version, which finally became an Act of Parliament.

Even if you read the white paper that came before the 2022 Bill, it was a positive step. The intention was to reform the telecom sector. However, the legislation that has now become law does not have provisions to legislate surveillance or internet suspension safeguards. While it gives the government power to intercept communications and suspend the internet, it lacks checks and balances to protect user rights.

Prema Sridevi: You mentioned the need for safeguards. What kind of safeguards are we talking about?

Tejasi Panjiar: We need safeguards that are written into the law, ensuring user-centric rights. This includes checks and balances on the government's power to intercept communications and suspend the internet. Given the instances of internet shutdowns and surveillance, such as the Pegasus scandal and the recent Apple threat notification, it's crucial to bring in these safeguards.

Prema Sridevi: Can you point out specific clauses or sections of the new law that make it outdated?

Tejasi Panjiar: Certainly. For example, Section 20 of the Telecom Act is almost identical to Section 5 of the Indian Telegraph Act. Both deal with surveillance, interception, and suspension of internet communications, retaining colonial provisions without any oversight or accountability. Additionally, Section 43 confers quasi-judicial powers to any officer authorised by the Union government, allowing them to search and seize documents without clear guidelines or qualifications.

Government Holds Power to Set Encryption Standards

Prema Sridevi: What about the encryption standards? How does the new law address this?

Tejasi Panjiar: Section 19(f) gives the government the power to notify encryption standards in the interest of public safety or during public emergencies. This can be prone to misuse, as encryption is a core aspect of any online communication service, such as WhatsApp or Signal. The lack of clarity on whether online communication services are included in the scope of the Bill is concerning.

Prema Sridevi: So, essentially, the government has the power to access our communications on platforms like WhatsApp and Zoom?

Tejasi Panjiar: Exactly. If online communication services are covered under this Act, the government can intercept and access communications on platforms like WhatsApp and Zoom, which raises significant privacy concerns.

Prema Sridevi: You've said that there is a lot of ambiguity around the scope of the provisions. What exactly do you mean when you say there are a lot of grey areas? 

Tejasi Panjiar: Right, so this whole conversation started in 2022 when the Bill expanded the scope of telecommunication services to include online communication services. This led to a lot of backlash and concerns because it meant increased regulatory burden, compliance costs, and a dilution of user safety. It also increased executive surveillance powers.

Prema Sridevi: How does this infringe upon the rights of a common man using mobile phones, Skype, or WhatsApp? How do these new laws impact personal privacy rights or data protection?

Tejasi Panjiar: When you and I message over WhatsApp, it is end-to-end encrypted. This means only you and I know the contents of our messages, not even WhatsApp. If the Telecom Act applies to communication services like WhatsApp, Zoom, Facebook Messenger, or any communication service, the government can extend its surveillance and suspension powers to these platforms. This means the government can check the contents of your messages in the interest of public safety by breaking encryption, giving them a backdoor channel to your previously encrypted chats. They can also suspend services like WhatsApp during internet shutdowns, which we have seen in states like Rajasthan and Kashmir.

Prema Sridevi: Does the new law explicitly state that the government can read our WhatsApp messages or access Zoom and Skype conversations? If so, service providers need to comply with this. What is the update on the compliance from service providers?

Tejasi Panjiar: That's where the ambiguity comes in. The 2022 version clearly expanded the scope to online communication services, but the 2023 version has heavily diluted the definition of telecommunication services. The definitions are vague and open-ended, which leaves the scope wide enough for online communication services to be included in the future. As a digital rights organisation, we are fighting for explicit language in the law to exclude online communication services from these provisions.

Prema Sridevi: The government recently said the new Telecom Act is ready for a partial takeoff. What does a partial takeoff mean, and why not a full takeoff? What provisions will come into effect and how will they impact citizens?

Telecom Act Imposes Duties on Users

Tejasi Panjiar: The government has still not explained their rationale for a partial notification, which is usually based on factors like easing compliance burden for entities and the government's readiness to roll out the Act. Some sections coming into effect include the definition clause, which is a big one, and the introduction of duties on users. This is something new; for instance, users now have a duty to not furnish false information when establishing their identity to avail telecommunication services. Failure to comply can result in penalties, which has serious implications for user anonymity.

Prema Sridevi: Clause 29 is particularly problematic for journalists and whistleblowers too.

Tejasi Panjiar: Yes, clause 29 is particularly concerning. It imposes duties on users, including not furnishing false information, which can undermine anonymity and have damaging consequences for journalists and whistleblowers who rely on anonymity for their work.

