Community Consultation for TRAI + Meredith Whittaker at BIC Hello everyone! There are 2 upcoming events of interest to those involved in privacy, tech policy, and AI. more
Social Media networks and platforms, chat and messaging applications, photo and video sharing services have radically transformed the internet landscape in India and elsewhere in the last decade. User generated content has allowed diverse voices to create and share views, political opinions, dance videos, movie and music commentaries.
While the platforms and networks have encouraged these voices, there is also a growing concern1 over the sharing of potentially offensive material such as pornographic content, child sexual abuse material (CSAM), hate speech and violent content often not suitable for the wide audience such platforms caters to.
The INFORMATION TECHNOLOGY (GUIDELINES FOR INTERMEDIARIES AND DIGITAL MEDIA ETHICS CODE) RULES, 2021 notified by the Ministry of Electronics and Information Technology (MEITY), together with the Ministry of Information and Broadcasting (MIB), Government of India – under the IT Act 2000, seeks to monitor and control user generated content and provide firm guidelines for social media Intermediaries, digital news publications and other organizations who host or transfer content on the internet.
The Rules were notified in February 2021, and went into effect in May 2021. Organizations and individuals have challenged the Rules on various counts2 – including their applicability under the parent law. Large platforms and social media networks have expressed concern about implementation and compliance.
Privacy Mode, a hub for conversations around privacy, data security and compliance, conducted a two-part research project seeking to understand the impact of the Rules on organizations and employees in the tech ecosystem who might be responsible for implementing the Rules and achieving compliance in tech and media products.
A qualitative study of Social Media Platforms, Digital News Publications, and Cloud Computing services providers, was undertaken to look at the possible impact on encryption, traceability, compliance, applicability of law among others, was conducted in May-June 2021; and a quantitative survey of tech workers across India, looking at awareness, professional and personal impact, work flows and requirements, was conducted in June-July 2021.
This report is a comprehensive analysis of both surveys and presents a rounded picture of the impact of the IT Rules 2021 on organizations and its employees. This research report also looks at larger questions and concerns about privacy, freedom of expression and speech given the discursive debates around responsible tech, digital platforms and ethics, and impact on society and individuals.
By definition, the ‘Rules’ framed for any law in India are ‘Subordinate Legislation’ or ‘Delegated Legislation’. While laws are made by the Parliament/Legislature, Rules are made by the Executive i.e., the Government of India, to fulfill the requirements of the parent law. In Indian democracy, it is only the Legislative that can make laws. The Executive can only implement them. If the law says ‘XYZ has to be accomplished’, rules can frame the methods in which ‘XYZ’ can be accomplished. However, in the case of IT Rules 2021, the Rules are seen as overarching and exceeding the parent law.
Notified under the Information Technology Act, 20003 , which provides ‘Safe Harbour’ status to digital intermediaries, the Rules are ultra vires of the parent Act and seek to regulate activities that have no mention in it. Further, bringing digital news publishers under the ambit of the Rules, is unconstitutional and ultra vires of the IT act, as news websites do not fit the definition of ‘Intermediaries’ given under the Act4.
Further, the activities of news publishers and media are regulated by the Ministry of Information and Broadcasting (MIB)5, and thus excluded from the ambit of the IT Act. Concerns emerged that the Rules – which did not pass through the legislative body – sought to curtail rights and laws that did emerge from due legislative process.
Further, with existing guidelines under the Press Council Act that govern news organizations, the Rules are seen as overarching and drafted to censor specific media channels and outlets.
The Rules require intermediaries to identify the first originator of messages deemed objectionable. This implies that messaging platforms and social networking sites will have to significantly alter their product (and the technology underlying products) to comply. This is again not governed by the parent act, and is therefore unconstitutional. The Rules also operate from a position of assumed guilt, where all conversations and communications are expected to be scanned for potentially offensive material, and traced back to the original sender. This is against the assumption of innocence enshrined in the legal system operating in the country.
Breaking encryption and implementing traceability, a fundamental requirement of the new Rules, have international legal implications, as messaging services and social media platforms will need to alter the underlying technical architecture of their products or services - or at least have a different product and user experience for Indian users. Since this cannot be implemented for users in India alone and will affect every user of the services across the world, these social media intermediaries will be in violation of international laws governing user privacy and security, thus inviting legal costs.
