Censorship & privacy worries over new draft IT rules

Internet activists and cyber experts are raising concerns of surveillance and online censorship after reports suggest that the Centre is planning to amend cyber laws to make it mandatory for online platforms to trace the origin of “unlawful content” which will require platforms to break end-to-end encryption of data, including WhatsApp messages.

The five-page draft rules were alluded to in a report by the Indian Express on Monday which claimed that a one hour “confidential” meeting was held on Friday between representatives of Google, Facebook, WhatsApp, Amazon, Yahoo, Twitter, ShareChat, SEBI and The Internet Service Providers Association of India and an official of the Ministry of Electronics and Information Technology (MeitY) with others from the Cyber Law Division. The online platforms have been given a January 7 deadline to respond to the proposal.

The draft rules have since then been posted online, a copy of which has been attached below.

What are the rule changes?
The changes to the rules deal with Section 79 of the Information Technology (IT) Act and require internet platforms to:

• “deploy technology based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying or removing or disabling access to unlawful information or content”.
• a new Rule 3(4) activates a pro-active monthly notification across intermediaries to warn users repeatedly.
• Rule 3(5), which will introduce a “traceability requirement”, will in effect require a platform to break end-to-end encryption and introduce systems for retaining data and information specific to each bit of data, including WhatsApp messages.
• Internet platforms and providers will be liable to help the government “within 72 hours” of a query and would need to appoint a ‘Nodal person of Contact.for 24X7 coordination with law enforcement agencies and officers to ensure compliance”
• Increases data retention time from 90-180 days.

What do activists say about the rule changes?
DH reached out to experts such as Aapar Gupta, lawyer and co-founder of The Internet Freedom Foundation who put out a statement after publication of the news story by IE in which they outlined their concerns around the implications of the order relating to non-participatory decision making and around government related surveillance and online censorship.

On online censorship, he refers to Draft Rule 3(9) which requires “technology based automated tools or appropriate mechanisms to proactively identifying or removing or disabling access to unlawful information or content,” and says that this may as well be a sledgehammer to online free speech.

He reasons that this appears to be a U-turn of the Shreya Singhal judgement that had in 2015 struck down Section 66A of the IT Act, thus disallowing the arrest of those allegedly posting offensive content online. Significantly, the judgement had noted that: “it would be very difficult for intermediaries like Google, Facebook etc. to act when millions of requests are made and the intermediary is then to judge as to which of such requests are legitimate and which are not.”

However, according to the new rule, the government deflects its responsibility, thus "requiring online platforms to become pro-active arbiters and judges of legality." "Placing such a requirement for a platform to obtain immunity from prosecution and actively sweep its platform would result in widespread takedowns without any legal process or natural justice, warns the statement.

Furthermore, the new rule, he argues, is similar to the China-based AI censorship which has been shown to be faulty & has coding biases besides being prone to overbroad censorship. Gupta also stated that there are better ways to check misinformation and threats to Indian elections which can be achieved as per our fundamental rights guaranteed under the Constitution.

Srinivas Kodali, an interdisciplinary researcher working on issues of data and internet also spoke to DH over the phone as he expressed concerns about the government amending the rules to carry out surveillance on its political rivals.

‘The issue is that they are not inviting any consultation with all the stakeholders such as the members of the civil society or even with other political parties such as the opposition when these rules will affect everyone in the country. The concerns of snooping on political opponents such as the opposition is also valid considering what has been happening in Telangana and Andhra Pradesh where the Chief Minister of Andhra Pradesh, Mr Chandrababu Naidu’s phone was tapped back in 2015. In fact, even Finance Minister, Mr Arun Jaitley’s call data records were accessed because some random policeman could access it. Therefore, giving access to everyone and anybody is making us almost into a surveillance state,” said Kodali.

Kodali also said that the proposed rule changes would be violative of the recently declared right to privacy.

Govt. calls concerns 'objectionable'
"This is being done in the backdrop of mob lynching incidents that saw the killing of innocent people on the basis of rumours,” anonymous official sources told NDTV.

Terming the concerns of activists as 'objectionable', it added: "The limited goal is to identify source of the rumour-mongering in order to stop mob lynching. This year, such demands were raised in different quarters after increasing incidents of mob lynching due to child kidnapping rumours were spread on social media and specifically on WhatsApp."

PIL against government December 20 ‘snooping order’
The government’s draft rules come after a December 20 notification which allowed 10 government agencies to intercept or decrypt any data or information from computers of citizens. On Monday, the rules were challenged in a PIL filed in the Supreme Court which sought for quashing of the order.

"The impugned order has been issued to find political opponents, thinkers and speakers to control the entire country under the dictatorship to win coming general elections through an undeclared emergency, which can't be permitted under the Constitution," his petition stated.

The petitioner stated that the notification -- a blanket surveillance order -- must be tested on the principle of the right to privacy as a fundamental right declared by the nine-judge Constitution bench.