WhatsApp vs Indian govt: Fight for

privacy moves to court

The lawsuit, coming in the wake of several run-ins with multinational tech and
non-tech companies, indicates that the government is in way over its head.

On Wednesday, Facebook Inc.-owned WhatsApp sued the government of India

in the Delhi high court, calling the imposition of new internet rules
“unconstitutional”. The subject of adhering to the Information Technology
(Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, has been
simmering for a while, with a lot of back and forth and back-room negotiations
going on between the government and technology companies like Google and
Facebook. It seems the matter will now be decided by the courts.

WhatsApp has filed a lawsuit in Delhi against the Indian government, seeking
to block regulations coming into force on Wednesday that experts say would
compel Facebook’s messaging app to break privacy protections, sources said.
The case asks the Delhi High Court to declare that one of the new IT rules is a
violation of privacy rights in India’s constitution since it requires social media
companies to identify the “first originator of information” when authorities
demand it, people familiar with the lawsuit told Reuters.

From WhatsApp sues Indian government over new privacy rules – sources
• Reuters

This is a significant development, and we have reviewed a copy of the petition

filed by WhatsApp.

“We had no choice,” said a Facebook executive, asking not to be named

considering the sensitivity around the issue.

In the petition, WhatsApp has gone hammer and tongs at the government, as if
chiding it for invading the personal space of its users. The company has cited
several flaws and legal violations, including of the right to privacy and the
freedom of speech and expression. All to establish that the tracing obligation
should be declared unconstitutional or otherwise invalidated.

“Requiring messaging apps to ‘trace’ chats is the equivalent of asking us to keep

a fingerprint of every single message sent on WhatsApp, which would break
end-to-end encryption and fundamentally undermine people’s right to
privacy,” said a WhatsApp spokesperson. “We have consistently joined civil
society and experts around the world in opposing requirements that would
violate the privacy of our users. In the meantime, we will also continue to
engage with the Government of India on practical solutions aimed at keeping
people safe, including responding to valid legal requests for the information
available to us.”

Before we jump into the details of the case, and what one can expect from the
sordid mess, there are four editorial observations we’d like to make as
important context for this story.

First, we’ve long held the view that India is a very important market for tech
companies. Both in terms of the number of users and as a potential market
opportunity to make money. Now if you look at the history of their operation in
the country, these tech companies have mostly stayed out of trouble, going to
great lengths to accommodate the vagaries of the policy environment for doing
business in the country. This is clearly changing. Both Twitter and now
WhatsApp have taken a fairly combative stance in dealing with the
government’s requests and policy changes.

An offshoot of this tense relationship has been playing out in the government’s
soft bankrolling of the Atmanirbhar, or self-sufficiency, campaign. Where the
government’s deft communications department has created a snowball
narrative of protecting India from digital colonizers.

Second, while the government would have everyone believe that it is on top of
things, and it exudes confidence that it will be able to make most foreign
companies dance to its tunes, if one were to collate the data, it points to quite
the contrary. Of late, India has had a poor track record when it comes to legal
fights against multinational corporations. It agreed to participate in two
international arbitrations—involving tax claims on Vodafone and Cairn
Energy—but failed to honour their awards after ending up on the losing side.
Experts in India had advised the government against pursuing these cases.
Reports have surfaced to the effect that even the country’s attorney general was
not in favour of appealing against the Vodafone verdict. The government
refuted these reports, and went ahead and filed an appeal in the Singapore high
court in February this year.

Things seem to be heading in the same direction in the case of Cairn Energy too.
The UK-based company, which is fighting to get back $1.2 billion from the
Indian government, had won the case that was argued in The Hague. All the
three arbitrators, including the one appointed by India, ruled in favour of Cairn.
But India has decided to go for an appeal. Meanwhile, Cairn has opened a new
front in a US court, asking for Air India’s aircraft to be attached to recover the
$1.2 billion that is in dispute.
More recently, India froze the bank accounts of video-sharing service TikTok in
the country. And now comes the WhatsApp and the Twitter fiascos, not to
mention several media companies which have already taken the government to
court over the amendments to the IT Act.

