Govt looks to break into encrypted messages

Suggested changes currently need production of a court order before a messaging intermediary is required to break encryption.

The Information Technology Intermediaries Guidelines (Amendment) Rules, 2018, the new set of rules on regulation of social media which the government is to submit to the Supreme Court later this month, will push for “traceability” of content which in effect means breaking end-to-end encryption, even of messaging intermediaries.

This will make it difficult for large social media intermediaries, mostly international business conglomerates, to give in without a battle.

The guidelines, which are not being discussed or debated publicly with only a few in the government privy to the details, are meant to control online content deemed “unlawful”. But these will raise fundamental questions on both freedom of speech and privacy of ordinary users.

Suggested changes currently need production of a court order before a messaging intermediary is required to break encryption.

The Indian Express has been told that there could be two levels of online intermediaries defined in the new set of rules, each with different regulations, for social and non-social media.

Non-social media may have relatively lighter regulations given that there could be mandatory local legal incorporation for large social media intermediaries. Non-social media intermediaries will still have to appoint a local office for grievance redressal.

On November 21 last year, Sanjay Dhotre, Minister of State for Electronics and Information Technology, in a written reply to a question in Rajya Sabha, confirmed that the Centre was going ahead with new amended rules for social media. He said social media companies have to follow certain due diligence as laid out in the Information Technology (Intermediary Guidelines) Rules, 2011 under Section 79 of the Information Technology Act.

The issue of messaging apps being required to break end-to-end encryption has been a sticky point between governments and messaging apps like Facebook-owned WhatsApp, especially after revelations last year on the use of spy software being used by governments to break into phones and conduct surveillance into private conversations of activists, journalists and lawyers, including in India.

The need to conduct surveillance for reasons of security versus the right to privacy of citizens and users has been a heated debate, and remains unresolved — the government appears to be pushing for more and intermediaries are insisting on greater transparency in the rules-framing process.

On December 24, 2018, The Indian Express reported that in the draft of The Information Technology Intermediaries Guidelines (Amendment) Rules, 2018, Rule 3 (9) required “intermediaries”, or online platforms, to deploy technology-based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying or removing or disabling access to unlawful information or content”.

It is now learnt that automatic proactive filtering for all unlawful content could be replaced by a “re-upload prevention” provision — it will prevent re-uploading of certain specific categories of content deemed illegal and taken down by platforms.

Social media intermediaries will still be required to provide user data within 72 hours in response to a government surveillance request, and have content-takedown timelines of 24 hours for content declared “unlawful”.