‘New IT rules give the government disproportionate control over the internet’

Image for representational purpose only. Photo: istock

On May 25, a day before it was required to comply with the new IT Act, 2021, WhatsApp sued the Government of India (GoI). The messaging app argued that the new IT intermediary guidelines - effective May 26 - would result in them having to break end-to-end encryption and thus infringe upon the fundamental right of privacy and free speech. The Centre's new rules demand that significant social media platforms provide traceability of the first originator of unlawful messages.

The Indian government's new IT rules, which it says would be applicable only in ‘prevention, investigation or punishment of very serious offences' dealing with the security of the state or in ‘offences in relation with rape, sexually explicit material or child sexual abuse material', extend to various platforms including Twitter and Google.

In another case versus the Indian government in the Delhi High Court, WhatsApp is defending its own privacy policy update of 2021, which requires its users to allow their data in business messages to be shared with the app's parent company Facebook. The Centre opposed this change on the grounds of "violation of informational privacy". These legal tussles have brought to the surface various holes in internet privacy and freedom in the country.

Nikhil Pahwa, founder, Medianama and a digital rights activist has been actively involved in the discussions around technology policy, censorship and internet privacy in India. He is also the founder of Save The Internet, now known as Internet Freedom Foundation, which works on the web being open to all. Mid-day reached out to Pahwa to understand how important WhatsApp's concerns were, why it is important to have end-to-end encryption, and the basics of user privacy in the digital space. He also delves into his concerns about privacy in India, and how policy-making can help in the process.

Here are edited excerpts:

WhatsApp recently sued the Government of India and user privacy is at the centre of it all. How valid are their concerns and how strong is their case?
People have a different expectation of privacy when it comes to WhatsApp compared to otherwise. Now, it is not very popular from the privacy perspective in India and there are concerns about the app sharing data of users engaging with businesses on WhatsApp with Facebook.

However, it is an important case because WhatsApp is protecting its users and thus the Signal protocol, and Signal as an application is even more private than WhatsApp. These guidelines will impact WhatsApp and Signal equally. This will also impact Microsoft Teams, when it rolls out cloud with encryption. Sometime last year, the US, UK, Canada, Australia, New Zealand wrote a letter to Mark Zuckerberg not to roll out end-to-end encryption.

So, this case is going to be watched closely by these governments because they are contesting end-to-end encryption.

How does compromising the end-to-end encryption threaten the privacy of a user?
There is encryption and then end-to-end encryption. The latter will ensure that platforms like WhatsApp will not know that one has sent me a message. It is one of the most widely used encryptions today and very effective and without it, users will not get the protection they currently get with WhatsApp today.

From a user perspective, how can one become more aware of their privacy in digital spaces?
While it is a very broad area, people can start with checking the permissions they give to an application when they are downloading it. Especially on Android, they are able to restrict when the app is able to collect data. It is important to also keep their GPS location off at all times. Since Android allows you to control which permissions you give to which applications, so users need to restrict them from collecting data they don't want to give.

It is also important to be cautious about which applications are being downloaded. People tend to download applications without thinking how much data the application will be collecting. They also let applications remain on their devices even though they aren't using them.

It is important for them to be conscious and cautious about data. They also tend to use applications which are not encrypted and they tend to treat all messaging applications as equal. The most private application that exists today is Signal and in addition people can also make use of VPNs (Virtual Private Networks) because otherwise ISPs (Internet Service Providers) can monitor what you are accessing on the internet. So, the VPNs can help restrict the amount of data they can view about your internet usage.

However, it is still very difficult to protect yourself from the operation system of the device you are using and Android has its own issues with privacy.

As a digital rights activist in India, what are some of your major concerns with privacy in India today?
My primary concern is that we don't have a privacy bill to protect us. Secondly, we also haven't had surveillance reform in India, so there is very little restriction with government surveillance in the country. Our intelligence agencies are currently not governed by the parliament or a law in the parliament. These are all serious concerns that impact us more.

Let's not forget that the Government of India in the Supreme Court argued against a fundamental right to privacy, which they lost.

What would be a fair way for the government to approach policy making for social media?
The problem with the new IT rules is that they are not adequately backed by law and they go beyond what the IT Act allows the government to do. These rules also give the government disproportionate control over the internet and allows them to censor and restrict our speech and violate our privacy. So, I think these are serious concerns that courts must get into.

How does the country fare in the context of online privacy and free speech versus the rest of the world?
While I cannot comment about how our country fares because the rest of the world is a very broad space with different countries which do things differently.

However, I can say that we are in an environment where internet freedom has been declining every year. There is a disproportionate amount of control that our government is able to exert on our freedoms online whether you look at internet shutdowns or the lack of a privacy law. So, when it comes to our freedoms online, our governments need to do a better job.

Also Read: Director Faraz Arif Ansari lists nine must-watch LGBTQIA+ films