Decryption, disclosure and detention: What the Prevention of Organised Crimes Bill brings back

President Anura Kumara Dissanayake

• In August I counted at least seven laws and draft laws bearing on what citizens and organisations may say, publish, fund and organise. The POC Bill is an eighth, providing insight into this Government’s true intent, since drafting this poor, vast powers this repetitive, and burdens falling this consistently on the same few are hard to put down to coincidence 
• I would argue that anything remotely akin to this under the Rajapaksas would have set off louder alarm bells, so that the relative quiet now is itself a measure of how much is permitted to proceed at pace, under a cosmetic veneer of ‘system change’

A new week, a new draft law, and a new set of significant challenges.

Section 45 of the Prevention of Organised Crimes Bill, gazetted on 2 October, lets a Superintendent of Police, on a Magistrate’s order, direct “any person who provides locking or encryption services” to unlock a service and hand over what it holds, which is for all practical purposes section 55 of the first draft of the Protection of the State from Terrorism (PSTA) Bill returned from exile. The revised PSTA dropped that power, and its data demands on telecommunications and internet firms, after 7 UN mandate holders raised concerns about it in February. But that what the revised PSTA surrendered to criticism now, tellingly, reappears in an organised crimes statute, with a lower trigger and none of the scrutiny that attaches to the word terrorism.

Relatedly, media reported BASL President Saliya Pieris noting that the revised PSTA Bill tabled in Parliament departs in major ways from what the committee appointed to consider it had agreed, particularly on bail and on extending detention. This new POC bill also fits what I have argued about lawmaking under this Government since August, that it legislates in clusters, and in rapid succession, tabling each draft before the last has even been critiqued, migrating rights-eroding, invasive powers from one text to the next, and leaving almost no one the time, energy or the means to follow the whole.

It is exhausting, and increasingly, that seems to be very much the point.

Add the Online Safety Act (OSA), and we are faced with an unending deluge of rights-eroding, harmful legislation, asymmetrically targeting minorities, diluting dissent, all really badly drafted, and often utterly irreconcilable with existing rights protections. Civil society must read, interpret and contest each new instrument, while multilateral agencies such as the World Bank blithely fund a government that’s bizarrely fixated on rehashing Rajapaksa-era harms, risking unprecedented surveillance architectures impacting minorities, dissent, and, ultimately, democracy. 

The POC Bill borrows the vocabulary of the UN Convention against Transnational Organised Crime but applies it to domestic conduct, defining an organised criminal group as 3 or more people acting in concert over a period of time, with no need for formal roles, who aim at a “financial or other material benefit” that section 66 stretches to any advantage, “including services”. A serious crime is any of 53 First Schedule offences or anything punishable by 4 years or more, and warrantless searches, provider orders, interception and decryption need only reasonable suspicion of that, so that while a WhatsApp group does not become a criminal group because 3 people in it criticise the Government, the trouble lies in everything that happens before anyone tests it.

Old wine, new statute

The first, atrocious PSTA draft’s duty to report, punishable by up to 7 years in section 15, reappears as section 65 with a longer reach and no exclusions, requiring compliance “notwithstanding any obligation of secrecy”, whereas the revised PSTA excludes legally protected, professionally secret and self-incriminating information. Its offence of sharing “confidential information” finds analogues in sections 14 and 56, and executive detention returns too, since a Secretary to the Ministry responsible for the Police may issue Detention Orders of up to 2 months at a time and 1 year in all (section 21), with the Magistrate on first production directed to make “an order giving effect to” it (section 20(3)(a)), while Part IV disapplies the rules that bar confessions to the police, an echo of the Prevention of Terrorism Act. I can't see how the right to silence, to liberty and to a fair trial survives when professional secrets can be compelled, a Magistrate is directed to sign off on detention, and a confession given to the police is admissible in court, which leaves anyone who dissents with only as many rights as the executive chooses to allow.

To wit, where the stakes are highest, in decryption, disclosure and detention, the resemblance to the PSTA’s worst, most indefensible aspects are uncanny, and unmistakable, even if who copied from whom, and why, remains unknown. What the overlap clearly exposes is the interaction design flaw I flagged in August, which is that a power struck from one law simply moves into another, and powers refused a home in one statute seem, by devious design, to leave a forwarding address for the next. 

This is no less than democratic backsliding attempted by stealth.

