Following the previous post, which examined the relevant statutory provisions that establish the substantive framework governing Indian communications surveillance, we now turn to the statutory procedure to be followed by intercepting agents while conducting communications surveillance.

With the substantive law regarding telephone tapping laid out by Section 5(2), the procedural law regarding the same is found under Rule 419A of the Indian Telegraph Rules, 1951. It is important to note that Rule 419A was not part of the Telegraph Rules when they were originally notified in 1951. It was introduced by way of an amendment in 2007, which was necessitated by the Supreme Court's condemnation in PUCL of the lack of procedure governing telephone tapping. Due to this absence of procedure, the Supreme Court in PUCL had also enumerated certain guidelines to be followed while intercepting communications under Section 5(2). These guidelines served as a place-holder up until 2007, when Rule 419A was officially added to the Telegraph Rules, replacing the Court-issued guidelines.

As the procedure laid down by Rule 419A is lengthy and complicated to say the least, it will be examined in two phases - (1) procurement and review of lawful order, and (2) interception process.

Procurement and review of lawful order under Rule 419A

According to Rule 419A, a direction for interception under Section 5(2) [hereinafter referred to as the 'lawful order'] may normally be issued only by the Union Home Secretary at the Centre, or a State Home Secretary at the States. However, in unavoidable circumstances, a lawful order may be issued by an officer not below the rank of a Joint Secretary to the Government of India, who has been authorized by the Union/State Home Secretary to this effect.

Now the term "unavoidable circumstances" has not been defined under the Telegraph Rules, Telegraph Act, any other legislation, or judgments by courts of law. As a result, there exists no objective standard to determine whether a given situation qualifies as an unavoidable circumstance. This raises the very pertinent question: who decides whether a circumstance is unavoidable and how?

Setting aside this unresolved ambiguity in procedure, Rule 419A stipulates another exception to the general rule. In emergent cases, where procuring a lawful order is itself infeasible - either due to remoteness of location, or for operational reasons, interception may be carried out with the prior approval (as distinct from lawful order) of the Head or the second senior most officer of the authorized Law Enforcement Agency at the Centre, or officers authorized in this behalf - not below the rank of Inspector General of Police - at the States.

This exception to the general rule operates at the implementational level of interception, and says that if it is not possible to procure a lawful order for either of the listed reasons, the interception process may commence even without a lawful order as long as it is approved by a senior official as specified of the intercepting agency. However, when interception is carried out in this fashion, the relevant sanctioning authority - be it a Union/State Home Secretary (or possibly a Joint Secretary) - must be informed of the fact within 3 working days, and the lawful order itself must be procured within 7 working days. Failing this, all interception must cease from the 8^th day, until a lawful order is procured from the concerned sanctioning authority.

Rule 419A also states that a lawful order may be issued only once all other reasonable means for acquiring the information have been considered and ruled out. Any order so issued will remain in force for a period of 60 days from the date of issue, unless revoked earlier. Though the order may subsequently be renewed if necessary, no order will remain in force for more than a sum total of 180 days. All lawful orders must further contain:

• reasons behind the order, and;

• name and designation of the authority to whom the intercepted information is to be disclosed, and;

• a statement to the effect that the use of intercepted information will be subject to Section 5(2) of the Telegraph Act.

When a lawful order is issued by any of the concerned authorities, a copy must be forwarded within 7 working days to the respective Central/State Review Committee, which has been constituted by the Central/State Government under Rule 419A for the sole purpose of reviewing lawful orders. The constitution of Review Committees, though entirely Executive in nature, differs depending on whether it is a Central or State Review Committee. A Central Review Committee will consist of the Cabinet Secretary as Chairman, and the Secretary to the Government of India In-charge, Legal Affairs and the Secretary to the Government of India, Department of Telecommunications as Members. A State Review Committee on the other hand, will consist of the Chief Secretary as Chairman, and the Secretary Law/Legal Remembrancer In-charge, Legal Affairs and a Secretary to the State Government (other than the Home Secretary) as Members.

Review Committees will meet at least once in 2 months and determine if the lawful orders placed before them are in accordance with Section 5(2) of the Telegraph Act. When a Committee is of the opinion that a lawful order is violative of Section 5(2), it may set aside the order and ask that all copies of information intercepted under that particular order be destroyed.

Interception process under Rule 419A

Now that we have seen how a lawful order is procured and reviewed under Rule 419A, we turn to the process of interception itself. Procedure in this regard must be adhered to at all times, even if interception is undertaken in unavoidable or emergent circumstances.

The actual ground-level interception of communications over telephones will be carried out by various Law Enforcement Agencies such as the Intelligence Bureau and the Research and Analysis Wing, which have been specifically authorized to this effect by the Government. However, the identities of agencies so authorized are not disclosed to the public for security reasons.

In any case, as per Rule 419A, all intercepting agencies will designate one or more nodal officers to authenticate and relay requisitions for interception between the agencies and Telecommunications Service Providers. These nodal officers will be senior officials of the agencies, not below the rank of (Additional) Superintendent of Police or equivalent. The TSPs in turn will designate two senior officials as nodal officers to receive and handle requisitions. Requisitions (which will include lawful orders authorizing interception) will be delivered to nodal officers of the respective TSPs by officers not below the rank of Sub-Inspector of Police, and the nodal officers will issue letters of acknowledgement to the relevant intercepting agencies within 2 hours of their reception.

Here ends the procedure detailed by Rule 419A with respect to the interception process. Internal protocol to be followed by both intercepting agencies and TSPs in handling requisitions for interception, which presumably explains how intercepted information finds its way to the intercepting agencies, are further enumerated by periodic guidelines or notifications issued by the Central Government in the form of Standard Operating Procedures. However, these SOPs are kept out of public reach for security reasons, thereby ensuring that none other than those directly involved in the interception process have a comprehensive idea of the end-to-end procedure. An RTI request filed by SFLC.in seeking a copy of the latest of such SOPs was denied by the Department of Telecommunications, claiming exemption under Section 8(1)(a) of the RTI Act, which exempts the disclosure of information that may prejudicially affect national security.

Rule 419A does nevertheless go on to lay down certain procedural safeguards aimed at preventing misuse of intercepted information. For starters, officers authorized to intercept are required at all times to maintain records that contain the intercepted information itself, particulars of interceptees, particulars of those to whom intercepted information has been disclosed, number of copies of intercepted information created, mode of creating said copies, date of destruction of said copies and duration for which the lawful order remained in force. TSPs in turn, are to put in place adequate and effective internal checks in order to ensure that unauthorized interception does not take place, and that extreme secrecy is maintained, and utmost care and precaution taken in the interception process. Further, TSPs are made responsible for the actions of their employees, and established violations of relevant license clauses will result in action being taken against TSPs under the Telegraph Act, and this may even extend to revocation of their licenses. Last, but certainly not the least, all records pertaining to intercepted information are to be destroyed by sanctioning authorities and intercepting agencies every 6 moths, unless they (likely) need to be retained for "functional requirements". Similarly, TSPs are to destroy all such records 2 months after ceasure of interception, and are required to maintain extreme secrecy in doing so.

The procedure to be followed while invoking Sections 69 and 69B are laid down under the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, and the Information Technology (Procedure and Safeguards for Monitoring and Collecting Traffic Data or Information) Rules, 2009. The procedure outlined by these Rules are near-identical replications of the procedure under Rule 419A of the Telegraph Rules, and their reiteration here is therefore unnecessary. It would suffice to keep in mind that Internet surveillance is governed by the same broad procedural framework as telephone surveillance.