The Encryption Debate in India

This is a bit late, but I thought it would be nice to wade into the currently simmering liberty v. security debate centred about the proliferation of encrypted online communication. I'd written about encryption myself a while back at a time when it wasn't in the eye of the storm. Most of what I have to say in this post is probably already the subject of various comments/editorials in India and the USA, so I apologise for the inescapable repetition. I will address two questions (1) is encrypting private communications illegal in any form, and (2) can the government compel you to give up your encrypted communications. I am purposely keeping out of the liberty v. security debate.

Is WhatsApp Really Illegal Now?

I came across a provocatively titled article today - 'WhatsApp is now Technically Illegal and a National Security Threat in India'. The click-bait worked and I read through the piece and several others [useful links here, here, here and here]. What emerged was a bleak scenario. 

To answer the question first, WhatsApp is technically not illegal - an Internet Service Provider (ISP) running WhatsApp without seeking government permission for the new encryption level is what's illegal. This is because the Department of Telecommunications (DoT) operates through License Agreements between the Government (Licensor) and the ISP (Licensee). Clause 2.1(vii) of this Agreement places a limit of 40-bits for encryption that can be placed by individuals/organisations on the ISP without government permission. For anything more, the ISP needs permission from the Licensor, i.e. the Government. 

What is 40-bit encryption? The kind that people in the 1990s used. The Government doesn't really disagree - a 2002 Note by the DoT stated that 40-bit was needed to ensure security operations aren't hampered. Strangely, despite development of technology the Government stuck to this standard in 2007, incorporating it in the License Agreements mentioned above. In 2009, the Information Technology (Amendment) Act of 2009 was notified, which inserted Section 84-A: "the Central Government may, for the secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption." No such prescription has yet come through. The Government has not changed the 2007 policy, although several public sector institutions mandate a higher level of encryption than the 40-bit standard. The RBI mandates 128 bit encryption. This is because 40-bit encryption is rather insecure, to put it lightly. 

So, you don't need to worry about using WhatsApp yourself (well, given the new encryption, of course you don't). The ISPs offering you WhatsApp for use are the ones who will be bothered. That too for contractual violations and not for committing a crime, since this amounts to breaching the License Agreement. Notification of an encryption policy, or a change in the existing agreement, has been sought for many years. Maybe this wakes up the slumbering leviathan that is the Government. 

Can you/WhatsApp be Compelled to Reveal Information?

Section 69 of the Information Technology Act, 2000 is key to this. It authorises  any agency of the Central Government to "intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource." This requires a written order under Section 69(1), and for it there must be satisfaction that "it [the interception, monitoring or decryption] is necessary of expedient to do in the interest of the sovereignty or integrity of india, defence of india, security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence". Note how lofty goals of requiring decryption for the security of the state, come down to normal things such as investigating any offence. 

The Government may prescribe rules governing this process and attendant safeguards under Section 69(2), and these have been created in the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. It places a requirement of cooperation on the subscriber (end-user, like you and I) or intermediary (like the ISP) under Section 69(3), and a failure to cooperate attracts a fine, and imprisonment which may extend to seven years under Section 69(4). This legal compulsion to cooperate with the threat of prosecution is what brings us to the fundamental right guaranteed to all persons (not citizens) in India under Article 20(3) of its Constitution: "No person accused of any offence shall be compelled to be a witness against himself." 

There are three questions that must be answered while determining any Article 20(3) question: (1) is there compulsion, (2) is the person compelled accused of any offence and (3) is the material sought from compulsion unique to the personal knowledge of that accused or not (blood samples are not unique to personal knowledge in this classification, for instance). Section 69(1) clearly reveals an element of compulsion - a potential seven-year jail term for not cooperating - so condition (1) is met. Its conditions (2) and (3) that are interesting.

I've recently written a lot about condition (2) and how it has contributed to a steady decay of the protection under Article 20(3) in the sphere of the so-called socio-economic offences [see previous posts here, here and here]. This requirement of being accused requires a 'formal accusation' against a person. Section 69(2) sends us to the 2009 Rules to see whether or not such a 'formal accusation' is made against a person who is subjected to an order under Section 69(1). The one Rule directly addressing the 'Decryption Key Holder' (WhatsApp in our case) is Rule 17, which doesn't really make any accusation of the kinds required. The terms of Section 69(1) make it abundantly clear that a need for interception, monitoring or decryption is not limited to crime-solving, but extends to crime-controls and prevention. This makes it harder to argue that a person is accused of any offence at the time when the decryption order warrants cooperation at the threat of prosecution.