Prema Sridevi: What legal recourse do journalists and whistleblowers have to counter these provisions?

Tej

Telecom Act 2023: Exploring Ambiguities and Privacy Issues

Prema Sridevi: Today with me on this episode of Unbreak the News is Tejasi Panjiar, the Associate Policy Counsel at the Internet Freedom Foundation (IFF). Tejasi has been advocating for digital rights for years. Tejasi, thank you for joining me.

Tejasi Panjiar: Happy to be here.

Prema Sridevi: In December 2023, when most of the opposition MPs were suspended in Parliament, the Lok Sabha passed the Telecommunications Bill 2023. This Bill replaces three archaic laws: the Indian Telegraph Act of 1885, the Indian Wireless Telegraphy Act of 1933, and the Telegraph Wire Act of 1950, bringing all telecom regulations under one Act. You have called the new telecom law outdated and archaic. What exactly do you mean by this?

Tejasi Panjiar: Thank you for the question and for setting the context. It's very important to remember the chaos in Parliament when the bill was passed. We've consistently called it outdated because we've seen two versions of this Bill: the 2022 version and the 2023 version, which finally became an Act of Parliament.

Even if you read the white paper that came before the 2022 Bill, it was a positive step. The intention was to reform the telecom sector. However, the legislation that has now become law does not have provisions to legislate surveillance or internet suspension safeguards. While it gives the government power to intercept communications and suspend the internet, it lacks checks and balances to protect user rights.

Prema Sridevi: You mentioned the need for safeguards. What kind of safeguards are we talking about?

Tejasi Panjiar: We need safeguards that are written into the law, ensuring user-centric rights. This includes checks and balances on the government's power to intercept communications and suspend the internet. Given the instances of internet shutdowns and surveillance, such as the Pegasus scandal and the recent Apple threat notification, it's crucial to bring in these safeguards.

Prema Sridevi: Can you point out specific clauses or sections of the new law that make it outdated?

Tejasi Panjiar: Certainly. For example, Section 20 of the Telecom Act is almost identical to Section 5 of the Indian Telegraph Act. Both deal with surveillance, interception, and suspension of internet communications, retaining colonial provisions without any oversight or accountability. Additionally, Section 43 confers quasi-judicial powers to any officer authorised by the Union government, allowing them to search and seize documents without clear guidelines or qualifications.

Government Holds Power to Set Encryption Standards

Prema Sridevi: What about the encryption standards? How does the new law address this?

Tejasi Panjiar: Section 19(f) gives the government the power to notify encryption standards in the interest of public safety or during public emergencies. This can be prone to misuse, as encryption is a core aspect of any online communication service, such as WhatsApp or Signal. The lack of clarity on whether online communication services are included in the scope of the Bill is concerning.

Prema Sridevi: So, essentially, the government has the power to access our communications on platforms like WhatsApp and Zoom?

Tejasi Panjiar: Exactly. If online communication services are covered under this Act, the government can intercept and access communications on platforms like WhatsApp and Zoom, which raises significant privacy concerns.

Prema Sridevi: You've said that there is a lot of ambiguity around the scope of the provisions. What exactly do you mean when you say there are a lot of grey areas? 

Tejasi Panjiar: Right, so this whole conversation started in 2022 when the Bill expanded the scope of telecommunication services to include online communication services. This led to a lot of backlash and concerns because it meant increased regulatory burden, compliance costs, and a dilution of user safety. It also increased executive surveillance powers.

Prema Sridevi: How does this infringe upon the rights of a common man using mobile phones, Skype, or WhatsApp? How do these new laws impact personal privacy rights or data protection?

Tejasi Panjiar: When you and I message over WhatsApp, it is end-to-end encrypted. This means only you and I know the contents of our messages, not even WhatsApp. If the Telecom Act applies to communication services like WhatsApp, Zoom, Facebook Messenger, or any communication service, the government can extend its surveillance and suspension powers to these platforms. This means the government can check the contents of your messages in the interest of public safety by breaking encryption, giving them a backdoor channel to your previously encrypted chats. They can also suspend services like WhatsApp during internet shutdowns, which we have seen in states like Rajasthan and Kashmir.

Prema Sridevi: Does the new law explicitly state that the government can read our WhatsApp messages or access Zoom and Skype conversations? If so, service providers need to comply with this. What is the update on the compliance from service providers?

