Interception Rules 2009: Procedure and Safeguards under Section 69

Section 69 supplies the power; the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 supply everything that disciplines it: who may authorise, what a direction must contain, how long it lives, who executes it, how secrecy and destruction work, and who reviews it. The Rules consciously transplant the Rule 419A model that PUCL demanded for telephones. Topics 62 and 70 used them in outline; this note, as asked, studies the Rules separately and in full.

1. The Frame and the Definitions

• Source. Made under s.69(2), which mandates that the procedure and safeguards subject to which interception, monitoring and decryption are carried out shall be such as prescribed; the Rules are therefore a condition of the power, not housekeeping.
• The three operations. Interception (acquisition of the contents of information through any means so as to make them available to a person other than the sender or recipient), monitoring (viewing or inspection of information by observation of a computer resource), and decryption (the process of conversion of encrypted information into intelligible form, with decryption assistance and the decryption key holder defined alongside)
• Coverage. Any information generated, transmitted, received or stored in any computer resource: live traffic and stored material alike, which is the width Topic 71 contrasts with the telephone regime.

2. Who May Authorise

Figure 1: The authorisation ladder

• Competent authority. The Union Home Secretary for directions of the Central Government, and the Home Secretary of the State for a State Government. Every direction issues in writing with recorded reasons.
• Unavoidable circumstances. Where the competent authority cannot act, an officer not below the rank of Joint Secretary to the Government of India, duly authorised, may issue the direction; the competent authority must consider and confirm it within seven working days.
• Emergent cases. In remote areas where obtaining prior directions is not feasible, or for operational reasons, interception may be carried out with the prior approval of the head or the second senior-most officer of the authorised security agency at the Central level, or an officer authorised in this behalf at the State level. The competent authority must be informed within three working days and must confirm within seven working days; without confirmation the interception ceases and the information is not used.
• Authorised agencies. Only Government agencies authorised in this behalf may intercept, monitor or decrypt. The 2018 Ministry of Home Affairs order naming ten central agencies is the working list, and its challenge remains pending (Topic 70)

3. The Direction: Contents, Screen and Life

Figure 2: The direction from issue to destruction

• Grounds and reasons. The direction rests on the s.69(1) grounds and must record the reasons in writing, the requirement on which writ review of any order depends.
• Specificity. It identifies the information or class of information, the computer resource or communication concerned, and the person or class of persons whose information is to be intercepted, monitored or decrypted, and names the officer or authority to whom the intercepted material is to be disclosed.
• The other means screen. The competent authority must consider the possibility of acquiring the necessary information by other means, and a direction issues only when it is not possible to acquire the information by any other reasonable means, the Rules' necessity requirement, which Puttaswamy now constitutionalises.
• Duration. A direction remains in force for sixty days from issue and may be renewed, but no direction remains in force beyond a total period of one hundred and eighty days.

4. Execution and Decryption Assistance

Figure 3: The two sides of execution

• The intermediary's designated officers. Every intermediary appoints designated officers to receive and handle directions and communicates them to the authority. Requests are conveyed in writing to these officers, who acknowledge them and provide all facilities, cooperation and assistance for the interception, monitoring or decryption, including installation of the agency's equipment and access to the resource.
• Decryption assistance. Where the direction so requires, the decryption key holder must disclose the decryption key or provide decryption assistance. The duty extends to the key and assistance within the person's possession, capability and control, and it is this duty that makes s.69 the answer to encryption (its collision with self-incrimination is examined in Topic 70)
• Internal discipline. The intermediary puts in place internal checks to ensure that no unauthorised interception occurs and that the confidentiality of intercepted material is maintained, and it is responsible for the actions of its employees; contravention exposes it to action under the Act, and refusal of assistance is punishable under s.69(4) with up to seven years.
• Use and disclosure limits. The intercepted material is used only for the purposes for which the direction issued, and is disclosed only to the officer the direction names.

5. Secrecy, Review and Destruction

• Confidentiality. Extreme secrecy is maintained at every stage: the existence of the direction, the identity of the target and the contents of the material are all confidential, on both the agency's and the intermediary's side.
• The Review Committee. The committee constituted under Rule 419A, at Cabinet Secretary level for the Centre (with the Law and Telecom Secretaries) and Chief Secretary level in the States, meets at least once in two months and records its findings on whether each direction accords with s.69; where it finds a direction not in accordance, it may set it aside and direct destruction of the copies of the intercepted information.
• Destruction. Records pertaining to directions and the intercepted material are destroyed by the security agencies every six months, except where required for functional purposes, and intermediaries destroy their records within two months of discontinuance of the interception, maintaining extreme secrecy in doing so.
• The paper trail. Registers of directions, their dates, purposes and the officers concerned are maintained precisely so that the bimonthly review has something to examine, the internal answer to the oversight criticism examined in Topic 70.

6. The Baseline Prohibition

Figure 4: The prohibition and its perimeter

• No interception without a direction. The Rules prohibit any interception, monitoring or decryption of information in a computer resource except by a direction issued under them, the provision that makes freelance surveillance by any officer unlawful, not merely irregular.
• Around the prohibition. Disclosure of intercepted material contrary to the Rules answers under the Act, including the s.72 confidentiality discipline; and Vinit Kumar shows a court destroying the product of interception that failed the safeguards rather than letting it be used (Topic 70)

7. Frequently Asked Questions

Who can authorise interception under the 2009 Rules and in what circumstances?

Ordinarily the competent authority: the Union Home Secretary for the Centre and the State Home Secretary for a State, by a written, reasoned order. In unavoidable circumstances, a duly authorised officer not below Joint Secretary may issue the direction, subject to confirmation by the competent authority within seven working days. In emergent cases in remote areas or for operational reasons, interception may begin with the prior approval of the head or second senior-most officer of the authorised agency, with the competent authority informed within three working days and confirming within seven, failing which the interception ceases.

What safeguards do the Rules impose on an interception direction?

Written reasons; specificity as to the information, resource and persons; consideration of other means before issue; a life of sixty days renewable to a maximum of one hundred and eighty; execution only through the intermediary's designated officers with confidentiality and internal checks; disclosure only to the named officer and use only for the direction's purpose; scrutiny by the Review Committee at least once in two months, with power to set aside and order destruction; and destruction of records by agencies every six months and by intermediaries within two months of discontinuance.

8. Related Topics

• Topic 70: Section 69 and the Right to Privacy. The constitutional testing of these safeguards.
• Topic 71: Section 69 vs Telephone Interception. The Rule 419A model across the two regimes.