India's new IT rules include a traceability clause that requires social media platforms to locate the "the first originator of the information” if required by authorities. Why is WhatsApp fighting this clause?
Facebook-owned messaging platform WhatsApp is taking the Indian government to court over the traceability clause in the new IT Rules 2021. WhatsApp’s lawsuit has been filed in the Delhi High Court on May 26, the last day to comply with the new rules.
The new IT rules include a traceability clause that requires social media platforms to locate the “the first originator of the information” if required by authorities.
It should be noted that this rule will impact most messaging apps such as Signal, Telegram, Snapchat, Wire and others. Signal and Telegram have recently gained popularity in the market. Signal is completely end-to-end encrypted (E2E) and, in fact, WhatsApp relies on the Signal protocol for its own encryption.
But given WhatsApp has close to 450 million users in India, the impact of this rule will definitely be significant on the platform.
Newsletter | Click to get the day’s best explainers in your inbox
We explain why WhatsApp is fighting this clause.
What does WhatsApp’s lawsuit state?
As reported by indianexpress.com, WhatsApp is invoking the 2017 Justice K S Puttaswamy vs Union Of India case to argue that the traceability provision is unconstitutional and against people’s fundamental right to privacy as underlined by the Supreme Court decision. The plea states that the court should declare the traceability clause as “unconstitutional” and should not allow it to come into force. It is also challenging the clause which puts “criminal liability” on its employees for non compliance, it is learnt.
What has WhatsApp said about ‘traceability’?
The company has issued a detailed blog post explaining why traceability will not work. A WhatsApp spokesperson said that the requirement to ‘trace’ chats would be the “equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp.” This would mean that the platform will have to break end-to-end encryption, which is turned on by default for all messages.
Traceability would mean re-engineering the app just for the Indian market, which is unlikely to happen. End-to-end encryption ensures that no third-party, not even the messaging app itself can track or read messages.
“We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the Government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,” a spokesperson said in a statement.
In the blog post, WhatsApp says it is all for “reasonable and proportionate regulations”, but cannot support “eroding privacy for everyone, violating human rights, and putting innocent people at risk.”
Why is WhatsApp against finding the originator of a message?
End-to-end encryption ensures that no one can read the message, except for the sender and the receiver. This includes WhatsApp itself. Nor does the app keep a log of who is sending what message and to whom.
And given it cannot read the contents of a message, finding the originator is even harder. Further many of the messages are just copied or forwarded by users.
WhatsApp says that if it had to trace an originator, then it would have to “store information”. The argument is tracing even one message means tracing every single message on the platform.
In order to trace messages, WhatsApp will have to add some sort of “permanent identity stamp” or effectively ‘fingerprint’ each message, which it says will be like a mass surveillance program.
📣 JOIN NOW 📣: The Express Explained Telegram Channel
But why can’t WhatsApp impose traceability? What is the harm, even if it has to rely on ‘fingerprinting’ techniques?
WhatsApp’s argument is that traceability, even if enforced, is not foolproof and could lead to human rights violations.
Further, they will have to “turn over the names of people who shared something even if they did not create it, shared it out of concern, or sent it to check its accuracy.”
In its blog post, it notes that “innocent people could get caught up in investigations, or even go to jail, for sharing content that later becomes problematic in the eyes of a government.” It also adds that such an approach will violate “recognised principles of free expression and human rights.”
Internet experts have also argued against digital fingerprinting techniques to achieve traceability, cautioning these can be easily impersonated. In an earlier interview to indianexpress.com, Rajnesh Singh – Regional Vice President Asia-Pacific at the Internet Society had said that these techniques are not “absolute,” and warned that “innocent users could get implicated for activities carried out by cyber criminals who might use more sophisticated techniques to impersonate a sender.”
Experts are clear that fingerprinting techniques are open to abuse, and in the end will undermine encryption entirely. Apps would have to remove encryption in order to implement such digital signatures on messages.
The post says in order “to trace even one message, services would have to trace every message”, because “there is no way to predict which message a government would want to investigate in the future”. “In doing so, a government that chooses to mandate traceability is effectively mandating a new form of mass surveillance. To comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp — like a fingerprint — to private messages with friends, family, colleagues, doctors, and businesses,” it says, explaining that this would mean companies would be “collecting more information about their users at a time when people want companies to have less information about them”.
What is WhatsApp’s argument on why traceability won’t work?
WhatsApp too states that tracing messages will be “ineffective and highly susceptible to abuse.”
“If you simply downloaded an image and shared it, took a screenshot and resent it, or sent an article on WhatsApp that someone emailed you, you would be determined to be the originator of that content,” notes the blog post.
Further, they state “traceability” goes against the basic principles of how law enforcement and investigations work. “In a typical law enforcement request, a government requests technology companies provide account information about a known individual’s account. With traceability, a government would provide a technology company a piece of content and ask who sent it first,” explains the blog post.
Can WhatsApp help law enforcement without traceability?
WhatsApp says it has a dedicated team, which “reviews and responds to valid law enforcement requests.” It says it has always responded to “valid requests by providing the limited categories of information available to us, consistent with applicable law and policy.” It also notes that they have a “team devoted to assisting law enforcement 24/7 with emergencies involving imminent harm or risk of death or serious physical injury.”
Source: Read Full Article