Tejasi Panjiar: That's where the ambiguity comes in. The 2022 version clearly expanded the scope to online communication services, but the 2023 version has heavily diluted the definition of telecommunication services. The definitions are vague and open-ended, which leaves the scope wide enough for online communication services to be included in the future. As a digital rights organisation, we are fighting for explicit language in the law to exclude online communication services from these provisions.

Prema Sridevi: The government recently said the new Telecom Act is ready for a partial takeoff. What does a partial takeoff mean, and why not a full takeoff? What provisions will come into effect and how will they impact citizens?

Telecom Act Imposes Duties on Users

Tejasi Panjiar: The government has still not explained their rationale for a partial notification, which is usually based on factors like easing compliance burden for entities and the government's readiness to roll out the Act. Some sections coming into effect include the definition clause, which is a big one, and the introduction of duties on users. This is something new; for instance, users now have a duty to not furnish false information when establishing their identity to avail telecommunication services. Failure to comply can result in penalties, which has serious implications for user anonymity.

Prema Sridevi: Clause 29 is particularly problematic for journalists and whistleblowers too.

Tejasi Panjiar: Yes, clause 29 is particularly concerning. It imposes duties on users, including not furnishing false information, which can undermine anonymity and have damaging consequences for journalists and whistleblowers who rely on anonymity for their work.

Prema Sridevi: What legal recourse do journalists and whistleblowers have to counter these provisions?

Tejasi Panjiar: Legal recourse would be to challenge the provisions in court but I am not sure how effective that is going to be. From a policy perspective, we are pushing for reforms in the language of the Act to make it very explicit and safeguard journalists, whistleblowers, and other vulnerable communities.

Prema Sridevi: Your organisation, the Internet Freedom Foundation, has constantly spoken about the need for a more rights-centric law that protects users' rights instead of infringing upon them. What should have been the ideal Bill according to you? What should the new law ideally address?

Transparency and Accountability Must be Built into the Law

Tejasi Panjiar: The first step would be to alleviate fears around expanding the scope of this Act to online communication services. Given the increasing use of platforms like WhatsApp and Zoom, it's crucial to ensure accessibility and anonymity. Another key area is reforms in surveillance and internet shutdown provisions. For instance, any decision to suspend the internet should be reviewed by a committee with the power to act on their decisions. Transparency and accountability must be built into the law.

Prema Sridevi: What are the three top concerns you have with the new law?

Tejasi Panjiar: The first concern is the way the Act was brought in, with minimal debate and half of the Parliament suspended. The second is the vague scope of the Act, which leaves room for future expansion to online communication services. The third is the lack of reforms in surveillance and internet suspension architecture, which should have been the main focus of a new law.

Prema Sridevi: What specific sections in the new law should citizens and journalists be worried about regarding privacy and data protection?

Tejasi Panjiar: Sections 19 and 20 are particularly concerning. Section 20 gives the government power to possess devices, intercept communications, and suspend telecommunication services, including internet shutdowns. Section 19 allows the government to set encryption standards, which can undermine the security of encrypted platforms.

Prema Sridevi: How do international telecom regulations typically handle user privacy and data protection? Can you give us some examples of countries leading in this area and what India can learn from them?

Tejasi Panjiar: While most jurisdictions have surveillance and internet suspension provisions, they also have corresponding rights-based safeguards built into the law. India can learn from these jurisdictions by incorporating similar safeguards to protect user privacy and data protection.

Prema Sridevi: Do you think there is room for future meaningful amendments to the Telecom Bill 2023 to address its current shortcomings? If so, what specific changes would you advocate for?

Tejasi Panjiar: There is always scope for amendments to any Act of Parliament. A meaningful discourse in Parliament is necessary to address the Bill's shortcomings. Specific changes should include removing duties on users that undermine anonymity and explicitly excluding online communication services from the scope of the Act. Additionally, the powers given to the executive need to be amended to introduce rights and safeguards.

Prema Sridevi: What can ordinary citizens do to advocate for their digital rights in light of the new telecom regulations? How can they make their voices heard?

Tejasi Panjiar: Ordinary citizens can take their concerns to court, especially if the law starts being ambiguously misused. It's important to keep raising awareness and pushing for amendments that protect digital rights. Engaging with digital rights organisations and staying informed about the issues can also help in advocating for better protections.

Prema Sridevi: Thank you, Tejasi, for the insights. It was wonderful having you on the show.

Tejasi Panjiar: Thank you for having me.