Impact of the traceability provision on the privacy of Indian citizens

This blog post is first in series of “Encryption and human rights” series by SFLC.in.

The Ministry of Electronics and Information Technology (hereinafter “MeitY”) and the Ministry of Information and Broadcasting (hereinafter “MIB”) on 25.02.2021 notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (hereinafter “Rules, 2021”). The Intermediary Guidelines replace the Information Technology (Intermediaries Guidelines) Rules, 2011 (hereinafter, “Rules 2011”).

Amongst various other controversial provisions, one of the provisions is the “traceability or the originator” provision. It requires significant social media intermediaries, which is a new class created under the 2021 Rules, to trace the first originator of a message. This provision would be applicable on tech companies like Facebook, Signal, WhatsApp, Telegram, Instagram. In addition to this, via Rule 6, the intermediaries with less than a user base of 50 lakh users would have to comply with Rule 4 or any of its provisions. In this blog post, we talk about the potential impact the traceability provision could have on the privacy of Indian citizens.

1. What is the traceability provision?

   Rule 4(2) of the Rules 2021, mandates a ‘significant social media intermediary’ providing services primarily in the nature of messaging to enable identification of the first originator of the information on a computer source, as required by a judicial order or an order passed under S. 69 of the Information Technology Act, 2000 (hereinafter “the Act” or “the parent Act”) per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009.

   Further, the purpose for which such an order can be passed has also been specified to include offences related to, inter alia, the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material.

   One of the provisos to the Rule states that if the first originator of an information is not based in India then the first originator of that information in India would be deemed as the originator of that information.

   Applicability to other intermediaries

   In an effort to further expand the scope of their applicability, Rule 6 of the Rules 2021 mandates that MeitY can order any intermediary other than a significant social media intermediary to comply with obligations as under Rule 4 in the event that the services of such an intermediary transmits information that can create material risk of harm to the sovereignty and integrity or India, security of the State, friendly relations with foreign States or public order. However, the same is to be done by providing reasons in writing.

   This means that services with a user base of less than 50 lakh such as Matrix, Diaspora may be required to fulfill the obligations of Significant Social Media Intermediaries under Rule 4.

2. Impact of the traceability provision on privacy of Indian citizens

   The traceability provision, has bypassed legislative scrutiny, and does not conform with the parent Act. The IT Act, 2000 and S. 69 do not talk about traceability. It has raised questions on the fundamental right to free speech, and privacy of Indian citizens as well. The concerns associated with the fundamental right to privacy have been raised below.

   Privacy as an internationally recognized human right

   Privacy has been internationally recognized as a human right. Article 12 of the Universal Declaration of Human Rights as proclaimed by the United Nations states that “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, not to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”

   Article 17 of the International Covenant on Civil and Political Rights (hereinafter “the ICCPR”) declares privacy as human right as well. India is a signatory to both UDHR and ICCPR.

   Privacy as a fundamental right in India

   Privacy was unanimously recognized as a fundamental right in India by a 9-judge bench in 2017 in Justice K.S.Puttaswamy vs. Union of India ((2017) 10 SCC 1). The right to privacy judgment or the Puttaswamy I laid down a three pronged test to justify an intrusion into the fundamental right to privacy. The three-pronged test includes:

   i) legality i.e. there must be a law laid down by the state;

   ii) need i.e. the proposed action must be necessary in a democratic society for a legitimate state aim;

   iii) proportionality i.e. the extent of such interference must be proportionate to the need for the interference. There must be a rational nexus between the objects and the means adopted to achieve them.

   The IT Act, 2000 does not provide for traceability. It only talks about decryption under S. 69 of the Act.

   Similarly , the imposition of the traceability provision does not justify the necessity and proportionality principle. The Puttaswamy I judgment requires that there must be a guarantee against arbitrary state action. However, the traceability provision allows bypassing judicial scrutiny.

   As per the proportionality requirement, the intrusion must be through lesser intrusive/restrictive alternatives. However, the traceability provision is not a least intrusive means. One of the provisos to Rule 4(2) states that an order cannot be passed if there are ‘other less intrusive means’ to identify the first originator. However, the said proviso stands of little to no value as the phrase ‘less intrusive means’ find no definition/guidance within the Rules, thereby rendering the proviso unclear and ambiguous.

   The final proviso to Rule 4(2) states that on account of the first originator being located outside India’s territory, the ‘first originator of that information within the territory of India’ is deemed the first originator of the information. This proviso, in effect, forces social media intermediaries to ensure access to users’ entire chain of metadata communication, and is by no means least intrusive.

   What does the UN’s Rapporteur say?

   Three UN Rapporteur recently published a document expressing concerns about the Rules, 2021.ⁱ According to the Rapporteur, the traceability provision will impact the right to privacy of every internet user. It has also emphasized on the concerns arising from the executive orders to access user data, and the ineffective procedural safeguards.

3. How will the traceability provision impact privacy of Indian citizens?

   a. Privacy of communications

   End-to-end encrypted services provide a secure channel to citizens to communicate freely without the fear of being watched by a third party or state surveillance. The traceability provision will lead to self-censorship as users will fear being watched, and hence, will be restrained in their communications. This is also an impingement of their right to privacy.

   Naturally, the right privacy and right to free speech and expression are inextricably intertwined. End-to-end encrypted services provide a safe space to users to exercise their right to free speech.

   Encrypted communications allow citizens to share their opinions and information without fear of surveillance or unwarranted intrusion. They also ensure that communications related to trade secrets, privileged communications, commercial and financial communications are far from prying eyes.

   b. Unnecessary state intrusion with inadequate procedural safeguards

   The traceability provision refers to S. 69, IT Act, 2000 for a traceability request. However, S. 69 has been criticised for its opacity and lack of judicial scrutiny. While Rule 4(2) seeks to mandate the identification of first originators, the provision is bereft of any procedural guidance on the same. This vests enormous discretion in the hands of law enforcement agencies to employ wide-ranging means to elicit such information.

   The provision does not stipulate a threshold of “virality” of a message to be traced. It also fails to provide a time-period or a sunrise date from which companies would be required to trace a message.

   c. Possible closure of encrypted platforms like Signal and federated FOSS platforms like Matrix

   There is also a likelihood that end-to-end encrypted platforms like Signal will be banned or will leave India than modify their technical infrastructure to enable traceability. This will lead to lack of safer encrypted alternatives for Indian citizens to exercise their right to privacy and freedom of speech and expression.

   d. Chilling effect on fundamental right to free speech

   One tends to behave differently when under the watchful eye of an entity with power, in this case, the entity being the State. Constant monitoring of the flow of information gives rise to the chilling effect on free speech. The chilling effect includes fear in whistle blowers to share information, to carry out confidential conversations with sources by journalists. This is particularly pervasive in sensitive areas where journalists are constantly targeted for their reporting.

   Encryption helps ensure anonymity without the fear of company hosting such services leaking crucial information to the government. The Intermediary Rules, 2021 have worsened the situation by legitimizing surveillance on end-to-end encrypted communications and forcing companies to comply with such requests by government.

   e. Enables several sections like journalists, activists to exercise right to dissent without fear of surveillance

   End-to-end encrypted platforms are particularly popular amongst journalists, activists, whistle-blowers, and civil society organizations, to communicate without state eavesdropping. The traceability provision takes away that sense of security, and also compromises the privacy of journalistic sources, whistle-blowers as well as private secure communications.

As of the date of writing, the traceability is facing legal challenges in various Indian courts. There are four cases dealing with the traceability provision in the Kerala High Court, Delhi High Court, and the Supreme Court of India. You can read about the legal challenges here.

You can read more about the traceability provision here.