Secure messaging and what encryption cannot protect

For journalists, activists, dissidents and whistle-blowers, the worry isn’t necessarily that police can break end-to-end encrypted (E2EE) apps like WhatsApp or Signal. It’s everything outside the encrypted channel – the backups, the handsets and the humans – from the cloud copy of a chat to the IT contractor who runs a rights group’s accounts. Then there’s the person at the other end of the chat, whom, incredibly, section 65 forces to tell police what they know. Section 44(4) adds that a senior officer can get who called whom, and from where, without asking a Magistrate. Anyone added without being asked to a school parents’, post-workshop, workplace gossip, gym, contemporary events or neighbourhood WhatsApp group knows how loose membership of a chat can be, which matters when “virtual meetings” with known members count as evidence of belonging to a criminal group, so that people who never knew of an investigation, and cannot challenge what they are never told, may be swept into a pervasive, invasive surveillance dragnet with no notification, no time limit, and no review.

The Anti-Corruption Act and the Proceeds of Crime Act already allow comparable orders. If the POC bill goes ahead in its current form, an investigator in the future can choose whichever statute carries the weakest safeguards. The Personal Data Protection Act (PDPA) offers little refuge, since the Bill neither mentions nor displaces it and supplies no limit on purpose, no retention rule, no deletion after acquittal and no notice to the person affected. Nor will the leading social media and technology companies comply, since an E2EE service holds no keys, which makes an order under section 45 impossible to obey or an instruction to fundamentally change the product by providing backdoors. Elsewhere, all the major technology provides have threatened or chosen to exit over providing this access. Signal’s president said it would “absolutely, 100% walk” from the UK over its Online Safety Act, Apple withdrew encrypted iCloud backups from British users in 2025 after a reported demand for access, WhatsApp told the Delhi High Court in 2024 that if told to break encryption “WhatsApp goes”, and Brazil intermittently blocked WhatsApp in a long fight over court orders. Sri Lanka has by order of magnitude far less leverage than any of them, so the likelier outcome is pressure on the companies and, failing that, blocks on the platforms, as in 2018 and 2019, with ordinary users losing the means to speak, to share and to stay informed, and punished for a power that was aimed at a few suspects.

Speech, association and first principles

For Tamils in the North, already among the most closely watched communities in the country, the Bill’s idea of membership is anything but abstract, since a court may weigh “physical or virtual meetings with known members”, the “language” people use and identification “by any evidence” in deciding who belongs to a criminal group, with 5 to 20 years at stake. Going to a meeting, sending a message to a friend or using a particular turn of phrase (which especially if in Tamil risks misinterpretation by those in intelligence, Police, and related services who, by default, can’t understand or speak it) thus becomes potential evidence of belonging to a criminal group even though none of it is an offence. 

This means that the ordinary habits of association, conversation and communication that make up daily life can be gathered after the fact and read as proof of membership, leaving people unable to know in advance which of their everyday acts might one day be held against them. A ban on reporting court proceedings without permission, and on disclosing that police are investigating a group, may compound the problem by leaving a court reporter who cannot tell readers what happened in a magistrate’s court without first securing permission, or an editor who cannot confirm that police are investigating a group, so that the public learns least about the cases that most affect it. 

Layered over the Online Safety Act, the PSTA and the draconian proposed NGO law, this fails the first principles any limit on speech and association must meet, since the aim of tackling profit-driven organised crime is legitimate but the means are neither clear nor proportionate, allowing for abject fear to take precedence over competent investigation, and prosecution. 

Shortfalls against UN guidance

Sri Lanka ratified the UN Convention against Transnational Organised Crime in 2006, yet the Bill does nearly the opposite of what the UN’s own 2022 issue paper asks of a State legislating to comply. The UN paper warns that the Convention should not be used “as a pretext to eliminate political rivals, criminalise protest and advocacy or outlaw social groups”, whereas section 66 widens benefit to any advantage, “including services”, and the Bill has no saving clause. It asks for “sufficiently clear notions of participation or association”, whereas section 4(2) infers membership from language and virtual meetings, and it expects surveillance to be proportionate and notified afterwards, with undercover agents barred from inciting offences, yet sections 44(4) and 45 carry no proportionality test and the Bill has no notification and no bar on incitement.

In August I counted at least seven laws and draft laws bearing on what citizens and organisations may say, publish, fund and organise. The POC Bill is an eighth, providing insight into this Government’s true intent, since drafting this poor, vast powers this repetitive, and burdens falling this consistently on the same few are hard to put down to coincidence. Each law also makes the next easier, and all of them end up at the command of the all-powerful executive - the very office this Government promised, at the election, to abolish, but has not. The future, if the POC Bill is passed in its present form, is extremely bleak. 

I would argue that anything remotely akin to this under the Rajapaksas would have set off louder alarm bells, so that the relative quiet now is itself a measure of how much is permitted to proceed at pace, under a cosmetic veneer of ‘system change’.