We then come to condition (3). Is an encryption code/decryption key 'personal information' or is it akin to blood-samples? This question has been considered in the US and the UK; both countries follow similar distinctions and restrict their self-incrimination protections to something akin to our 'personal knowledge' idea. The last time I read up on this, England had the Court of Appeal decision in R v. S & A and the US had In re Boucher (district court and appeals court) and USA v. John Doe (11th Cir. App. Court). The English Court held the decryption key could be demanded without violating self-incrimination protections under the European Convention on Human Rights. It found the digital key akin to a physical one, and relied on this analogy for its decision. The American Courts held otherwise in both cases. And found that compelling such passwords violated the self-incrimination clause of the Fifth Amendment. Both sets of courts debunked the physical key analogy.

How would/should India hold? Back then, I'd argued that it made sense to agree with the American approach, primarily because of the 'foregone conclusion' doctrine they adopt. Basically, the idea is that self-incrimination questions don't enter the fray if existence of the information ultimately sought is a 'foregone conclusion': its existence can be concluded without needing the decryption. I stand by that claim, but understand that it will mostly not be seen being used by Indian courts any time soon. Which brings us to the settled question on the nature of the testimony. Is the decryption key really part of 'personal knowledge'? If you were to compel me to reveal my computer password, that demand is very different from demanding a firm to divulge its decryption key which is used to code a software. The former is quite certainly a part of my 'personal knowledge' - evidenced best by how often I forget the darn thing. The latter doesn't fit this idea - the decryption key is usually part of the software and not 'personal knowledge' of any person. Unless, we extend self-incrimination to corporations and label decryption keys as part of the corporation's 'personal knowledge'. 

I think this shows how no blanket answer can be given for whether these scenarios result in violating the guarantee of Article 20(3). Both sets of issues - the accused person requirement and the personal knowledge test - show exciting possibilities of development in this field. It would be interesting to see how a High Court treats them.

On Abetment and the IPC

The fascination of this Blog with inchoate liability continues, and this post dips into the concept of abetment. One might say this fascination is being reflected across the board, with a high-profile investigation recently grabbing headlines for making use of abetment. This, admittedly though, is a diversion from the current project of considering criminal conspiracy on this blog. But the diversion is purposeful, as I hope will become clear during the course of this post.

Statutory Framework
I refrain from providing regular dictionary definitions of abetment, since Section 107 IPC does the defining for our purposes. According to this provision one can 'abet' a thing in one of three ways: (i) by instigating any person to do that thing, (ii) by engaging with another in a conspiracy for the doing of that thing with some act/illegal omission occurring pursuant to this conspiracy towards doing that thing, or (iii) intentionally aiding by act/illegal omission, the doing of that thing. Section 108 IPC tells us that an abettor is liable regardless of whether the principal acts on the abetment. Liability is thus one step removed from the ultimate commission of an offence, making clear the 'inchoate' nature of abetment. So, to use the statutory example: if A instigates B to murder C, and B doesn't do so, A is still liable for abetment. The commission of offences makes a difference for punishment - this is explained by Sections 109-117 of the IPC. Most prosaically, Sections 109, 115 and 116 IPC provide that different punishments are inflicted where a principal commits the offence being abetted and where no offence is committed. This provides a neat method to proceed with this post; we will first jump to rules creating liability and then turn to rules defining the extent of that liability.

Defining Abetment and Abettors
Section 108 IPC tells us that an abettor faces inchoate liability. We've discussed inchoate liability in context of conspiracy, so lets compare. Section 120-A defines conspiracy as agreeing to commit 'illegal acts', and the explanation renders conspiracies to commit offences punishable without any subsequent act resulting. Abetment by conspiracy as per Section 107 IPC always requires the occurrence of an act/illegal omission pursuant to the conspiracy. But, notice a more basic difference. A conspiracy to commit an offence means both parties have agreed at the outset that they will be committing offences. This planned cooperation is only one means of abetment, and the other forms do not require abetment of offences, but abetment of acts. So an abettor need not know the 'thing' being abetted is an offence. Section 108 supports this, and defines an Abettor as one who abets an offence, or acts that would be offences.

