India and the world want social media companies to do more for the “safe haven”
With India tightening the loop of regulatory compliance around social media platforms, there have been concerns about watering down the Safe Harbor provision in the country’s IT regulations.
Safe Harbor means immunity for social media companies in the event that content transmitted through their platforms violates local laws. Facebook, Twitter, Instagram, YouTube, and a host of other social media platforms enjoy such immunity as several jurisdictions, including India, recognize that, like bookstore owners, these platforms are mere channels not responsible for the content of the books should be drawn to their store.
But in the digital economy, various countries that want to curb the spread of misinformation and hate speech require social media platforms to meet certain conditions in order to enjoy their safe haven. A cross-border condition is that these platforms should remove “illegal” content after they have received actual knowledge of it in a notification from courts or law enforcement authorities (LEAs). India’s new IT rules significantly expand these conditions. They require major social media intermediaries – social media platforms with over 5 million users – to identify the first author of information that the government believes threatens the sovereignty and integrity of India. Legal experts have indicated that the formulation of these rules is too broad and could mean a lot. There is also concern about what the government is treating as fake news or illegal content, as evidenced by recent events such as crackdown on young “toolkit” activists.
WhatsApp said that in order to identify the first author, it would have to crack the end-to-end encryption (E2E) on its platform. Tech experts agree. E2E is the linchpin of WhatsApp, Signal and Telegram’s claims to protect user privacy. That means no one, not even WhatsApp, can read your messages. In order to comply with the new standards, however, “hashed” data about the sender of each message would have to be stored. The new rules therefore require platforms to store more user data, which undermines the principle of data minimization.
“Law and order, when threatened, everyone cooperates. Companies resist waving their hand and demand data without legal support. We need to work on better metadata analysis techniques that can give us all the information and more for investigation. It’s the extrajudicial requests that should be resisted. Section 69 and Rule 4 (2) create an opaque, executive-controlled dark hole, ”said Mishi Choudhary, Founder and Legal Director of Software Freedom Law Center in India (sflc.in).
The world wants more compliance from social media companies
India is not the first country to seek backdoor access to these E2E-enabled messaging platforms. The US has been discussing laws in recent years aimed at imposing similar conditions on social media companies in order to keep them safe havens. One such bill aims to give US LEAs the right to access digital messages without a warrant. It also aims to announce a broad category of “best practices” that social media platforms are expected to follow in order to enjoy their safe haven. The US Parliament did not pass the bill, despite the fact that former President Donald Trump also sought to change the liability rules for intermediaries during his tenure.
Should WhatsApp have to comply with the new IT rules in India, it would have to change its existing architecture and store more data. Again, before India ratifies the Personal Data Protection Act in 2019.
If Facebook’s own messaging platform warps in India – the world’s second largest internet market with over 700 million users – it may have to agree to similar rules in other jurisdictions as well. Brazil also wants the traceability of users on WhatsApp. The European Union (EU) wants platforms to proactively monitor and remove objectionable content. The member states Germany and France have already made progress on this front.
There are some similarities between the rules for intermediaries in India and those provided in the EU.
Rules don’t differentiate between WhatsApp & Signal
India classifies social media platforms with over 5 million users as “significant social media intermediaries” who, in addition to identifying the first author, must also appoint a resident complaints officer, chief compliance officer and a Nodal contact person for 24×7 coordination with Indian LEAs. The rules also require these larger platforms to have an office in India.
India has a much wider network than the EU, the latter suggesting additional compliance only for very large platforms with 45 million monthly users. The rules in the EU have yet to be approved.
“Such requirements for larger platforms can deter domestic startups from expanding their business beyond the stated user limit and pose a challenge to the country’s macroeconomic progress,” said Kazim Rizvi, founding director of The Dialogue, a think tank for research and public policy . Europe has raised similar concerns, with domain experts believing that the benefits of the established platforms of very large platforms are likely to increase.
“These rules put a damper on platforms based on the Free and Open Source Software (FOSS) movement. India’s IT rules do not differentiate between for-profit companies like WhatsApp and platforms like Signal, which was developed by an American non-profit organization, ”added Mishi of sflc.in.
Sflc.in supported FOSS developer Praveen Arimbrathodiyil in challenging parts of the new IT rules in the Kerala High Court. The petitioners have argued that the regulations place a burden of compliance on FOSS companies or services and affect their right to trade.
The new regulations would also have an impact on competition in the industry. Social media giants like Facebook, Twitter and WhatsApp have the tools to appoint more civil servants in India and also store more data for traceability. Smaller and upcoming platforms like Signal don’t do this. Platforms that cannot adhere to the new rules could lose their safe haven as social media intermediaries in India. In this scenario, if a message on Signal violates local law, government agencies could book not only the sender or “originator” of that message, but even the platform and its employees.
“India’s Competition Commission would tell you this is a bad provision,” joked one legal expert.
While various companies that will be affected by the new rules have expressed their willingness to comply, Signal has suspended media interactions in India until further notice.