The Centre-WhatsApp tussle over new IT rules
- Recently, WhatsApp moved the Delhi High Court against India’s new Information Technology rules-2021 notified by the government in February.
- Concern with the new rules:
- India’s new IT rules include a traceability clause that requires social media platforms to locate the “the first originator of the information” if required by authorities. WhatsApp fighting this clause.
- It should be noted that this rule will impact most messaging apps such as Signal, Telegram, Snapchat, Wire and others. But given WhatsApp has close to 450 million users in India, the impact of this rule will definitely be significant on the platform.
- WhatsApp is invoking the 2017 Justice K S Puttaswamy vs Union Of India case to argue that the traceability provision is unconstitutional and against people’s fundamental right to privacy as underlined by the Supreme Court decision.
- WhatsApp has also cited the proprivacy arguments of organisations such as Mozilla, Access Now, Internet Society, Center for Democracy and Technology, Stanford Internet Observatory, Electronic Frontier Foundation, and Internet Freedom Foundation to bolster its point.
- The plea states that the court should declare the traceability clause as “unconstitutional” and should not allow it to come into force.
- It is also challenging the clause which puts “criminal liability” on its employees for non compliance, it is learnt.
- A WhatsApp spokesperson said that the requirement to ‘trace’ chats would be the “equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp.” As there is no way to predict which message a government would want to investigate in the future.
- This would mean that the platform will have to break end-to-end encryption, which is turned on by default for all messages.
- End-to-end encryption ensures that no third-party, not even the messaging app itself can track or read messages. It ensures that no one can read the message, except for the sender and the receiver.
- Traceability would mean re-engineering the app just for the Indian market, which is unlikely to happen.
- The app doesn’t keep a log of who is sending what message and to whom.
- And given it cannot read the contents of a message, finding the originator is even harder. Further many of the messages are just copied or forwarded by users.
- Further, tracing even one message means tracing every single message on the platform.
- WhatsApp will have to add some sort of “permanent identity stamp” or effectively ‘fingerprint’ each message, which it says will be like a mass surveillance program.
- WhatsApp says it is all for “reasonable and proportionate regulations”, but cannot support “eroding privacy for everyone, violating human rights, and putting innocent people at risk.”
- WhatsApp argues that traceability, even if enforced, is not foolproof and could lead to human rights violations and putting innocent people at risk:
- Whatsapp will have to “turn over the names of people who shared something even if they did not create it, shared it out of concern, or sent it to check its accuracy.”
- It notes that “innocent people could get caught up in investigations, or even go to jail, for sharing content that later becomes problematic in the eyes of a government.”
- It will violate “recognised principles of free expression and human rights.”
- Whats app said that even without traceability, we respond to valid requests by providing the limited categories of information available to us, consistent with applicable law and policy. They have a team devoted to assisting law enforcement 24/7 with emergencies involving imminent harm or risk of death or serious physical injury.
- Internet experts have also argued against digital fingerprinting techniques to achieve traceability, cautioning these can be easily impersonated.
- Innocent users could get implicated for activities carried out by cyber criminals who might use more sophisticated techniques to impersonate a sender.
Government response on this issue:
- Electronics & Information Technology Minister said, the government “is committed to ensure the Right of Privacy to all its citizens but at the same time it is also the responsibility of the government to maintain law and order and ensure national security.”
- No Fundamental Right, including the Right to Privacy, is absolute and it is subject to reasonable restrictions.
- A traceability order shall only come about, as IT Rule 4(2) states, “for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years”.
- The traceability measure will be a measure of “last resort”.
- The rules further state that “in complying with an order for identification of the first originator, no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator.
- WhatsApp made “no specific objection” to this requirement till the last date for the compliance with this rule. Ministry said, “Any operations being run in India are subject to the law of the land. WhatsApp’s refusal to comply with the guidelines is a clear act of defiance of a measure.”
- Ministry also cited, “At one end, WhatsApp seeks to mandate a privacy policy wherein it will share the data of all its users with its parent company, Facebook, for marketing and advertising purposes. On the other hand, WhatsApp makes every effort to refuse the enactment of the Intermediary Guidelines which are necessary to uphold law and order and curb the menace of fake news.”
Experts are clear that fingerprinting techniques are open to abuse, and in the end will undermine encryption entirely. Apps would have to remove encryption in order to implement such digital signatures on messages.
Further, to comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp — like a fingerprint — to private messages with friends, family, colleagues, doctors, and businesses. Moreover, this would mean companies would be “collecting more information about their users at a time when people want companies to have less information about them”.
So going forward, there should be a balanced way out should be taken which can ensure the privacy of citizens as well as national security.
