Encryption is essential for protecting sensitive data, individual privacy and national security in a time of digital transition and growing cybersecurity threats. This article begins by highlighting the need for encryption laws in India, emphasising the growing reliance on digital technologies across sectors and the critical necessity of protecting digital assets. It proceeds to dissect the existing legal frameworks governing encryption and the enforcement challenges faced by regulatory agencies. A critical aspect of the research involves examining international perspectives on encryption legislations, drawing lessons from global approaches and discerning their relevance to India’s policy landscape. This article underscores the delicate balance between privacy and security concerns, particularly in the context of counterterrorism efforts. In addition, this research unravels case studies and incidents involving notable cybersecurity breaches in India, shedding light on the legal implications and consequences that follow such breaches. The study culminates with an exploration of the public opinion and stakeholders’ perspectives on encryption legislations, considering industry views and civil liberties concerns. It offers insights into the best practices for drafting effective encryption laws and provides recommendations to strengthen India’s digital resilience. It calls for proactive measures to secure India’s digital future while preserving individual freedoms and privacy rights.
AbelsonH., AndersonR., BellovinS. M., BenalohJ., BlazeM., DiffieW., GilmoreJ., GreenM., LandauS., NeumannP. G., RivestR. L., SchillerJ. I., SchneierB., SpecterM., & WeitznerD. J. (2015). Keys under doormats: Mandating insecurity by requiring government access to all data and communications. Journal of Cybersecurity, 1(1), 69–79.
2.
AhmadN. (2009). Restrictions on cryptography in India—A case study of encryption and privacy. Computer Law & Security Review, 25(2), 173–180. 10.1016/j.clsr.2009.01.007
3.
Amazon Web Services, Inc. (n.d.). SSL vs. TLS—Difference between communication protocols. https://aws.amazon.com/compare/the-difference-between-ssl-and-tls/
4.
American Civil Liberties Union (ACLU). (2021). Encryption and government hacking. https://www.aclu.org/issues/privacy-technology/surveillance-technologies/encryption-and-government-hacking
5.
AndersonR. (2008). Security engineering: A guide to building dependable distributed systems (2nd ed.). John Wiley & Sons.
6.
AndersonR., & MooreT. (2006). The economics of information security. Science, 314(5799), 610–613. 10.1126/science.1130992
7.
Apple Inc. (2021). Apple’s commitment to privacy and security. https://www.apple.com/privacy/
8.
BrennanW. J. (2017). The role of the judiciary in cybersecurity. Texas Law Review, 96(3), 505–512.
9.
Center for Democracy and Technology (CDT). (2019, November). Encryption: Protecting the infrastructure of the digital economy. Retrieved, 4September2023, from https://cdt.org/wp-content/uploads/2015/02/CDT-comments-on-the-use-of-encryption-and-anonymity-in-digital-communcations.pdf
10.
Central Bureau of Investigation. (2021). About CBI. Retrieved, 4September2023, from https://cbi.gov.in/about-us?search=who-we-are
11.
Communications Assistance for Law Enforcement Act, 47 U.S.C. §§ 1001–1010 (1994).
12.
Cryptography Research. (2021, January). The state of cryptography: Challenges and opportunities.
13.
Defense Research and Development Organization. (n.d.). Retrieved, 4September2023, from https://www.drdo.gov.in/
14.
Department of Electronics and Information Technology, Government of India. (2015, September21). Draft national encryption policy.
15.
DoctorowC. (2016). Crypto wars: Privacy vs. security in the digital age. MIT Technology Review. https://www.technologyreview.com/2016/03/09/245793/crypto-wars-privacy-vs-security-in-the-digital-age/
16.
Electronic Frontier Foundation. (2021). Surveillance self-defense: Know your rights. Retrieved, 4September2023, from https://www.eff.org/issues/know-your-rights
17.
Encryption Law of the People’s Republic of China. (2019). Encryption law of the People’s Republic of China.
18.
European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88.
19.
Federal Bureau of Investigation. (2021). What we investigate. Retrieved, 4September2023, from https://www.fbi.gov/about
20.
Federal Communications Commission. (2021). About the FCC. Retrieved, 4September2023, from https://www.fcc.gov/about-fcc/what-we-do
21.
Five Eyes. (2018, August29). Statement of principles on access to evidence and encryption. https://www.intelligence.gov/index.php/news/883-five-eyes-statement-of-principles-on-access-to-evidence-and-encryption
22.
Gazette of India. (2011). Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, G.S.R. 313(E).
23.
Global Commission on Internet Governance. (2016). One internet. Centre for International Governance Innovation and Chatham House. Retrieved, 4September2023, from https://www.cigionline.org/people/global-commission-internet-governance
24.
Google. (2021). Data protection & privacy. https://safety.google/privacy/data/
25.
GreenM. (2015). Cryptography and the internet’s Achilles’ heel. IEEE Spectrum, 52(8), 28–33. 10.1109/MSPEC.2015.7153335
GreenM. D., & LandauS. (2019, November). Encryption policy in democratic regimes: Finding convergent paths or drifting apart?Oxford Internet Institute, University of Oxford.