The Rules are seen as violating freedom of expression guaranteed in the Indian constitution by implementing traceability, which breaks encryption. Privacy, also a fundamental right as determined by the Supreme Court of India, is increasingly seen as a ‘make-or-break’ feature of all websites, apps, products, and services. Privacy operates from a position of assumption of innocence of the user. The Rules, by enforcing traceability, violate the fundamental rights of Indian citizens by reducing privacy to a conditional service, and not a constitutional guarantee
When the IT Rules came into effect in May 2021, they were criticized for imposing high costs of compliance, including legal and personal liability attached to employees of social media organizations. In the case of the office of the Chief Compliance Officer (CCO), liability extended even after the CCO retired from office. Every social media and news organization surveyed during this research pointed to the personal liability attached to the role of the CCO, grievance and nodal officers as imposing financial and legal costs on their organizations.
Proactive content filtering requirements will impact human resources requirements, demand changes in product and business operations, thereby significantly increasing costs. Traceability clauses under the Rules require extensive overhaul of messaging services and social networking platforms’ core architecture, requiring significant monetary and human resource investment.
Further, respondents in the Focus Group Discussions (FGDs) believed that ease of doing business will diminish given the stringent compliance regime and employee impact.
The Rules are also framed vaguely and arbitrarily, leading to confusion over operating clauses. Additionally, they have stringent reporting requirements. This will affect all organizations, especially small and medium enterprises, financially, and otherwise.
In addition to the legal and ethical concerns emerging from implementation of the Rules, there are knowledge, awareness, and skill gaps across a representative sample of the IT industry, which may impact the ability of organizations to comply with the IT Rules.
Software developers in junior and mid-level roles in IT organizations believe their workload will increase with the IT Rules. Respondents hinted at their jobs now requiring them to do more documentation and reporting, and their role in achieving compliance in the company’s product as increasing their workload.
Industry representatives however felt that tech workers and product managers will fundamentally need knowledge in, or retraining in, privacy features, content filtering and user experience, in order to fully comply with the Rules. Experts in the industry believe that more than just technical skills or knowledge, what is missing is also perspective and understanding of how executing the Rules will impact users of media and tech products.
As noted above, encryption and traceability requirements of the Rules will mean major changes in products, especially user experience and inability to safeguard privacy of Indian users under the IT Rules. Implementing features such as voluntary verification will need product managers to acquire new skills and knowledge. Tech workers will need to learn how to work in coordination with legal teams. Given the implementation of the IT Rules, each content takedown request will have to be serviced on a case-by-case basis. This will impact scale and standard operating procedures in organizations, or will result in organizations relying more heavily on automation to censor content proactively (and to avoid being served takedown notices). In both cases, users of these products will bear the brunt, where their freedom of speech and expression will be reduced drastically.
Individual chapters and sections of the report are presented as submissions. Scroll down to read them.
Nadika Nadja is a researcher at Hasgeek. She has worked across advertising, journalism, TV and film production as a writer, editor and researcher.
Bhavani S is a Research Associate at Hasgeek. She has previously worked for the Centre for Budget and Policy Studies (CBPS), Microsoft Research India, and the University of Michigan, Ann Arbor.
Anish TP illustrated the report. Satyavrat KK provided research and editorial support. David Timethy and Zainab Bawa were project managers for producing this report. Kiran Jonnalagadda and Zainab Bawa advised on research design and execution.
We would like to thank the following individuals who provided feedback during different stages of the research. Their feedback helped the team fine-tune and bring rigour to the research process.
- Suman Kar, founder of security firm Banbreach, for reviewing early drafts of the quantitative research questionnaire, and providing detailed inputs on survey design.
- Prithwiraj Mukherjee, Assistant Professor of Marketing at IIM-Bangalore, for reviewing early drafts of the quantitative research questionnaire, and providing detailed inputs on survey design.
- Chinmayi SK, Founder of The Bachchao Project, for reviewing and providing feedback on the final report and conclusions
While Hasgeek sought funding from organizations, the research itself was conducted – with full disclosure at all stages – independently and objectively. The findings do not reflect any individual organization’s needs.
