A (very) short explainer on the new IT Rules & Traceability provision

NOTE: We don't inhabit a fragmented reality. Nothing around us can be isolated from the catastrophic effects of the pandemic we're witnessing. All further posts on this blog will carry this caveat until there is some reasonable accountability established and substantial actions taken against the state's criminal abdication of responsibility.

1. What are the new IT Rules 2021?

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 are rules laid down by Ministry of electronics and Information technology in exercise of the powers conferred to it by IT Act, 2000 regarding regulation of social media intermediaries, OTT platforms and online news aggregators.

2. Why have these rules been in news?

It is because India, for the first time has given law enforcement agencies the statutory backing to legally mandate companies defined as ‘significant social media intermediary primarily in the nature of messaging’ to give out information about the ‘first originator’ of the information concerned. In other words, it is the first piece of legislation that legally demands certain intermediaries to break the end to end encryption technology built into their platforms to ‘trace’ the first originator.

3. What is end to end encryption?

End to end encryption simply means that technology which enables any and all of the communication between two users over a platforms that support E2E to be securely encrypted so that nobody, not even the platform can access the contents of the conversation.

4. What is a significant social media intermediary?

A ‘significant social media intermediary’ is a social media intermediary with over 5 million users. A ‘social media intermediary’ means an intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information using its services’.

5. Who is a first originator?

An originator as defined in the IT act. 2000 is ‘a person who sends, generates, stores or transmits any electronic message or causes any electronic message to be sent, generated, stored or transmitted to any other person but does not include an intermediary’. Therefore ‘first originator’ is the first person who does the things envisioned in the definition.

6. What is the traceability provision in the rules?

Commonly called the ‘traceability provision’, section 4(2) of the Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021 says, ‘A significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009, which shall be supported with a copy of such information in electronic form’.

It further lists four conditions to be fulfilled for exercising powers under this section:

a) An order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years

b) That no order shall be passed in cases where other less intrusive means are effective in identifying the originator of the information

c) In complying with an order for identification of the first originator, no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users

d) Where the first originator of any information on the computer resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator of the information for the purpose of this clause.

The government or the relevant authority has a choice between securing a judicial order or an order under section 69, IT Act 2000 for exercising power under this provision.

7. Can the first originator be identified without breaking end to end encryption?

Most Lawyers and cyber security professionals say no.

8. Why has Whatsapp filed a case against the Indian government for enforcing IT rules?

Whatsapp recently filed a case against the Indian government for enforcing the IT rules, particularly the traceability provision. In the lawsuit it claims that the traceability provision is in violation of the right to privacy guaranteed under the Indian constitution under article 21 and confirmed by the Puttuswamy decision.