Centre overruled industry demands on safeguards for phone, internet tapping: RTI response

The Union government did not incorporate industry demands for greater accountability and judicial scrutiny in its phone and internet tapping rules, according to a review of submissions to the Department of Telecommunications (DoT) obtained by The Hindu.

In India, lawful interception — the technical term for tapping phone connections for calls, and internet connections for data — is authorised by senior officials in the Union and State governments, without any judicial oversight.

Also read |Centre says it has no data on phone tapping

Last December, the Union government notified the Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules, 2024. The new rules were notified as there was a new parent legislation for telecommunications, the Telecommunications Act, 2023, which replaced the 19th century Telegraph Act. A draft of the rules were published last August, and The Hindu reviewed industry inputs to that draft, provided under the Right to Information Act.

Geographical jurisdictions

Many of the safeguards that the industry asked for were not accepted. For instance, Vodafone Idea Ltd (VIL) wrote that it was “advisable that the current Rules clearly specify the geographical jurisdiction of various Authorized agencies to issue interception Orders, such as the authority of the State Home Secretary to issue Interception Orders belonging to numbers from other States.”

This suggestion was not incorporated, leaving it ambiguous what the authority of State-level officials is in requesting intercepts from other parts of the country.

Independent oversight

Extreme Infocomm Ltd., which operates so-called internet exchange points that allow internet providers and content providers to save on bandwidth costs with peering infrastructure, said that effective oversight required “independent bodies — either judicial or parliamentary — to ensure that interception orders are objectively reviewed, without undue influence from the issuing authority.” 

This suggestion, also made by the non-partisan research body PRS Legislative, was not accepted either. As has been the case for decades, senior officials remain free to issue interception orders, and the three-member review committee has no representation outside the Union or State governments. The government continues to rely on a 1997 Supreme Court judgement (PUCL v. Union of India) that held that interception does not need judicial oversight.

Since interception orders are confidential, there are few statistics in the public domain on their current scale. Over a decade ago, in 2014, the Ministry of Home Affairs had said in an RTI response that, at the Central level alone, 7,500 to 9,000 intercept orders were issued each month. “Such volume of orders may make it difficult for this [Review] Committee to apply its mind for detailed case-by-case scrutiny,” PRS said in its submission to the DoT.

Interception costs

The scale of interception orders entails “huge” capital and operational expenditure, Bharti Airtel Ltd. said in its response. “With the ever-increasing traffic, the storage of these records for double the time is a herculean task, even without the substantial costs that the [telecom service providers] TSPs have to incur,” Airtel said.

The company, as well as the Cellular Operators Association of India, asked the DoT to pay for the costs incurred in interception. The final rules make no provision for compensation.

Secure communications

The government did accept some of the industry’s suggestions. For instance, Airtel and Vodafone asked for the word “secure” to be inserted into the rules in reference to communications between telcos and the government. That suggestion was incorporated in the final rules.

Under the new rules, junior officials are now allowed to issue intercept orders in emergency cases, but must get confirmation by an authorised high-level official within two working days. The government incorporated telecom firms’ request that if an intercept order given by a junior official was not “confirmed” by an authorised entity, the records must be destroyed.