WhatsApp filed a lawsuit against the Indian government over the new IT Rules 2021 stating that the rules will compel the messaging platform to break privacy protections, Reuters reported earlier today. The filing comes a day after the deadline to comply with the new rules passed.
A WhatsApp spokesperson confirmed this news with MediaNama saying that traceability “fundamentally undermines people’s right to privacy.”
Traceability mandate will break end-to-end encryption
In the lawsuit filed by WhatsApp in the Delhi High Court, the platform said that one of the provisions of the new rules is a violation of the privacy rights guaranteed by the Indian constitution. The provision in question is the traceability mandate which requires a significant social media intermediary providing services primarily in the nature of messaging to enable the identification of the first originator of a message, people familiar with the lawsuit told Reuters.
While the rules require platforms to only provide this information for people credibly accused of wrongdoing, WhatsApp says that this cannot be done for specific people and it would have to break end-to-end encryption for both receivers and originators of a message in order to comply with the law, the report stated.
Rules will fail Puttuswamy test
“Although WhatsApp has received considerable flack over its own policies, the court should be supporting the lawsuit of the company because 1) Privacy is sacrosanct after the judgment of Justice Puttaswamy case of 2017, 2) There is no statute in place which defines the boundaries of this delicate aspect yet, 3) In the absence of a statute countering it, the judgment of the Court reigns supreme,” Siddharth Jain, Co-Founding Partner, PSL Advocates & Solicitors, told MediaNama.
In its complaint, WhatsApp also cited the 2017 Indian Supreme Court case in which the Puttuswamy test was used to support privacy. The test says that privacy must be protected except in cases where legality, necessity and proportionality all weighed against it. According to Reuters, WhatsApp argued that the new rules fail all three of those tests.
“However, in Puttawamy’s case itself, Supreme Court laid down certain exceptions and, in all probability, the Government would try to bring its order within that realm in the garb of national security, sovereignty etc,” Siddharth Jain added.
Why does traceability break end-to-end encryption?
WhatsApp has deployed end-to-end encryption for all messages, calls, photos, videos, and voice notes since 2016 so that message is “only shared with the intended recipient and no one else (not even us),” the company stated in an FAQ on this topic. Traceability is the opposite of this because it requires WhatsApp “to keep track of who-said-what and who-shared-what for billions of messages sent every day,” the company said.
The company will be forced to trace every message because it cannot predict which message the government wants to investigate and trace. “To comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp — like a fingerprint — to private messages with friends, family, colleagues, doctors, and businesses,” WhatsApp said.
“A government that chooses to mandate traceability is effectively mandating a new form of mass surveillance.” – WhatsApp
How does traceability violate human rights?
Traceability forces private companies to turn over the names of people who shared something even if they did not create it, shared it out of concern, or sent it to check its accuracy. Through such an approach, innocent people could get caught up in investigations, or even go to jail, for sharing content that later becomes problematic in the eyes of a government, even if they did not mean any harm by sharing it in the first place. The threat that anything someone writes can be traced back to them takes away people’s privacy and would have a chilling effect on what people say even in private settings, violating universally recognized principles of free expression and human rights. – WhatsApp FAQs
“We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the Government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,” a WhatsApp spokesperson told MediaNama.
Experts back WhatsApp
WhatsApp took steps it deems necessary: “Media giants suing to stall the coming into effect of the new rules was foreseeable. While the framing of new rules was imperative to keep abreast of the ever-changing national and global scenario wherein the role of tech giants is ever-increasing, the clash between the government and social media along with the growing censorship concerns made it inevitable that the incoming rules would be stringent. It seems fair to look into the rules in more detail to reach a middle ground ensuring that the safety of the country is not compromised and at the same time there is freedom of press and media and not blanket censorship. In the absence of any such negotiations, it seems that WhatsApp has taken the steps it deems necessary to protect its investments and future in India,” – Nikhil Varma, Managing Partner, Miglani Varma & Co, told MediaNama.
Not the first time traceability is challenged: “This is not the first time that identification and disclosure of the first originator of a message are under scrutiny by court on account of the privacy concerns. The Supreme Court is currently dealing with a similar issue. There is no denying that that intent behind seeking disclosure of details of first originator of the information transmitted (alleged to be unlawful) is powerful tool to effectively prevent and investigate fake news and crimes. Though the Rules does not demand disclosure of contents of the messages, however such intervention may sometimes become a potential violation of privacy and thus infringing upon the fundamental rights,” – Nakul Batra, Associate Partner, DSK Legal, told MediaNama.
IT Rules exceed the powers granted by parent Act: “WhatsApp has done what every company must do if they care about end-to-end encryption and privacy. The IT rules notified by the government are unconstitutional. In the garb of addressing misinformation and regulating technology companies, GoI has been exceeding the powers granted through subordinate legislation and using it for political purposes as is evident from the recent Twitter fracas. This is exactly the reason why the Free and Open Source Software community challenged these rules in the Kerala High Court,” Mishi Choudhary, Founder, Sflc.in told MediaNama.
Rules lack clarity, has unintended repercussions: Experts who earlier spoke in a MediaNama discussion on the same topic also contested the traceability mandate. In addition to arguing that the rules lack clarity on who an originator is and how it works for copy-paste or slightly modified messages, the panellists had a broad consensus that enabling traceability without breaking end-to-end encryption is not possible. If it is done without breaking end-to-end encryption, then it can only be done in a way that anyone can be made to look like an originator, which poses serious problems. The panellists also spoke at length about the repercussions of breaking end-to-end encryption. “What you’re doing is, you’re taking a good system that works across the world, and you’re creating a separate point of failure for it. And that point of failure is going to become a prime target for hackers,” Debayan Gupta, Professor at Ashoka University, said.
Also Read
- IT Rules 2021: CEO Will Cathcart Says WhatsApp Hopes To Find Solution To Traceability Without Breaking Encryption
- Identifying A Message’s Originator Undermines End-To-End Encryption: Internet Society
- WhatsApp Will Not Limit Features On Users Yet To Agree To New Terms
- Transcript And Video: MEITY’s Rakesh Maheshwari On IT Rules, 2021; Traceability, Intent, Compliance Timelines
- Supreme Court Directs Madras HC To Transfer All Files In The WhatsApp Traceability Case
Updated (26 May 11:06): A WhatsApp spokesperson confirmed the lawsuit with MediaNama. The post has been updated to include comments from the spokesperson.