So, an abettor's mental element need not be that well-defined. But, given how liability can arise even if there is no act consequent to any abetment, it makes sense to demand nothing short of intention on part of an abettor to hold her liable. Further, to ensure the net of criminal law is not cast too wide, it becomes necessary to demand some acts/illegal omissions towards the doing of something for establishing abetment. Section 107 supports this conventional theory. Instigation cannot exist without intention, and always involves some express physical act. Using several synonyms, the Supreme Court has explained that 'instigation' means to "goad, urge forward, provoke, incite, or encourage" the doing of something [Ramesh Kumar v. State of Chhattisgarh, (2001) 9 SCC 618 (3 Judges), at paragraph 20]. The conspiracy clause in Section 107 specifically requires that an act/illegal omission accompany a conspiracy, and this act/illegal omission must be towards the commission of the thing abetted. A pure conspiracy is not enough, contrary to the crime of Section 120-A IPC [Pramatha Nath Taluqdar v. Saroj Ranjan Sarkar, 1962 Supp. (2) SCR 297 (3 Judges), pages 318-320]. Finally, there is aiding by act/illegal omission clause which is prefaced by a requirement of intention, meaning that one must intentionally aid, not merely aid, for acts/illegal omissions to be considered abetment [Shri Ram v. State of Uttar Pradesh, (1975) 3 SCC 495].

Another interesting facet of Section 107 is its recognition that abetment can occur at any stage of the doing of some thing. I argue that there is a neat three-step division reflected in the three categories of Section 107. Instigation usually is the outset and represents a situation where A provokes/goads B to do something. Conspiracy indicates a plan between A and B to do something rather than one person provoking another towards it. Aiding indicates a situation where B is already doing something and A comes in later. Section 109 IPC seems to support me here with its explanation: "an act or offence is said to be committed in consequence of abetment, when it is committed in consequence of the instigation, or in pursuance of the conspiracy, or with the aid which constitutes the abetment." In this account of abetment the abettor's liability itself is linked to the principal. I argue that this is important, and keeps the scope of abetment reigned in. Pedantically, then, I argue that A cannot instigate someone who is already doing that thing, when Section 107 requires the instigation must be to do that thing. Basically, if A walks in on B repeatedly stabbing C, if A now encourages B to keep on stabbing it cannot be read as being an instigation to do something [stabbing here], since it is already happening. Abetment by conspiracy is also limited to situations where the thing is yet to be done - the conspiracy must be "for the doing of that thing". Once the 'thing' is already in motion, all that is left is intentionally aiding its 'doing', either by acts or illegal omissions.

My argument on the three-step division lacks support in case law, due to my poor research (another way to say that comments are welcome!). On to more surer footing then, where we consider how the IPC accounts for the possibility of dissonance between the acts of abettor and principal.

Liability and Accounting for Variance
If we see abetment as requiring complete harmony between the acts/intentions of the abettor and principal, then we come dangerously close to conflating abetment with conspiracy. Abetment doesn't always involve an element of planning, and the law must account for imperfect associations between abettor and principal that are being created. How does it account for this possible variance? At the first step of different intentions, the law privileges the acts/intentions of the abettor. Section 110 IPC provides that where the principal carries out an act with an intention different from the abettor, the law will operate on a fiction that the principal acted with the intention held by the abettor in order to punish the abettor.

