Feeds

Indian spooks snooping without ISP knowledge

'Lawful Intercept and Monitoring' systems don't sound very lawful

Choosing a cloud hosting partner with confidence

India's authorities are carrying out wide-ranging and indiscriminate internet surveillance of their citizens thanks to secret intercept systems located at the international gateways of several large ISPs, according to The Hindu.

The Chennai-based paper claimed after an investigation that Lawful Intercept and Monitoring (LIM) systems had been deployed by the Centre for Development of Telematics (C-DoT), in violation of the government’s own communications and privacy rules.

The LIMs are fully owned and operated by the government, unlike similar systems deployed by mobile operators which have to comply with Section 5(2) of the Indian Telegraph Act and Rule 419(A) of the IT Rules, it said.

In 2006 the government apparently released “Instructions for ensuring privacy of communications”, which forced all ISPs to employ “nodal officers” to regularly liaise with the authorities on interception requests. However, in reality few ISPs have such staff and the LIMs are operated without any consultation with them in any case, The Hindu claimed.

As a result no ISP contacted by the paper was able to confirm if it had ever received an authorisation letter for the monitoring of internet content.

The LIMs in question are apparently installed between the edge router and core network and have 100 per cent indiscriminate access to the online activity of India’s 160 million internet users with an “always live” link, so spooks can operate without legal oversight or ISP knowledge.

The authorities are therefore able to monitor not just by email address, URL or IP address but by broad keyword or text searches, paper said.

Nine security agencies are apparently involved including the Intelligence Bureau (IB) and the Research and Analysis Wing (RAW).

The government was not able to provide any clarity around who, if anyone, sends the interception requests, or who authenticates and implements it.

The news comes as New Delhi finalises a much more widely publicised surveillance system – the Rs.4 billion (£47.8m) Centralised Monitoring System (CMS).

The CMS, which has been branded as “chilling” by Human Rights Watch and is the subject of a popular Stop ICMS campaign, has hit several delays due to missing software and gaps in its coverage, but is expected to be pushed through.

The Indian government has shown itself to be pretty uncompromising when it comes to matters of “national security”, as BlackBerry can attest to after its long battle over providing spooks with access to customer comms. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.