BEDAVYASA MOHANTY
Despite being a rapidly maturing digital economy, India has not yet experienced its version of the Crypto Wars. However, policy developments—such as the draft Personal Data Protection Bill, the draft e-commerce policy, and the proposed amendments to India’s intermediary liability laws—indicate that regulation on encryption based on its perceived hindrance of lawful data collection is imminent. The exact nature of the regulation remains undecided because of a need to balance law enforcement needs, apprehensions about the proliferation of unsecured devices, concerns about the security of digital payments and freedom of expression. Whatever the outcome of this debate, it will significantly affect India’s newly recognized fundamental right to privacy, burgeoning economic activity in cyberspace, and security architecture as a whole.
INTRODUCTION
The technology policy debate in India has undergone a tectonic shift in the past few years. This can be generally attributed to the natural progression of technology-based services and their growing importance for commerce and the delivery of welfare. However, three specific developments have made cyber governance a top policy priority. First, in 2014, the Modi government set an unprecedented goal for Aadhaar—India’s national biometric identity program—to enroll over 1 billion Indian citizens and their sensitive personal information into a centralized database. By February 2018, there were 1.17 billion Aadhaar card holders. Aadhaar has not only made data a part of the public infrastructure but also made technologies like encryption critical to protecting India’s national security. In fact, the Indian government often touts the strength of encryption used by Aadhaar’s central database when it is accused of mismanaging the identity program.