Unicef: Growing concern for well-being of children and young people amid soaring screen time (2021) - https://www.unicef.org/press-releases/growing-concern-well-being-children-and-young-people-amid-soaring-screen-time ↩︎
LiveLaw: Supreme Court Lists Centre’s Transfer Petitions, Connected Cases After 6 Weeks
India Code: The Information Technology Act 2000 https://www.indiacode.nic.in/bitstream/123456789/1999/3/A2000-21.pdf ↩︎
India Code: IT Act Definitions https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077§ionId=13011§ionno=2&orderno=2 ↩︎
User privacy and the litigation between WhatsApp and the Indian Government over the IT Rules
On 27 May 2021, WhatsApp took the Government of India to court over the IT Rules 2021. The IT Rules 2021 mandate WhatsApp to implement traceability i.e. the ability to trace the origins of “unlawful” messages. This effectively breaks WhatsApp’s end-to-end encryption technology implemented to safeguard user privacy. WhatsApp argues that this mandate (in the IT Rules) violates citizens’ fundamental right to privacy and freedom of speech and expression.
The IT Rules demand that social media companies, including WhatsApp, Facebook, Google and Twitter, to identify the source of an unlawful message within 72 hours.[^The Gazette of India] WhatsApp said the IL Guidelines are a violation of its rights under Articles 14 and 21 of the Indian Constitution, and also the rights of its more than 400 million users in the country.1
WhatsApp’s response is informed by how it implements privacy and user rights in its functionality.
Jan Koum grew up in Kiev, Ukraine, a society where everything you did was eavesdropped on, recorded, and snitched on. “I had friends getting into trouble for telling anecdotes about communist leaders. I remember hearing stories from my parents of dissidents like Andrei Sakharov, sentenced to exile because of his political views. Nobody should have the right to eavesdrop, or you become a totalitarian state – the kind of state I escaped as a kid to come to this country (the United States Of America) where you have democracy and freedom of speech. Our goal is to protect it. We have encryption between our client and our server. We don’t save any messages on our servers, we don’t store your chat history.”2
Brian Acton and Jan Koum founded WhatsApp in 2009 after they left their job at Yahoo!. After a few small hiccups, the app became one of the biggest global beneficiaries of the advent of the smartphone, and the attendant rise in instant messaging platforms. In February 2014, Facebook acquired WhatsApp for $19 billion and tweaked the existing business model. Data such as verified phone number, status and display picture, and frequency of using WhatsApp was shared with the parent company. Features were also added to make it more business-friendly, specifically the WhatsApp for Business application that lets businesses create their business profile on WhatsApp for free.3 Eventually, Brian Acton left Facebook in September 2017 to work on his own non-profit Signal Foundation, followed by Jan Koum who left the company amidst arguments with Facebook over data privacy and WhatsApp’s business model.4 Despite this acrimonious end, WhatsApp still retains some of the fundamental guiding values that the company was founded with.
WhatsApp is “designed for privacy”. But how is this achieved?
According to a senior representative at WhatsApp, these begin with a series of ruminations. “We think about what are the users’ choices and controls for managing their identity and privacy. We also think about what is the communication to the user and general public about our privacy guarantees. Encapsulating all of it is our end-to-end encryption, which are the privacy guarantees through the lifecycle of the message between two people, or one person and a group of people.”
The most integral feature to WhatsApp’s architecture is the guarantee of end-to-end encryption with every single interaction on the app . “This might be counter intuitive to most startups, but we think the WhatsApp server itself is a security adversary. End-to-end encryption means that the message goes from say, Alice to Bob, and nobody in the middle can intervene or look at the messages. That assumes that even though the encrypted blobs pass to our server, we have to almost treat the server as if it’s controlled by an adversary or a rogue government or even a rogue employee. It puts most of the logic on the phone, so that there’s very little risk of exposures. And the server is just a dumb router kind of passing through encrypted blobs, blobs from one place to the other.”
To further stress on end-to-end encryption and how it works, the encryption keys are exchanged between the sender and the receiver before sending the message without WhatsApp knowing about it through a cryptographic method called Diffie-Hellman key exchange. “So all that WhatsApp knows is Sender, Receiver and content (which is gibberish because of encryption), and much like a ‘dumb router’, it does not create a copy of the content after the message is delivered.” 5 You can read a simple and eloquent explainer on the Diffie-Hellman key exchange [here].
