Indians For Guns

India to let government officials access private phone calls and emails
Security agencies will not need court approval to access data under new surveillance programme, say sources

Reuters in New Delhi
guardian.co.uk, Thursday 20 June 2013 10.14 BST

A woman talks on her mobile on a Mumbai train. The government can listen to and tape calls under the new system, say officials. Photograph: Navesh Chitrakar/Reuters
India has launched a wide-ranging surveillance programme that will give its security agencies and even income tax officials the ability to tap directly into emails and phone calls without oversight by courts or parliament, several sources say.

The expanded surveillance in the world's most populous democracy, which the government says will help safeguard national security, has alarmed privacy advocates at a time when allegations of massive US digital snooping beyond American shores have set off a global furore.

"If India doesn't want to look like an authoritarian regime, it needs to be transparent about who will be authorised to collect data, what data will be collected, how it will be used, and how the right to privacy will be protected," said Cynthia Wong, a researcher at New-York-based Human Rights Watch.

The Central Monitoring System (CMS) was announced in 2011 but there has been no public debate and the government has said little about how it will work or how it will ensure that the system is not abused.

The government started to quietly roll the system out state by state in April this year, according to government officials. Eventually it will be able to target any of India's 900 million landline and mobile phone subscribers and 120 million internet users.

The interior ministry spokesman KS Dhatwalia said he did not have details of CMS and therefore could not comment on the privacy concerns. A spokeswoman for the telecommunications ministry, which will oversee CMS, did not respond to queries.

Indian officials said making details of the project public would limit its effectiveness as a clandestine intelligence-gathering tool.

"Security of the country is very important. All countries have these surveillance programmes," said a senior telecommunications ministry official, defending the need for a large-scale eavesdropping system like CMS.

"You can see terrorists getting caught, you see crimes being stopped. You need surveillance. This is to protect you and your country," said the official, who is directly involved in setting up the project. He did not want to be identified because of the sensitivity of the subject.

The new system will allow the government to listen to and tape phone conversations, read emails and text messages, monitor posts on Facebook, Twitter or LinkedIn and track searches on Google of selected targets, according to interviews with two other officials involved in setting up the surveillance programme, human rights activists and cyber experts.

In 2012, India sent in 4,750 requests to Google for user data, the highest in the world after the US.

Security agencies will no longer need to seek a court order for surveillance or depend, as they do now, on internet or telephone service providers to give them the data, the government officials said.

Government intercept data servers are being built on the premises of private telecommunications firms. These will allow the government to tap into communications at will without telling the service providers, according to the officials and public documents.

The top bureaucrat in the federal interior ministry and his state-level deputies will have the power to approve requests for surveillance of specific phone numbers, emails or social media accounts, the government officials said.

While it is not unusual for governments to have equipment at telecommunication companies and service providers, they are usually required to submit warrants or be subject to other forms of independent oversight.

The senior telecommunications ministry official dismissed suggestions that India's system could be open to abuse.

"The home secretary has to have some substantial intelligence input to approve any kind of call tapping or call monitoring. He is not going to randomly decide to tape anybody's phone calls," he said.

"If at all the government reads your emails, or taps your phone, that will be done for a good reason. It is not invading your privacy, it is protecting you and your country," he said.

The government has arrested people in the past for critical social media posts, although there have been no prosecutions.

In 2010, India's Outlook news magazine accused intelligence officials of tapping telephone calls of several politicians, including a government minister. The accusations were never proved, but led to a political uproar.

India's junior minister for information technology, Milind Deora, said the new data collection system would actually improve citizens' privacy because telecommunications companies would no longer be directly involved in the surveillance – only government officials would.

"The mobile company will have no knowledge about whose phone conversation is being intercepted," Deora told a Google Hangout, an online forum, earlier this month.

India’s surveillance project may be as lethal as PRISM

Project documents relating to the new Centralized Monitoring System (CMS) reveal the government’s lethal and all-encompassing surveillance capabilities, which, without the assurance of a matching legal and procedural framework to protect privacy, threaten to be as intrusive as the U.S. government’s controversial PRISM project.

These capabilities are being built even as a debate rages on the extent to which the privacy of Indian Internet and social media users was compromised by the PRISM project. A PIL petition on the subject has already been admitted by the Supreme Court.

