WhatsApp Challenges Govt IT Rules: All You Need to Know About End-to-End Encryption & Traceability

WhatsApp has filed a plea in Delhi High Court on Tuesday against the central government’s new IT Rules that would require the Facebook-owned messaging app to “trace” the origin of messages sent through the platform.

Confirming the development, a WhatsApp spokesperson told CNN-News18, “Requiring messaging apps to ‘trace’ chats is the equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp, which would break end-to-end encryption and fundamentally undermines people’s right to privacy.”

“We have consistently joined civil society and experts around the world in opposing requirements that would violate the privacy of our users. In the meantime, we will also continue to engage with the Government of India on practical solutions aimed at keeping people safe, including responding to valid legal requests for the information available to us,” the spokesperson added.

What is traceability and why does WhatsApp oppose it?

Some governments are seeking to force technology companies to find out who sent a particular message on private messaging services. This concept is called ‘traceability’.

Technology and privacy experts have determined that traceability breaks end-to-end encryption and would severely undermine the privacy of billions of people who communicate digitally.

Reasonable and proportionate regulations for an increasingly digital world are important, but eroding privacy for everyone, violating human rights, and putting innocent people at risk is not the solution.

WhatsApp says it is committed to doing all it can to protect the privacy of people’s personal messages, which is why they are opposing traceability.

WhatsApp argues that when the concept of “traceability” was first proposed in early 2019, dozens of organisations wrote to the Indian government about how such a provision would violate the privacy of the users.

Legal advisors to the government have argued the traceability requirement in the draft rules are not supported by Indian laws.

The IT rules published in February this year, in addition to seeking “traceability”, call for criminal penalties for non-compliance.

WhatsApp top brass felt it had no choice other than to seek the opinion of the court in the matter, sources revealed.

“We’ve also noticed that other parts of the Indian government have taken issue with the traceability requirement, as noted by these public records requests here. We have consistently opposed legal action that would break end-to-end encryption. For example, we are currently before the Supreme Court of Brazil on a similar matter,” sources familiar with the development added.

What is end-to-end encryption?

End-to-end encryption was designed to help ensure that nobody other than the person you are talking to can know that you sent a particular message. This is the exact opposite of traceability, which would reveal who sent what to whom.

Traceability would force private companies to collect and store who-said-what and who-shared-what for billions of messages sent each day. This will require platforms to collect more data than they need, solely for the purpose of turning it over to law enforcement agencies.

Traceability, as per WhatsApp, would not be effective in finding the originator of a particular message because people commonly see content on websites or social media platforms and then copy and paste them into chats. It would also be impossible to understand the context of how it was originally shared.

“We also do not believe traceability can be imposed in a way that cannot be spoofed or modified, leading to new ways for people to be framed for things they did not say or do. Such massive data collection also makes messaging platforms inherently less secure by opening up more avenues for hacking,” said sources in WhatsApp.

Social media firms operating in India will have to implement the new Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, which come into force from Wednesday.

These new guidelines were released in February, giving social media platforms including Facebook, Instagram, Twitter and Koo three months to comply.

The new IT Rules 2021 for digital media platforms include the requirement to appoint a resident grievance officer as part of a larger grievance redressal mechanism, active monitoring of content on the platform, monthly compliance reports for Indian users, self-regulation mechanisms and also an oversight mechanism created by the Ministry of Electronics and Information Technology.

(Aditya Raj Kaul is Contributing Editor, News18 group with more than a decade long experience in covering Conflict, Foreign Policy, and Internal Security. He can be reached at [email protected])

Read all the Latest News, Breaking News and Coronavirus News here. Follow us on Facebook, Twitter and Telegram.