Can the professor be stopped in India?

We should hope that Money Heist remains an escapist crime drama and does not occur for real in India. Our outdated data access systems will never be able to handle such a crisis.

If you binge watch one show this year, let it be Money Heist. I started (and finished) the crime drama last week and have to say my favourite bits were the phone calls between the Professor and the Spanish law enforcement. In case you don’t know what I am talking about, there is a gang of thieves inside the Spanish Mint with hostages. Their leader (a man called ‘The Professor’) is on the outside, strategizing and coordinating things and has to talk to the
police ever so often.

Every time there was a phone call between the Professor and the police, I kept wondering what it would be like if a gang of thieves, led by a professor (or someone from the outside) tried to pull off a heist like this in India. If the Professor and his crew were pulling this off at one of the Indian Mints, you can bet your bottom rupee that the Indian law enforcement would be trying to get access to their WhatsApp chats to uncover their plan.

However, if they tried to do that, they would need to collaborate with the US. And each request for data would take an average of 10 months to process. By the time 10 months fly by (which in 2020 would be hard to tell), the Professor and his gang would have escaped with more money than they know what to do with.

Before smartphones

The reason it will take the Indian law enforcement 10 months to get access to data is that the process is broken or badly outdated, depending on who you ask.

The way to exchange electronic evidence for criminal investigations between two countries is through an agreement called Mutual Legal Assistance Treaties (MLATs). MLATs are an old process.

For context, India and the US signed an MLAT in 2001. At the time, the world had not been exposed to smartphones. Instead, black and white Nokia phones were in their early days. Not everyone could communicate through SMS and phone calls. Those who did, did not use SMS like they do WhatsApp today.

For some time, the MLATs worked. But, later in the decade, we were introduced to Facebook and the iPhone. Besides, smartphones kept getting cheaper, and it became easier and less expensive to use mobile data. All of this meant that the volume of MLAT requests began to rise.

While communication advanced to include more means and connected more people, the MLAT system did not evolve. Processing an MLAT request still requires meeting the compliance requirements of two judicial systems (in this case, India and the US) and the request needs to meet the US standard for ‘probable cause’, even though the crime may have occurred outside the US.

The MLATs were never built to handle the volume of requests they process today, and it shows. The MLAT process being overrun serves as a rationale for countries calling for data localisation, and also for law enforcement agencies being authorised to use means to access data that infringe on privacy. There have been some efforts to fix this failure; the Budapest Convention is one of them.

Besides, the US passed the CLOUD Act in 2018, which lets countries sign executive agreements with the US to make for faster fulfilment of MLAT requests.

However, India has not entered into an executive agreement with the US under the CLOUD Act, and there is little to suggest that the situation might change in the near future.

So, India’s chances of stopping the Professor and his gang may be dependent on an outdated treaty that needs to be fixed. As long as that remains the case, let us hope that Money Heist remains a Spanish crime drama.

The writer is a policy analyst working on emerging technologies. He tweets at @thesethist.

Tech-Tonic is a monthly look-in at all the happenings around the digital world, both big and small.