Indian government withdraws draft encryption policy after backlash, plans to revise and rerelease it
Ellen Barry / New York Times :
Context & Ripple Effects
Two days earlier, MediaNama warned that India's draft encryption policy put user privacy in danger; the New York Times now reports the government pulled it after the backlash and will revise before rereleasing. The retreat lands mid-pattern: in March, [[a:827324|China delayed the stage of its counterterrorism law that would have forced technology firms to hand over encryption keys]].
The corpus also shows this is not only an Indian habit — the NSA backed away from the Simon and Speck ciphers it wanted as global standards once experts balked — nor an old one: in 2022 India withdrew its Personal Data Protection Bill, and in 2024 it pulled a draft broadcasting services bill after creator backlash.
First-order effects
- Indian internet users and technology firms operating there face no new encryption obligations for now — the mandate to hand over keys or deploy weaker cryptography is off the table until the revised text lands.
- The government's drafting team must rewrite the policy, and the privacy objections MediaNama documented become the de facto checklist for what survives into the next draft.
Second-order effects
- Technology firms and civil-society groups in India gain a working precedent that loud, fast public opposition can force a full withdrawal rather than cosmetic amendments — raising the expected payoff of contesting every future draft at the proposal stage.
- Rival jurisdictions watching the same fight — China's stalled key-disclosure law being the closest analogue — see confirmation that blanket encryption mandates draw backlash severe enough to freeze legislation.
Third-order effects
- If the withdraw-revise-rerelease cycle keeps repeating, India's regulatory style hardens into publish-draft-then-retreat, where policy direction is set less by statute than by which coalition mobilizes fastest against each draft.
- Globally, the repeated retreats — from Washington to Beijing to Delhi — point toward states abandoning outright encryption mandates in favor of narrower demands negotiated case by case, though whether any revised Indian policy reasserts the original goals is unresolved.
The trend: Government attempts to mandate access to encrypted communications keep collapsing under expert and public backlash, pushing states toward iterative redrafting rather than outright mandates.