It increasingly looks like the government is biting off far more than it can chew.

Third, there’s been this belief amongst a certain section of the country’s
population that if India tries hard, it can ape China. In the way that China has
been able to keep some tech companies from participating in the market.
Believers in this vision might point to TikTok and how it was pushed out of
India, along with scores of other Chinese apps last year. While that is true, it is
far too insufficient paint and brush to make a complete artwork. India has been
an open market for tech companies for the longest time, and that is not about
to change in a hurry. US tech companies like Google and Facebook have made
far deeper inroads in our daily life and democracy than we’d like to give them
credit for.

Four, India is clearly drawing inspiration from Brazil. This is not a compliment.

The Jair Bolsanaro-led right-wing government introduced PLS 2630/2020, or

what has since been called the fake news bill, last year. It attempted to do
exactly what the government of India wants to accomplish here, i.e., get tech
platforms to provide traceability of messages of users. It should not come as a
surprise that this bill was panned by both Brazilians and the international
community of tech policy watchers. More on this later in the story. Now, with
those four points as context, let’s jump into the WhatsApp versus Union of India
issue.

Strong suit

It’s fairly straightforward what the Indian government wants to accomplish

with the implementation of the new IT Rules. In the case of social media
platforms or what the government calls social media intermediaries, among
other things, the government wants the platforms to take down posts that are
deemed unlawful. In the case of messaging platforms like WhatsApp, it wants
them to enable identification of the originator of a certain piece of information,
something that would make WhatsApp break its end-to-end encryption. This is
the point of contention and what the lawsuit is all about.

The petition filed by WhatsApp in the Delhi high court makes for a striking read.
The main point that WhatsApp makes is that the “traceability” rule should be
declared unconstitutional on the grounds that it infringes upon the
fundamental right to privacy, violates the freedom of speech and expression,
lacks legislative competence, manifests arbitrariness, and exceeds the limit of
the authority conferred by the enabling Act, which is the Information
Technology Act.

WhatsApp’s argument is that the traceability rule (drawing from a 2017

Supreme court ruling that supported privacy in the case of K.S. Puttaswamy vs
Union of India) violates the rights of its more than 400 million users and there
is no law enacted by Parliament that enables such a rule. The government may
be trying to make a law out of this rule, but it is not valid since IT Rules are a
subordinate legislation passed by a ministry and not Parliament.

Minus all the legal parlance, WhatsApp minces no words in its petition when
talking about the privacy of its users. There are three points that stand out and
that should be read for a better understanding of how the traceability part of IT
Rules threatens the right to privacy and how far it can go to empower the
government against users.

1. WhatsApp quotes a Supreme Court judgement rejecting the proposal of a

state government to install CCTV cameras at the entrances of bar rooms and
other places of amusement and public entertainment, in order to control crime
and protect women who are likely to be exploited. WhatsApp’s point is that if
“surveillance of public behaviour in a public place constituted an unlawful
invasion of privacy” in the CCTV proposal case, the traceability rule “is a much
more serious invasion of privacy than requiring businesses to film public
behaviour in public areas, as WhatsApp was designed to facilitate the exchange
of private communications.”

It’s an unusual case citation, but it establishes the point that nothing about the
traceability rule says right to privacy.

2. For even a physical search, the government requires judicial approval to

execute a search warrant. However, the traceability rule allows for the issuance
of orders to identify the first originator of information without any judicial
oversight, “which means that there is no guarantee against arbitrary state
action”.

This basically hints that the government could go after someone it has a
personal agenda against, if it wanted to.

3. The traceability rule would mean that WhatsApp would have to build a
mechanism that permits tracing of every communication sent in India on its
messaging service. There is a Supreme Court precedent that surveillance must
be targeted and limited only to those whose “conduct shows a determination to
lead a life of crime”. The traceability mechanism contradicts that and means
that there will be surveillance of all users, even those who are using the
platform lawfully.

Plus, there is no time limit for the retention of data, which means that the
government can ask for details of any message years after it was sent.