28.
IBM. (n.d.). What is a threat actor?https://www.ibm.com/topics/threat-actor
29.
Indian Space Research Organisation. (n.d.). Retrieved, 4September2023, from https://www.isro.gov.in/
30.
Information Technology Act. (2000). Information Technology Act, 2000, No. 21, Acts of Parliament, 2000 (India).
31.
International Organization for Standardization (ISO). (2021). ISO/IEC JTC 1/SC 27 - Information Security, Cybersecurity, and Privacy Protection.
Microsoft. (2021, March5). Statement on EARN IT Act. https://blogs.microsoft.com/on-the-issues/2020/03/05/statement-earn-it-act/
37.
Ministry of Electronics and Information, Technology (MeitY). (2020). National strategy on Blockchain.
38.
Ministry of Power, Government of India. (2021, January). Important orders, guidelines, notifications & reports. https://powermin.gov.in/en/content/important-orders-guidelines-notifications-reports
39.
National Security Agency. (2021). What we do. Retrieved, 4September2023, from https://www.nsa.gov/about/
40.
Observer Research Foundation (ORF). (2018). South Asia regional security.
41.
Office of the Prime Minister, Government of India. (2013). National cybersecurity policy.
42.
Open Society Foundations. (2021, January). Defending encryption: Civil society and the fight for secure communication. https://www.opensocietyfoundations.org/publications/defending-encryption
43.
Organization of American States (OAS). (2019). OAS cybersecurity strategy.
44.
Research and Analysis Wing. (2021). About RAW. Retrieved, 4September2023, from https://www.cfr.org/backgrounder/raw-indias-external-intelligence-agency
45.
Reserve Bank of India. (2016, June1). Master direction—Know your customer (KYC) direction, 2016.
46.
Reserve Bank of India. (2018, June6). Master direction—Cyber security framework for co-operative banks [PDF file]. https://102mditservices56b33fd530b1433187d75cb7c06c8f70.pdf
47.
RiazM., & ParvezS. (2013). Cryptography and network security in Mughal India. Journal of Computer Science and Technology, 28(6), 1060–1065. 10.1007/s11390-013-1409-4
48.
RistenpartT., TromerE., ShachamH., & SavageS. (2009). Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds. In Proceedings of the 16th ACM conference on computer and communications, security (CCS ‘09) (pp. 199–212). ACM. 10.1145/1653662.1653687
49.
RukminiS., & RamaniS. (2019, November19). Inquiry on WhatsApp hacking developments: MPs write to government, SC hearing today. The Indian Express.
50.
SarmaV. (2009). The Mauryan polity. Social Scientist, 37(5/6), 3–29.
51.
SchneierB. (1996). Applied cryptography: Protocols, algorithms, and source code in C (2nd ed.). John Wiley & Sons.
52.
SchneierB. (2016). Data and Goliath: The hidden battles to collect your data and control your world. W.W. Norton & Company.
53.
SharmaA. (2018, January4). Exclusive: India’s biometric database is leaking, says French security researcher. HuffPost India. https://www.cnn.com/2018/01/11/asia/india-security-breach-biometric-database-intl/index.html
54.
ShimJ. P. (2017). Cryptology and the Indian national security paradigm. Strategic Analysis, 41(6), 523–537. 10.1080/09700161.2017.1384272
55.
SmithJ. (2020). Cybersecurity and the power grid: Analyzing the 2020 attack on India’s electrical infrastructure. Cybersecurity Journal, 12(3), 45–63. 10.1089/cyber.2019.0696
56.
Telecom Regulatory Authority of India. (2021). About TRAI. Retrieved, 4September2023, from https://www.trai.gov.in/
57.
The Economic Times. (2018, August15). Cosmos bank cyber heist: What went wrong. https://www.law.ox.ac.uk/sites/default/files/migrated/oscola_4th_edn_hart_2012quickreferenceguide.pdf
58.
The Indian Express. (2019, October30). Kudankulam nuclear plant cyberattack: Probe finds malware in system.
59.
The Personal Data Protection Act. (2019).
60.
TripathiA. (2019, November2). The Pegasus row: What is the spyware and how does it work?The Indian Express. https://intranet.birmingham.ac.uk/as/libraryservices/library/referencing/icite/oscola/index.aspx
61.
United Nations General Assembly. (2020). The right to privacy in the digital age.
62.
United Nations General Assembly. (2020, March27). The right to privacy in the digital age (A/RES/74/247).
63.
United Nations Office on Drugs and Crime (UNODC). (2013, February). Comprehensive study on cybercrime. Retrieved, 4September2023, from https://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_210213.pdf
64.
United Nations. (2015). Report of the group of governmental experts on developments in the field of information and telecommunications in the context of international security.
65.
VicenteV. (2020, February20). What is an encryption backdoor? How-to geek. https://www.howtogeek.com/544727/what-is-an-encryption-backdoor/
66.
WinklerI. (2015). Secure communications in the internet of things: A review. In Proceedings of the 2015 ACM conference on special interest group on data communication (SIGCOMM ‘15) (pp. 509–514). ACM. 10.1145/2785956.2787484
