WhatsApp goes to court against India's IT rules 'undermining privacy'

Requiring messaging apps to trace chats is asking us to keep a fingerprint of every single message: Company.

WhatsApp on Tuesday filed a legal challenge against the Indian government, protesting before the Delhi High Court new IT rules that would require messaging services to trace the origin of particular messages.

“Requiring messaging apps to “trace” chats is the equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp, which would break end-to-end encryption and fundamentally undermines people’s right to privacy," said a WhatsApp spokesperson.

"We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the Government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,” said the spokesperson. 

Under the recently notified Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, social media intermediaries with more than 5 million users and providing messaging services will have to enable identification of the first originator of problematic content that may harm the country's interests and several other provisions described in the Rules. 

The social media intermediary will have to do this in response to a judicial order passed by a court or by a competent authority under section 69 of the IT Act.

"Provided also that where the first originator of any information on the computer resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator of the information for the purpose of this clause," say the rule. 

WhatsApp, which is owned by Facebook, has said before, that it will not break encryption as it undermines the privacy of its users. India is WhatsApp's largest market with over 400 million users.

“Traceability” violates user privacy and "by requiring private messaging services like WhatsApp to keep track of who-said-what and who-shared-what for billions of messages sent every day. Traceability requires messaging services to store information that can be used to ascertain the content of people’s messages, thereby breaking the very guarantees that end-to-end encryption provides.

In order to trace even one message, services would have to trace every message," said WhatsApp in a blog explaining why it opposes traceability. 

Privacy experts welcomed the move. "WhatsApp has done what every company must do if they care about end-to-end encryption and privacy. The IT rules notified by the government are unconstitutional. In the garb of addressing misinformation and regulating technology companies, GoI has been exceeding the powers granted through subordinate legislation and using it for political purposes as is evident from the recent Twitter fracas. This is exactly the reason why the Free and Open Source Software community challenged these rules in the Kerala High Court. Technology companies need regulation but not at the expense of user rights," said Mishi Choudhary, a technology lawyer with a law practice in New York and New Delhi.

The problem with traceability 

Encryption is the practice of scrambling data to make it unintelligible, even to service providers. It keeps conversations private but can be misused to spread fake news or for criminal activity. Technology and privacy experts have argued that breaking encryption is the first step towards government surveillance on its own citizens. 

Traceability, or identifying the originator of a message, would force companies like WhatsApp to collect and store details of billions of messages sent each day. It will require messaging platforms to collect more data than they need, only for the purpose of turning it over to law enforcement agencies.

Legal experts in India have argued that the traceability provision is unconstitutional in part because of a 2017 Supreme Court decision that held people have a fundamental right to privacy.

They have also said finding the first originator would not be an accurate way of identifying the information originator. People commonly see content on websites or social media platforms and then copy and paste them into chats. It would also be impossible to understand the context of how it was originally shared.

WhatsApp, along with others, opposed breaking end-to-end encryption in 2019 as well, when a previous version of the current government rules asked messaging services to do so.