The documents in the possession of The Hindu indicate that the CMS project now has a budgeted commitment nearly double that of the Rs. 400-crore estimate that senior officials mentioned in a recent briefing to the media. Once implemented, the CMS will enhance the government’s surveillance and interception capabilities far beyond ‘meta-data,’ data mining, and the original expectation of “instant” and secure interception of phone conversations.

The interception flow diagram, hitherto under wraps, reveals that the CMS being set up by C-DoT — an obscure government enterprise located on the outskirts of New Delhi — will have the capability to monitor and deliver Intercept Relating Information (IRI) across 900 million mobile (GSM and CDMA) and fixed (PSTN) lines as well as 160 million Internet users, on a ‘real time’ basis through secure ethernet leased lines.

The CMS will have unfettered access to the existing Lawful Interception Systems (LIS), currently installed in the network of every fixed and mobile operator, ISP, and International Long Distance service provider. Mobile and long distance operators, who were required to ensure interception only after they were in receipt of the “authorisation,” will no longer be in the picture. With CMS, all authorisations remain secret within government departments.

This means that government agencies can access in real time any mobile and fixed line phone conversation, SMS, fax, web-site visit, social media usage, Internet search and email, including partially written emails in draft folders, of “targeted numbers.” This is because, contrary to the impression that the CMS was replacing the existing surveillance equipment deployed by mobile operators and ISPs, it would actually combine the strength of two — expanding the CMS’s forensic capabilities multiple times.

Even where data mining and ‘meta-data’ access through call data records (CDRs) and session initiation protocol data records (SDRs) — used for Internet protocol-related communications including video conferencing, streaming multi-media, instant messaging, presence information, file transfer, video games and voice & fax over IP is concerned — the CMS will have unmatched capabilities of deep search surveillance and monitoring. The CMS is designed to have access to call content (CC) on multiple E1 leased lines through operators ‘billing/ mediation servers’. These servers will reveal user information to the accuracy of milliseconds, relating to call duration, identification and call history of those under surveillance. Additionally, it will disclose mobile numbers and email IDs, including pinpointing the target’s physical location by revealing cellphone tower information.

Nationwide surveillance

The Hindu’s investigation has also unveiled the mystery relating to the CMS’s national rollout. Contrary to reports about it being active nationwide, only Delhi and Haryana have tested “proof of concept” (POC) successfully. Kerala, Karnataka and Kolkata are the next three destinations for CMS’s implementation. Till 2015, two surveillance and interception systems will run in parallel — the existing State-wise, 200-odd Lawful Intercept and Monitoring (LIM) Systems, set up by 7 to 8 mobile operators in each of the 22 circles, plus the multiple ISP and international gateways — alongside the national rollout of CMS. The aim is to cover approximately one dozen States by the end of 2013-14.

On November 26, 2009, the government told Parliament that CMS’s implementation would overcome “the existing system’s secrecy which can be easily compromised due to manual interventions at many stages.” In January 2012, the government had admitted to intercepting over 1 lakh phones and communication devices over a year, at a rate of 7,500–9,000 per month.

Privacy vs. security

Currently two government spy agencies — the Intelligence Bureau (IB), and the Research and Analysis Wing (RAW) — plus seven others, including the Central Bureau of Investigation (CBI), the Narcotics Control Bureau, DRI, National Intelligence Agency, CBDT (tax authority), Military Intelligence of Assam and JK and Home Ministry — are authorised to intercept and monitor citizens’ calls and emails, under the guidelines laid down by the Supreme Court, The Indian Telegraph Act 1985, Rule 419(A) and other related legislation.

Given the major technological advancements in monitoring and enhanced forensic capabilities in surveillance, coupled with the change in procedure which mandates the interception authorization to be kept secret between two government departments with no scope of a transparent public disclosure of who is being monitored, for what purpose and for how long, privacy and free speech activists are protesting and raising many questions. The government, meanwhile, is proceeding undeterred.

its a very powerful tool which can be used for good or bad by the govt!!

I have always suspected it would more and more inconvenient to not have the UID.Now, it is no gas subsidy without it.Later it might be health care and whatnot.