Monitoring Traffic Data for Cyber Security

In one line

Section 69B lets the Central Government authorise an agency to monitor and collect traffic data for cyber security, which is not content, not authorised by the Home Secretary, and not confined to a named person.

The section

Section 69B(1), inserted in 2008:

The Central Government may, to enhance cyber security and for identification, analysis and prevention of intrusion or spread of computer contaminant in the country, by notification in the Official Gazette, authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource.

Sub-section (2): the intermediary or person in charge shall, when called upon, provide technical assistance and extend all facilities to enable online access or to secure and provide online access to the resource.

Sub-section (3): procedure and safeguards as prescribed.

Sub-section (4): an intermediary that intentionally or knowingly contravenes sub-section (2) is punishable with imprisonment up to one year, or a fine up to one crore rupees, or both. The fine was raised from one lakh by the Finance Act, 2017.

And the Explanation defines traffic data:

"traffic data" means any data identifying or purporting to identify any person, computer system or computer network or location to or from which the communication is or may be transmitted and includes communications origin, destination, route, time, data, size, duration or type of underlying service and any other information.

Read the last five words. "And any other information" undoes the specificity of everything before it. On its face the definition is the classical envelope-not-letter distinction: who, to whom, when, how big, how long, by what service. The closing words leave it open.

Four differences from section 69

One: the object. Section 69 reaches information, meaning content. Section 69B reaches traffic data, meaning the metadata about a communication. Who spoke to whom, when and for how long, not what was said.

Two: the authority. Under section 69 the competent authority is the Home Secretary, Union or State. Under section 69B, by rule 2(1)(d) of the 2009 Rules, it is the Secretary to the Government of India in the Department of Information Technology. The power is with the technology ministry, not the home ministry, because the purpose is security of systems rather than law and order.

Three: the purpose. Section 69 has six grounds plus investigation of any offence. Section 69B has one purpose expressed two ways: to enhance cyber security, and for the identification, analysis and prevention of intrusion or the spread of a computer contaminant. Nothing about sovereignty, public order or crime.

Four: the penalty. Section 69(4) is seven years for failing to assist. Section 69B(4) is one year or one crore rupees, and requires the contravention to be intentional or knowing, a mental element section 69(4) does not have.