WhatsApp aims to recreate a conversation in real life between two or more people - no one eavesdropping, no threat of interlopers and a sense of generalised intimacy. This is a useful analogy in understanding how their architecture works. WhatsApp also takes care to identify various threat models and build systems that counter them, including mass surveillance by governments or intelligence agencies, the WhatsApp server itself, as well as the threat of insider sabotage (in the event that an employee is compromised).6
In keeping with its foundational principles, WhatsApp has sought ways to ensure that end-to-end encryption is implemented even with the new features that it has rolled out in the past, be it WhatsApp status, stickers, voice notes and live location. Live location, in particular, is striking because WhatsApp had to work out the Diffie-Hellman key exchange for live location. The reason why the IT Rules undermine everything WhatsApp has built is because the Rules expect WhatsApp “not only keep a copy of the content for every message sent within India but also expects them to answer a question from law enforcement”, such as ‘Who sent ‘Let’s meet at the steps of the library’ first?'.5:1
To implement it, WhatsApp has two options:
- They need to store the plain text of every message, which means breaking up E2E entirely.
- They need to store the hash value of every message.
Hash values, in this context, can be regarded as a unique imprint for every message. The contents of a message are processed through a cryptographic algorithm, and a unique numerical value , the hash value, is produced that serves as a unique identifer of the content of the message. The hash value lookup is a non-starter because a Hash (encrypted message) will not be equal to a Hash (unencrypted message). WhatsApp only has access to encrypted messages. Further, the encryption keys change every message and are not known to WhatsApp at all, as established earlier with the ‘dumb router’ idea. The assumption is that WhatsApp can create an alternate end-to-end encryption technology that meets traceability requirements. However, this is a near impossible feat to do with cryptography.
These options give WhatsApp limited elbow room to fully comply with the Rules as they exist now. Which leaves us with the question: if not WhatsApp, what? A potential outcome is the advent of homegrown apps that do not have E2E which will fill the vacuum left by big players like WhatsApp or Signal in the event that such apps are banned from the country, a model similar to that of China. There is also the possibility that WhatsApp may have to develop a India-specific “no-encryption” app, a cumbersome investment that might just see the company deciding to exit India instead. 5:2
WhatsApp’s court case against the Government of India stems from the new IT Rules threatening its core functionality. From a technical angle, the IT Rules potentially liquidate the very tech that WhatsApp has built. This tech also defines if WhatsApp stays in business or shuts shop.
[^The Gazette of India]: The Ministry of Electronics and Information Technology. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. 25 Feb. 2021, egazette.nic.in/WriteReadData/2021/225464.pdf.
Banerjee, Prasid. “WhatsApp Case in Delhi HC First Big Test of Privacy Law.” Livemint, 26 May 2021, www.livemint.com/news/india/whatsapps-case-against-indian-govt-could-be-first-true-test-of-right-to-privacy-11622028707630.html. ↩︎
Olson, Parmy. “Exclusive: The Rags-To-Riches Tale Of How Jan Koum Built WhatsApp Into Facebook’s New $19 Billion Baby.” Forbes, Forbes Magazine, 23 Apr. 2014, www.forbes.com/sites/parmyolson/2014/02/19/exclusive-inside-story-how-jan-koum-built-whatsapp-into-facebooks-new-19-billion-baby/?sh=55d1b3862fa1. ↩︎
Statt, Nick. “WhatsApp Co-Founder Jan Koum Is Leaving Facebook after Clashing over Data Privacy.” The Verge, The Verge, 30 Apr. 2018, www.theverge.com/2018/4/30/17304792/whatsapp-jan-koum-facebook-data-privacy-encryption. ↩︎
Rowan, David. “The inside Story of Jan Koum and How Facebook Bought WhatsApp.” WIRED UK, www.wired.co.uk/article/whats-app-owner-founder-jan-koum-facebook. ↩︎
Verma, Udit. “How Does WhatsApp End-to-End Encryption Work.” Business Today, 8 Jan. 2019, www.businesstoday.in/buzztop/buzztop-feature/how-does-whatsapp-end-to-end-encryption-work/story/307998.html. ↩︎