At the second step of different physical consequences resulting from abetment, the law inserts a requirement of knowledge as to probable consequences to go along with the initial requirement of intention. Recall that an offence consists of conduct, consequence and circumstance requirements acting together. For instance, certain kinds of conduct - say, sexual intercourse - becomes an offence (rape) when it is committed in certain circumstances - in the absence of consent. Similarly, certain conduct is only an offence where it results in certain consequences - murder comes in, when acts result in causing death. What mental states are associated with conduct, consequences and circumstances? The law moves on a presumption that only voluntary conduct can be considered to hold someone liable (thus creating various exceptions for insanity and intoxication). Consequences are ordinarily intended: A intends to cause death by shooting C with a gun. Circumstances are known: A proceeds to have sexual intercourse with C despite knowing there is no consent or is reckless as to existence of consent. In abetment, there is a gap between the conduct and consequence elements. The acts of firing a gun or reckless/forcible sexual intercourse are not committed by A but by another person, B. The possibility of B realising the desired consequence becomes yet another circumstance, that can only be probably known.

Thus, under Section 111 IPC an abettor is liable for even those acts that are different from the ones abetted, so long as that different act was a probable consequence of the abetment and had a relation to it. Similarly, under Section 113 IPC, where acts are abetted with the intention of causing a particular effect but result in causing a different effect, the abettor can be liable even for the different effect if she knew that the act abetted was likely to cause that effect. Interestingly, all the illustrations to Sections 111 and 113 IPC are restricted to abetment by instigation, although the proviso to Section 111 specifically lists all three forms of abetment. Going back to the argument in the previous section, can it be said that a dissonance is possible where I am aiding the doing of something by acts/illegal omissions, as the thing is already in the process of being done?

An example to round things up. If A encourages her friend B (a 15 year old)  to take her car out for a spin, A abets B 'to do a thing', i.e. drive a vehicle. This is an offence, and so A can be held liable as an abettor. If A tells B that she will arrange for a fake license to help her drive whenever needed, A now abets by intentional aiding 'the doing of that thing', i.e. continuing driving while she is not authorised. A knows that B has a habit of driving fast - B got challaned on previous occasions - but lets her continue. Tomorrow, then, if B gets into an accident while driving rashly which leads to the death of a pedestrian C, can A be held liable as an abettor? The answer would turn on whether A knew that the act abetted (B driving, in a manner known to be rash), was likely to cause that effect (causing an accident while driving). Certainly, this is not implausible by any means.

Conclusions
This post hopefully cleared some ground on abetment, and created new doubts as well. What is more important for the larger scheme of things on this blog currently is the relationship between abetment and conspiracy, which we touched on. The next post will get back to discussing this relationship more thoroughly.

The IPC and Conspiracy II: A Problem of Excess

Criminal conspiracy was something I briefly introduced on this Blog recently. There were several threads to develop, and in this rather philosophically-titled post I want to bring out an old skeleton/argument from the conspiracy closet: the offence of conspiracy must be restricted to situations where the conspiracy remains unfulfilled. When the conspiracy results in realisation of the intended/known consequences i.e. an offence, there remains no reason to separately punish the conspiracy to commit that crime. 

The Prosecutor's Darling

Conspiracy is an inchoate offence, which means that it covers incomplete acts and makes them criminal due to particular harms they present. The particular harm has been elaborated upon by courts, which have noted that there is something very dangerous about people sitting together and thinking of plans to go against the state and its laws, meriting this behaviour be deterred through penalisation [Pinkerton v United States, 328 U.S. 640 (1946)]. Now, if we agree that a conspiracy offence intends to cover the inchoate liability of people agreeing to commit offences, why do prosecutors insist upon levying conspiracy charges in cases where persons do manage to commit offences pursuant to the conspiracy? 

I argue that there are two main reasons for this, at least. The first, is the procedural benefit conferred by a conspiracy charge: a golden-lasso like quality that allows the prosecutor to rope in disparate offences and offenders in a single trial where normally they would have to be tried separately. Section 218(1) of the Criminal Procedure Code 1973 creates the rule that there must be separate charges for every distinct offence, and each charge shall be tried separately. Section 220(1) creates the exception, providing that more offences than one may be tried together if they form part of the same transaction. A conspiracy is perhaps the easiest way to create one transaction out of a variety of offences committed across space and time. While there is not much writing on this in India, there has been some commentary in England over time on this rolled-up charge of conspiracy [See references in David Ormerod 'Making Sense of Mens Rea in Statutory Conspiracies' 59(1) Current Legal Problems 185 (2006)].

