Govt email IDs not to be used forfor social media. New guideline

According to the new central government email policy issued on Wednesday, government employees must not use their official email addresses to register on social media websites or other websites unless it is to perform an official function or they have the authorisation of their department’s competent authority.

The policy, notified in the gazette by the ministry of electronics and information technology (MeitY), also mandated government employees, contractors and consultants to use their official government emails, which are operated by the National Informatics Centre (NIC), while discharging public functions. It also mandates government departments to differentiate between the email addresses of government employees and consultants/contractors.

This is the second iteration of the government’s email policy to be notified in the gazette. The first was notified in February 2015.

A senior government official and a former government official, both aware of the matter, said that even though this email policy is not a law, a gazette notification helps stress the importance of the policy across the board.

According to the former official, this updated policy had been in the works since at least December 2023. The senior official said that the policy had undergone multiple rounds of consultations within the government.

Both the people cited above clarified that this policy is a general update released due to the changing cybersecurity landscape and was not necessitated by any specific or imminent threat.

In the new policy, entities and competent authority (MeitY secretary) are clearly defined and a lot of ambiguity related to the permission structure has been done away with. Since the Digital Personal Data Protection Act, 2023, has been notified (but not brought into force), the section related to privacy has also been removed.

Under the new policy, “core use organisations” (central government departments and other government-controlled entities that do not provide goods or services on commercial terms) and its users must use only NICeMail for official purposes.

It is only when such a CUO has an office outside India that it can, with all due approvals, maintain alternative email services hosted outside India.

All CUOs that have their own independent email servers must have their servers located within India. The policy recommends such CUOs to consider migrating their email services to NICeMail services “in the interest of security and uniform policy enforcement”.

The policy also requires departments that currently use @gov.in or @nic.in to instead migrate to @departmentname.gov.in mail domains so that information sanctity and integrity can be maintained when officials are transferred from one department/ministry to another, and so that the ministry/department doesn’t lose access to the official communication. For this, the department or ministry in question must register the domain name with NIC.

For instance, MeitY has registered the mail domain @meity.gov.in.

The policy gives government departments six months, that is until April 30, 2025, to complete this migration.

The policy also distinguishes between organisation-linked email addresses and service-linked email addresses. The former refers to an email address such as jointsecretary-section69a@meity.gov.in so that when the current JS leaves, the email address can be used by their successor.

The latter refers to the individual-linked email address of government officers of the rank of joint secretary and above, such as nameoftheofficer@gov.in. For organised services other than general central service, this mail domain can bear the name of the service as well. For instance, the MHA uses @ips.gov.in for service-linked email addresses of members of the Indian Police Service. These service-linked addresses can only be used for communication related to the officers’ service (vacation applications, term extensions, deputations, etc.), and not for official communication related to their position (such as joint secretary, DGP, etc.)

These two kinds of email addresses cannot be mapped to each other under the policy for security reasons. Emails received on the organisation-linked email address cannot be automatically forwarded to the service-linked email address.

The 2015 policy also recommended that designation-based official email addresses should be used for official purposes yet departments across the government continue to use Gmail and Yahoo email addresses, which are at times personal email addresses linked to an individual instead of those managed by the department. For instance, one of the “official” email addresses for journalists to get responses from the home ministry is mhamedia@gmail.com. For finance ministry, they are dprfinance@gmail.com and mofpi.pib@gmail.com.

On the day of or 30 days before the day of superannuation or voluntary retirement, the government department can assign its officer the use of a slightly altered service-linked email address so that it makes it clear that the person has retired. For IPS officers, for instance, it could change to @retiredips.gov.in, and for a member of the Navy, it could change to @navyveteran.gov.in. This, however, may be a paid service.

This step was taken because retired officials often continue to receive sensitive emails, and at times, some of them, want to retain their service-linked email addresses because they have never used another address in their lives, the senior government official cited above said.

If NIC detects any malicious link in the account of a user or an attachment with a malicious code, the policy empowers NIC to delete such content from the user’s account. In such cases, NIC is also empowered to do a forensic analysis of any such email data and take assistance of third parties for this purpose.