One of the key questions posed by the Supreme Court in yesterday’s hearings on the Aadhaar case was on the ownership of the source code behind the CIDR. Surprisingly, the response of the petitioners was that this was proprietary code, and neither the government nor the UIDAI owned it.
Representational image
Lacking ownership over this critical infrastructure can have serious consequences. One such consequence is that this affects the ability of the government to declare it as a ‘protected system’, a crucial factor for ensuring the safety of the CIDR. There is, however, a lack of clarity on the issue of ownership of the CIDR code, since information on the CIDR is not in the public domain for national security reasons.
Only government owned software can be a ‘protected system’
The question raised by the Supreme Court on the ownership of the source code behind the CIDR draws focus to the fact that this critical resource is fundamentally software, subject to the same laws that apply to non-critical software. The Kerala High Court, in the case of B.N. Firos v. State of Kerala, had issued this ruling- ‘Government cannot unilaterally declare any system as "protected" other than "Government work" … on which Govt.'s copyright is recognized…”. Given in 2006, this judgment ruled that unless the copyright on a software is owned by the Government, it cannot declare it to be a ‘protected system’ under the Information Technology Act, 2000.
The importance of being a ‘protected system’
The declaration of a computer resource - this may refer to a computer, a database, data, software, etc. – as a protected system, grants it a higher level of protection under Sections 66F, 70 and 70A of the IT Act. Being a support to a Critical Information Infrastructure or CII of the country, an attack on a protected system amounts to an act of cyberterrorism, which is punishable with life imprisonment. Mere unauthorized access to it also attracts a higher punishment of 10 years of imprisonment, as opposed to 3 years for accessing a non-critical resource. Moreover, this will also be protected by institutions like the NCIIPC, created specifically for the protection of CII.
The CIDR as a ‘protected system’
The declaration of the CIDR as a ‘protected system’ includes the CIDR’s ‘facilities, Information Assets, Logistics Infrastructure and Dependencies’ as a protected system. It isn’t clear if this includes the source code, either as an ‘information asset’, a ‘dependency’ or ‘facility’. It must be noted here that other resources that have been declared to be a protected system, such as the information assets in the form on people’s data stored in the CIDR, will continue to be protected.
What lack of ownership over the code implies
Lack of control over the software behind the CIDR, however, means that the code in use belongs to someone else, and that person has the freedom to reuse the code, license it to anyone else or even sell it. This means that maintaining the confidentiality of the code behind the CIDR, an essential factor for better security, is affected.
For instance, looking at software today, its development often involves the use of multiple components, which may be proprietary, open source or free, in combination with new code that is written by the developer. In the world of software, use of a tried and tested software component is normal, and in fact, good practice. This lowers the chance of unforeseen consequences in the form of a defect or vulnerability in the code, which is more likely when code is developed from scratch. Thus, developing a good, secure piece of software can often involve a trade-off between using a tested, secure component and retaining ownership of the software.
This use of multiple and varied components, thus, can lead to major issues with establishing ownership on the copyright over a piece of software. For example, open source software components sometimes require the derived product to be relicensed under the same open source license requirements. A developer may use a component consisting of pre-written code on which he owns the copyright. These components, whether open source or proprietary, which form a part of the software, can be reused for other purposes.
A man goes through the process of eye scanning for Unique Identification (UID) database system. Reuters
The government doesn’t automatically own software developed for it
Thus, when considering a critical piece of software like the source code behind the CIDR, it is unknown how much of it is not under the control of the UIDAI, and possibly available for reuse. The terms under which the software was developed plays an important role. A ‘government work’ under the Copyright Act, refers to a work that is made under the direction or control of the Indian government. The copyright in such a work vests with the government under Section 17(d), but this is subject to an agreement to the contrary.
A software developed for the government, or a software in use by the government, thus does not automatically belong to the government. Thus, when the petitioners argue that the ownership of the code behind the CIDR does not vest with the government, this is very much possible.
The government must retain control over its critical software
One key consideration is that the BN Firos case was decided back in 2006, and with regards to a far less crucial software than the CIDR. The software in issue there was an e-government software, created for the payment of bills, taxes, etc. to the government and governmental authorities. It will have to be seen if a different stance will ensue in the Courts with a critical software like that behind the CIDR.
Despite this, the important issue is that the rule requiring that the government to own the software before it declares it as a protected system is crucial for the government to retain control over that resource. As far as the CIDR is concerned, more clarity on the extent of the government’s control over the code behind it may be obtained when the state presents its arguments before the Supreme Court. Looking at the ubiquitous use of technology today, computer resources are now increasingly critical to a nation’s security. It is very important that the government retain control over the code it uses in such crucial systems to ensure their security and avoid such issues.
The author is lawyer and author specializing in technology laws. She is also a certified information privacy professional.
Published Date: Jan 26, 2018 08:37 AM | Updated Date: Jan 26, 2018 08:37 AM
