Updated @ 9.45am BST, September 22: It is now being reported that the Indian government has withdrawn the draft policy completely, and will issue a new version in due course.

Original story

India's newly released draft national encryption policy includes a requirement that plaintext versions of all encrypted data and messages must be kept by every user, whether a business or an individual, for 90 days. And the "verifiable" plaintext must made available to law enforcement agencies on demand. This unprecedented requirement is likely to make security breaches even more serious, and present enormous logistical problems for companies using encryption on a large scale, since they will have to manage the storage and timely deletion of the plaintext versions.

The Indian government also intends to regulate every product that uses encryption: "All vendors of encryption products shall register their products with the designated agency of the Government. While seeking registration, the vendors shall submit working copies of the encryption software/hardware to the Government along with professional quality documentation, test suites and execution platform environments." This stipulation would rule out many important open-source encryption programs, since there may not be a "vendor" offering them that can undertake this onerous and expensive registration process.

The same controls will be exerted over any digital service that uses encryption, including foreign ones: "Service Providers located within and outside India, using Encryption technology for providing any type of services in India must enter into an agreement with the Government for providing such services in India." Once again, users of such services "are also responsible to provide plain text when demanded," which would seem an impossible task when communicating securely with e-commerce websites that use encryption.

Moreover—yes, that's not all!—the proposed encryption policy would only allow companies and the public to use officially sanctioned encryption algorithms and key sizes. These will presumably be chosen to allow the intelligence services to break them if necessary—for example, if a crypto user refuses to hand over plaintext versions. Any such use of weak crypto would further endanger its users, especially if they were unaware that the encryption offered little protection.

Needless to say, none of these rules apply to the Indian government itself: "This policy is not applicable to sensitive departments/agencies of the government designated for performing sensitive and strategic roles."

In its present form, the proposed policy represents one of the worst approaches to regulating encryption yet, at a time when many governments around the world—including the UK—are seeking to undermine the technology in various ways. Given how unworkable the Indian government's proposals are, it seems likely that the current draft will be revised. If you're an Indian citizen, comments from the public are invited until 16 October.

If the proposal isn't revised, India risks exposing unnecessarily its citizens and businesses to the loss of sensitive information through online attacks, and of ensuring that ambitious Internet companies and programmers leave the country for more rational jurisdictions.