All of the above defeat the purpose of having a private messaging platform.

No user knowing that WhatsApp and, by extension, the government can access
what they say to their contacts would be willing to stay on the service for the
sake of privacy as well as for the fear of getting implicated in a legal matter. And
WhatsApp establishes that in its petition.

(i) journalists could be at risk of retaliation for investigating issues that may be
unpopular; (ii) civil or political activists could be at risk of retaliation for
discussing certain rights and criticizing or advocating for politicians or policies;
and (iii) clients and attorneys could become reluctant to share confidential
information for fear that the privacy and security of their communications is no
longer ensured.

From Petition filed by WhatsApp •

This should definitely hurt the government and its narrative that the
traceability rule is meant to control serious crimes and curb fake news. The
Ministry of Electronics and Information Technology reiterated its intentions
yesterday. News agency ANI reported the following, attributed to the ministry:
“Government of India respects the Right of Privacy and has no intention to
violate it when WhatsApp is required to disclose the origin of a particular
message. Such requirements are only in case when a particular message is
required for prevention, investigation or punishment of serious offences such
as sexually explicit content.”

There’s more. “At one end, WhatsApp seeks to mandate a privacy policy
wherein it will share data of all its users with its parent company, Facebook. On
other hand, WhatsApp makes every effort to refuse enactment of Intermediary
Guidelines necessary to uphold law & order & curb fake news. Any operations
being run in India are subject to the law of the land. WhatsApp’s refusal to
comply with the guidelines is a clear act of defiance of a measure whose intent
can certainly not be doubted.”

If the government is fuming on the inside, it is making it known publicly. The

fascinating bit is that the government’s narrative is far from original. To know
more, let’s quickly head to Brazil.
In Bolsonaro’s steps

India is not the first country to have come up with the WhatsApp traceability
idea. Brazil has been trying to get ahead of the tech companies, especially
Facebook and WhatsApp, since at least 2016.

Finally, in May 2020, even as the pandemic was raging through Brazil, one of
the worst affected countries in the world, the ruling party was busy planning a
fake news law. The urgency to do this was in the light of the 2018 general
elections in the country, in which Bolsonaro had secured a sweeping victory.
But where social media played a key role, much like in other parts of the world,
and as a result the plague of fake news followed. With more than 100 million
users there, WhatsApp is Brazil’s largest social media platform. The bill
introduced by the senate was called PLS 2630/2020 or the fake news bill. It is
yet to be passed but it created a ruckus for what it hoped to achieve. The
Electronic Frontier Foundation, a not-for-profit organization explains it best.

Article 10 of the bill compels private messaging applications to retain, for three
months, the chain of all communications that have been “massively forwarded.”
The data to be retained includes the users that did the mass forwarding, date
and time of forwardings, and the total number of users who received the
message. The bill defines “mass forwarding” as the sending of the same message
by more than five users, in an interval of up to fifteen days, to chat groups,
transmission lists, or similar mechanisms that group together multiple
recipients. This retention obligation applies only to messages whose content
has reached 1,000 or more users in 15 days. The retained logs should be deleted
if the virality threshold of 1,000 users has not been met in fifteen days.

From The Electronic Frontier Foundation•

It is eerie how similar the government of India’s actions are, when you compare
it to what played out in Brazil. Almost as if the Modi government picked up
Bolsonaro’s playbook. For years, the Indian government too has been talking
about the traceability of messages to curb the spread of misinformation; both
WhatsApp and the Indian government have had arguments in a few courts as
well.

Facebook, on its part, got busy protecting itself. Over the last one year, both
WhatsApp and Facebook have spent enough and more resources in Brazil to
build public opinion on the traceability aspect of the fake news bill and how it
would lead to the end of their right to privacy. Last July,
it commissioned studies asking Brazilians what they thought of the traceability
idea and published the results. It put up an FAQ explaining how the threat of
traceability in Brazil will erode privacy. WhatsApp’s playbook
for countering the Indian government is similar to how it approached the Brazil
issue. With one huge difference. In India, the company went to court yesterday.
Something that it rarely does.

***