The second benefit is the evidentiary relaxation provided in cases of conspiracy. In a case where Z is being tried for having committed a robbery, a statement by X that she heard Y tell her that Z was going to commit a robbery, has no value. Whatever X says is hearsay, a short term for basically saying that there is a sensory gap between X and the actual event that X is talking about - Z committing a robbery. Now flip the coin and take a case where X, Y and Z are stated to be conspirators, who committed a robbery. Suddenly, the same statement has great value. It is specifically made relevant under Section 10 of the Indian Evidence Act 1872. Having a conspiracy charge potentially allows the prosecutor to rely upon previously inadmissible evidence, naturally making it appealing. 

The Problem of Excess

The prosecutor's darling is getting overworked, sadly. Conspiracy charges are being employed ever more routinely without there being a great deal of thought, leading to unsustainable cases and easy defences. This led to courts recognising that there can be multiple conspiracies as opposed to one broad conspiracy, which would then require separate trials nonetheless. The net, thus, cannot be strung too far and wide either it would seem. Today though, there are new problems emerging particularly in the context of statutory offences, which do not require any mental element for commission of offences. Traditionally, one may recall, a crime must have an act/omission, and an accompanying mental element that makes this act/omission criminal. If I took your pen knowing its yours, its very different from me taking it absentmindedly thinking that it is mine. But as know, several offences today do not require any mental element to make conduct criminal. The circumstances and consequences hold the key. Today, for instance, Section 13(1)(d)(iii) of the Prevention of Corruption Act, 1988, simply proscribes the obtaining for any person any valuable thing or pecuniary advantage without any public interest. The Delhi High Court interpreted this clause as not requiring a mens rea requirement. There is no need for you to intentionally or knowingly have obtained that valuable thing or advantage without public interest. Your conduct is criminal as long as the circumstance - of it being without any public interest - is established.

Now, can there be a conspiracy to commit such offences which the prosecution alleges occurred without any intention or knowledge on part of the offender, but only because the circumstances were found to exist? For example, consider the case against Dr. Manmohan Singh in the coal-allocation scam. The prosecution may allege that he intentionally acted/omitted to act in a manner to obtain for other persons a pecuniary advantage without any public interest. But it is also an offence, if it can be shown that other persons benefited from the acts/omissions of Dr. Singh and this was without public interest, regardless of whether or not these acts/omissions were known/intended. Can there be a conspiracy charge in the latter? A conspiracy is premised on parties agreeing on a course of conduct with the intention or knowledge that this conduct upon completion would or would result in the commission of an offence. It would, therefore, be rather absurd to charge a person for a conspiracy where the entire case is based on the non-existence of a mental element to commit crime. The English House of Lords in R v Saik [2006 UKHL 18] and the U.K. Law Commission have considered this problem of conspiring to commit statutory offences in some detail. We remain without any comparative assessment of the problem in India.

Alternatives

These problems remain a symptom of a deeper malaise: an insistence to employ conspiracy charges where they are not meant to be. As mentioned at the outset, conspiracy is an inchoate crime. The rationale behind criminalising conspiracies is particularly attuned to its inchoate nature. If offences are eventually committed, the fact of persons having conspired to commit them remains more suited to consideration as yet another fact to appreciate the gravity of that conduct and punish appropriately, rather than insist on treating the initial agreement separately as conduct amounting to an offence.

Are there alternatives? Well, yes. It is not necessary for a prosecutor to employ conspiracy charges to round up various offences and offenders. If the allegation is that an offence is committed pursuant to the same, then there is the route of abetment by conspiracy, under Section 107 IPC. It recognises the notion that conspiracy is only facilitating the commission of other offences. If there is involvement in the commission of the offences itself - say X, Y and Z were robbing the bank together - then there is the route of group liability under Section 34 of the IPC. The procedural advantages would be retained to cover various associate offences (suppose, forging keycards to gain entry to the bank) committed in furtherance of the main offence. The fact remains though, that today employing conspiracy charges is deeply embedded in the fabric of prosecutions that this question is considered mostly academic to only be shoved under the carpet. Until these problems are faced in some high-profile cases or repeatedly seen in a particular set of offences (as happened in England for conspiracy in money laundering offences), we are unlikely to receive the thorough re-appraisal of conspiracy law that is needed today.