Last week, Meta-owned messaging app WhatsApp told the Delhi High Court that it would have to cease operations in India if it’s forced to break encryption for compliance with India’s Information Technology (IT) Rules, 2021. These rules, which have traceability requirements to identify “first originator” of messages, were challenged in the court by WhatsApp in 2021 shortly after being notified.
What is end-to-end encryption?
In an end-to-end encryption app like WhatsApp, Telegram or Signal, any message sent is encrypted on the device before flowing through the internet to the receiver, on whose device it is decrypted. This way only the sender and the receiver can read the messages. While this is important from a user privacy perspective, government authorities and agencies in several jurisdictions across the world have, from time to time, sought a backdoor into this encryption for law enforcement purposes.
What do the IT rules say?
In February 2021, the Indian government brought out the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules. These rules mandated ‘significant’ social media intermediaries such as WhatsApp, X (formerly Twitter), Facebook, Instagram to enable traceability for law enforcement purposes. Any social media intermediary having more than 5 million users in India is tagged as ‘significant’ for the purpose of these rules.
What is WhatsApp’s argument against this?
WhatsApp argued that the requirement to disclose user data violates privacy rights and claimed that this rule was introduced without prior consultation. Breaking encryption on its platform, the company argued, would infringe upon users' fundamental right to privacy and consequently, WhatsApp is seeking judicial intervention to challenge the rule as unconstitutional.
Tejas Karia, counsel for WhatsApp, stated before a division bench comprising acting Chief Justice Manmohan and Justice Manmeet Pritam Singh Arora, "As a platform, we are saying, if we are compelled to break encryption, then WhatsApp will cease its operations."
In 2021, WhatsApp had flagged that in mandating traceability, “a government…is effectively mandating a new form of mass surveillance.”
“To comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp — like a fingerprint — to private messages with friends, family, colleagues, doctors, and businesses,” it had argued earlier.
What is the government's stance?
The central government has informed the Delhi High Court that WhatsApp and its parent company Meta, which monetises user information for business purposes, cannot legitimately claim to protect privacy.
The Ministry of Electronics and Information Technology (MeitY) argued this stance in an affidavit opposing WhatsApp and Meta's petition, stating that WhatsApp has already violated users' fundamental rights in India by denying them any dispute resolution rights within the country.
MeitY also emphasised that non-compliance with these rules could hinder law enforcement agencies' ability to track fake messages, potentially leading to societal unrest.
The Centre seeking traceability from messaging apps is also not a new phenomenon. More than a decade ago, Canadian smartphone maker Research in Motion (RIM) had engaged in a four-year standoff over providing encryption keys for its secure corporate emails and messenger services for users of its Blackberry devices.
