WhatsApp’s case against the government hinges on two key questions

Picture for representation

What just happened might be a great irony. Facebook-owned WhatsApp — arguably the twin entities most responsible for erosion of privacy across the world today — has surprisingly turned into a champion of Indians’ privacy rights.

On May 26, it filed a case in the Delhi High Court, arguing that a rule framed by the Indian government requiring it to identify the “first originator” of messages would violate Indians’ fundamental right to privacy under Articles 14, 19 and 21 of the Constitution, as upheld by the Supreme Court in 2017.

Also Read: New rules designed to prevent misuse of social media; WhatsApp users have nothing to fear: Ravi Shankar Prasad

Personal Data Protection Bill: New WhatsApp Privacy policy case is reminder that India needs to enact the law

WhatsApp adamant about new user policy but won't limit user functionality

WhatsApp sues Indian govt, says new IT rules will end privacy

WhatsApp is at the centre of two similar cases in Brazil in which the constitutional right to privacy is being debated. But it did not initially invoke privacy rights. It only brought the cases to fight nationwide bans on the platform ordered by multiple courts for not letting law enforcement access some messages. So, for Mark Zuckerberg to stand up for privacy rights of users anywhere in the world, while his platforms systematically bilk billions of users’ data, is a moment not devoid of significance.

The Indian government in February framed a set of rules — called Intermediary Guidelines and Digital Media Ethics Code — for social media that gives it extraordinary control of the platforms. Many believe the rules were designed to stifle free speech, and are among the harshest anywhere in the world.

While many of the rules could be challenged, WhatsApp has zeroed in on one that mandates encrypted platforms, such as WhatsApp, Telegram and Signal, to create a system to “trace” the “first originator” in India of any message. In the event a piece of content was created by a user outside India, the rule requires the messaging platforms to identify the first Indian user who “forwarded” it.

India is not the only government that hates encryption technologies. Governments in the UK, US or Australia continue to demand “backdoor” access to messages, or mull legislation that can secure such privileged access. In comparison, the Indian government’s demand is limited to identifying the “first originator.” But it chose to frame its final rules under existing legislation, rather than seek fresh parliamentary approval, in itself a move that raises questions, considering the importance of the provisions.

The Indian government’s rules have also come after years of public, inconclusive, sparring with tech platforms. The government, aided by at least one tech expert, argues that tracking the origin of a message is not the equivalent of breaking encryption and accessing the content of private messages. V. Kamakoti, a computer science professor at the Indian Institute of Technology in Chennai, has testified before the Madras High Court that tracking the origin of messages would leave intact “end-to-end encryption” on WhatsApp. But most other experts and WhatsApp contend that the messages would not be protected once code is deployed to track messages.

“Requiring messaging apps to 'trace' chats is the equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp, which would break end-to-end encryption,” a spokesman for WhatsApp said Wednesday after its lawsuit was filed in the Delhi High Court.

What Happens Now?

WhatsApp case will be first heard by the Delhi High Court. The court could stay the rule while it hears the case. But eventually it is likely to go to the highest court of the land because there are quite a few unresolved issues, including the most obvious one: no fundamental right, including that of privacy, is absolute, and reasonable curbs can be imposed by the government.

In the 2017 Puttaswamy case, the nine-judge bench that declared privacy to be a fundamental right was hearing a case challenging the Aadhaar framework, not issues related to the internet. Consequently, it did not consider, for example, end-to-end encryption. The question of “proportionality” of any restriction to the fundamental right to privacy remains in question and additionally needs to be adjudicated now. This is because, a platform needs to be built with certain technologies and capabilities and cannot be amended on the fly to, say, selectively track or access a message based on a specific case.

Key Questions

The WhatsApp case will likely hinge on two key questions. One, can the messaging platform be run in compliance with the government’s rules on message tracing without breaking end-to-end encryption that currently is at the heart of user privacy? In the event it can be run on those lines, the outcome is simple.

In the event technology does not permit such compliance, the court will need to rule on this question: Can a government rule forcing WhatsApp to use technology that permits tracing of messages be tantamount to a constitutional violation of an individual’s right to privacy?

The answers to these questions will settle the issue.