How the Official Secrets Act has become a colonial relic in the AI age

The Ministry of Home Affairs circulated a classified note last month to the secretaries of all ministries and departments. It updated a circular originally issued in December 1998 — a largely advisory document reminding officials of their obligations under the Central Civil Services Conduct Rules.

A Hindustan Times report said the updated version added something the 1998 circular did not contain: an explicit warning that sharing classified or sensitive information with the media could attract proceedings under the Official Secrets Act, 1923 (OSA).

The trigger, as stated in the circular itself, was a “spurt in the incidents of leakage of sensitive information to unauthorised or undesirable elements having potential of jeopardising the overall national interest and security besides being a source of embarrassment to the government.”

Also read | AI three-hour takedown rule: When speed becomes the censor

That last phrase is worth pausing on. The OSA, a 1923 statute designed for spies and saboteurs, is now the declared instrument for managing the government’s reputational discomfort. The circular was itself circulated in classified form. A classified circular warning against the leak of classified documents: the self-referential logic is almost perfect.

This is the most recent episode in the long history of the OSA’s mission creep. But it is not the most revealing. For that, one must look at a different MHA document, issued nine months earlier, which illustrates with unusual precision what the classification system actually protects — and what it cannot.

The document that exposes itself

On May 2, 2025, Under Secretary Pratap Singh Rawat of the MHA’s Foreigners Division signed a circular addressed to chief secretaries of all states and Union Territory (UT) administrations, DGPs and IGPs, and the Directors General of the BSF, Assam Rifles, and Coast Guards. The subject: procedure for deportation of illegal Bangladeshi nationals and Rohingyas. Across all eight pages, in bold capitals, appeared the word: SECRET.

The circular prescribes the protocol for detecting, biometrically capturing, holding, escorting, and deporting illegal Bangladeshi nationals and Rohingya. It directs states to set up special task forces and holding centres in every district, specifies a 30-day verification timeline, and refers the reader to the MHA’s Foreigners Identification Portal — a publicly accessible web address.

There is nothing in it that could be described as intelligence, operational security information, or anything whose disclosure would assist a foreign adversary. It is an administrative circular on immigration enforcement logistics. Paragraph 12 is where the architecture collapses inward. It requests state governments to “take measures to avoid unnecessary publicity on the issue of deportation.”

This document was filed by the Union of India as part of its affidavit before the Delhi High Court in Rohingya deportation proceedings, and was then reproduced by petitioner Rita Manchanda in Supreme Court proceedings arising from the custodial disappearance of five Rohingya persons in May 2025. The circular marked SECRET to suppress publicity has been publicly litigated in two courts by the government’s own act of disclosure.

The gap at the centre of the Act

The OSA of 1923 is a 15-section statute that replaced two earlier colonial instruments — the 1889 Act designed to suppress nationalist publications, and its 1904 revision under Viceroy Lord Curzon. It is, as the legal scholar AG Noorani observed, a near-verbatim copy of Britain's Official Secrets Act of 1911.

Its two operational limbs are Section 3, which addresses espionage with penalties up to 14 years, and Section 5, which criminalises the wrongful communication of official information to any unauthorised person.

The structural gap is one of omission: the phrase “official secrets” is nowhere defined. Who has the authority to designate information as secret, by what process, subject to what review — none of this is in the Act. In practice, that void is filled by the Manual of Departmental Security Instructions, circulated by the MHA, which establishes the top secret/ secret/confidential/restricted hierarchy. This manual has never been officially published.

When RTI activist Venkatesh Nayak sought its disclosure, the Central Information Commission declined it, accepting the government's submission that publishing the classification criteria would harm national security. When the Department of Defence Production separately published a near-identical manual for private defence industry licensees, the absurdity of the MHA's position became self-evident.

The consequence is stark: the legal instrument under which an Under Secretary types SECRET at the top of a page is itself secret. Citizens cannot know which acts the state considers criminal. The OSA, which carries penalties of up to 14 years, operates against a background of classification criteria that no court has reviewed and no Parliament has approved.

What the courts have said

The Supreme Court’s espionage jurisprudence is formidable in reach. In Sama Alana Abdulla v. State of Gujarat, decided in 1996, the court held that a document need not be labelled secret for Section 3 to apply — it suffices that it is likely to be useful to an enemy. The 2003 budget-leak prosecution extended the term “enemy” to include potential future adversaries. Conscious possession of a sensitive document, without an innocent explanation, can sustain a conviction.

Also read | What Justice Bhuyan’s remarks on judicial transfers reveal about state of judicial independence

But these are espionage cases. Outside that context, the courts have been more protective. A 2009 Delhi trial court ruling in the Santanu Saikia matter — involving a cabinet note published in the Financial Express — held that a document merely labelled secret does not give rise to OSA liability; the nature of the information governs.

The Delhi High Court’s 2019 ruling quashing the prosecution of Reliance Industries officials went further, establishing the public domain principle: once information is available in the public domain, its confidentiality is lost and the prosecution collapses. Both principles apply directly to the MHA deportation circular, which is now in the records of two courts.

The Rafale episode of 2019 made the same point at the highest level. When the Attorney General threatened OSA action against journalists who published documents allegedly removed from government files, the Supreme Court held it had a right to examine those documents in the public interest. The threat came to nothing.

And in the Nambi Narayanan case — the ISRO scientist charged in 1994 with leaking classified information, who spent 50 days in custody before the Supreme Court found the prosecution fabricated — the Central Information Commissioner later observed that the OSA, with its undefined secrecy and unbounded official discretion, threatens not only freedom of information but fundamental civil liberties.

AI-assisted surveillance

The May 2025 circular is not only a deportation protocol. It is the founding legal instrument for a persistent, AI-powered biometric surveillance database. The consolidated biometric data is then shared with the UIDAI, the Election Commission, the Passports Division, and any other agency granting government identity cards — for the express purpose of deactivating those benefits.

India's Digital Personal Data Protection Act, 2023 exempts state processing for national security and law enforcement. Rohingya are not Indian citizens; they have no data protection rights at all. The OSA’s role in this is structural: the circular authorising the biometric database is classified SECRET under criteria that are undisclosed, so courts cannot review the proportionality of the classification, and citizens cannot challenge the legal authority for a surveillance system built in secret, by executive fiat, against stateless persons.

The unresolved constitutional question

The 1954 Press Commission noted the OSA’s chilling effect. The HD Shourie Committee recommended in 1997 limiting Section 5 of the OSA to genuine national security breaches. The Second Administrative Reforms Commission in 2006 recommended outright repeal and replacement within the National Security Act. The MHA submitted a review report to the Cabinet Secretariat in 2017. Nothing emerged from any of it.

In Britain, OSA prosecution requires the Attorney General’s personal sanction, acting in a quasi-judicial capacity. In India, prosecutorial authority is vested in the police.

Also read | Why Supreme Court is concerned with marriage battles choking its docket

A 1923 statute designed for a colonial security environment is applied without constitutional guardrails to the AI-powered, data-intensive governance of 2025. What the case law has not yet provided is a direct Supreme Court ruling testing Section 5 of the OSA against Article 19, or determining whether an unpublished, judicially unreviewable classification manual satisfies the rule of law requirements of any criminal statute.