An update to the IT Act is a very welcome move

By Asheeta Regidi Recently, it was reported that the Information Technology Act, 2000 will be updated and brought into the 21st century. India’s IT laws, comprising of the IT Act and the rules and regulations issued under it, have for a long time been outdated and way behind its counterparts in other parts of the world. The Act was last updated eight years ago in 2008. The internet and its uses has been transforming by leaps and bounds since then. The news of the update to the Indian IT Act is therefore very welcome. Here’s a look at some of the misuses of the internet which the IT Act needs to be equipped to handle: Mass governmental surveillance Recently, Yahoo was reported to have developed a scanning tool to scan all its customers’ e-mails for the FBI. Such mass government surveillance, including that conducted by entities like the Central Monitoring System of India, are not authorised by law. The only Indian laws on surveillance authorise it on a selective and temporary basis, and not the permanent, large-scale basis in which surveillance is being conducted these days. The IT Act should take a stand on mass surveillance, and declare it to be illegal. Hopefully, mass surveillance won’t be legalised as a result of the updates. The Aadhaar system and data protection A comprehensive legislation on privacy is missing in India. The only such law is the Right to Privacy Bill, which is yet to be finalized. The only codified privacy laws apply to private organisations, collecting sensitive personal data. These provisions do not apply to government bodies or to individuals collecting data. However, with the establishment of the UIDAI and the Aadhaar system, and the increasing use of e-governance systems today, there is a need for extension of the rules to governmental bodies as well. In addition to new rules, cybersecurity standards, which can be updated on a regular basis, need to be made mandatory for any entities, including government bodies, which collect any kind of personal information from people. Hacking of drones and self driving cars Hacking under the IT Act requires a ‘computer’ to be hacked. The definition of a computer under the IT Act does not cover new age technology like drones and self driving cars. While such technology cannot fit the definition of a computer, it can easily be hacked. The advent of the Internet of Things and Smart Cities makes this a bigger reality and a danger. Offences such as hacking need to be extended to involve all such entities. New-age intermediaries and aggregators Intermediaries now no longer play the passive role they did ten years ago. As can be seen in the case of Whatsapp and Facebook, many intermediaries collect a huge volume of data from their users. Stricter norms are required for such entities. The advent of aggregators, like Ola and Airbnb, also need to brought under the ambit of law, and their responsibilities under the IT Act specified. Collection of geolocational data by mobile apps The collection of geolocational data by mobile apps like Google Street View, taxi aggregators and Pokemon Go, is another issue that needs to be addressed. The collection of geolocational data does not come under the definition of ‘sensitive personal data’, and is so not protected by India’s existing privacy laws. A new Section 66A The Shreya Singhal judgment last year removed Section 66A of the IT Act, a section that was being grossly misused to censor any adverse views expressed over the Internet. Unfortunately, the removal of Section 66A also removed a crucial part of the IT Act. Section 66A was designed to deal with a number of cybercrimes, including cyber bullying, cyber defamation and net extortion. For example, the current IT Act punishes the publishing of an obscene photograph, but will not punish the sending of an obscene message (since Section 66A has been removed). E-mail spamming is another cybercrime that was dealt with specifically under Section 66A. A new version, one that is less violative of the citizens’ right to freedom of speech, is required. Misuse of social media A huge lacuna in the current IT laws is the lack of social media laws. Social media has completely changed the way people communicate with each other. Social media now plays a larger role in shaping people’s opinions than traditional media like news channels. The potential of social media has particularly been tapped into by the politicians. Misuse of social media through the use of false accounts for spreading false propaganda and creating negative opinions has become rampant. Other misuses of social media include biased news curation, creating false trending articles and paid reviews. Better cybercrime investigation Some updates are also required to better tackle cybercrime investigation. One is that the reporting of the cybercrimes within a time frame has to be made compulsory. For example, reporting any data breaches in companies storing a large volume of consumer data, such as the recent **hacking of Yahoo e-mail accounts** , should be mandatory. Another change required is to make basic training for cybercrime investigation compulsory for police officers at the ground level. Until an adequate number of cybercrime investigation cells can be set up, the police at police stations need to know how to handle delicate digital evidence. The dark web The IT Act also needs more teeth to handle the dark web. The presence of specified websites for illegal activities, such as the notorious Silk Road , and the easy availability of illegal items online, such as drugs, needs to be addressed. The author is a lawyer with a specialisation in cyber laws and has co-authored books on the subject.