The latest draft of amendments to the Information Technology Act will “require proactive monitoring to a very limited extent” and will require companies like WhatsApp to provide metadata to the government without breaking platform encryption, said a senior IT official overseeing the draft process.
“Any proactive monitoring that we are looking for is technically feasible within the encrypted environment,” the source said. “We are not asking for decryption at all. Otherwise, the whole thing will go. This is wrongly being conveyed in the court that we are demanding decryption. Metadata is not encrypted, and so, metadata that is relevant and as required by the government should be provided. That’s a government’s right to know.”
The official added that no further consultations regarding the proposed amendments to rules under Section 79 of the Information Technology (IT) Act will take place, unless required by Union and IT Minister Ravi Shankar Prasad.
The previous draft, publicly released for consultation in December 2018, stated: “The Intermediary shall deploy technology based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.” It added an intermediary requirement to enable tracing who originally sent forwarded information.
After the draft release in December, WhatsApp had stated these amendments would require the company to “re-architect our systems leading to a different product” and to collect far more data than they do already. WhatsApp did not respond to questions.
“Privacy is not absolute,” the official said. “The supreme court has said it is a fundamental right but not an absolute right. In those cases, in which your privacy can be breached, the government has the right and should have the right only in those exceptions — which is not about breaking encryption, but which is still about getting metadata of the message.”
WhatsApp currently collects “meta-data,” including your display pictures, profile name, and phone number. As an encrypted platform, the company cannot see the content of messages.
The official said the meta-data monitoring will be required in cases of “extremist content, child porngraphy, or in cases which will lead to a lynching or the disruption of public order.”
The Ministry submitted an affidavit in the Supreme Court on Monday stating that it will take another three months to notify rules regulating intermediaries such as Facebook and WhatsApp. The Court had asked the Ministry on September 24 about its status in an ongoing case between WhatsApp-owner Facebook and the Union of India. The draft rules will be approved by Secretary Ajay Prakash Sawhney and then the Minister before being notified.
The senior IT official also said that the Ministry met with the Ministry of Information and Broadcasting on Tuesday to discuss designated ministerial responsibilities after I&B minister Prakash Javadekar earlier this month called for more content regulation of over-the-top (OTT) platforms such as Netflix and Hotstar.
“These rules have an impact on everybody,” the official said. “My start-up ecosystem should not get impacted. My big companies always have big muscle power and big ability to convince media and to convince government and to convince every political leader. They play either directly or through proxy or whatever. Then of course, there is a third section of society that wants the Internet to be completely free. Then, the law enforcement bodies who feel as and when crime is being committed they should be able to get the information right in time. It’s all about making a balance. That’s why it is taking time.”
The Court also decided on Tuesday to accept Facebook’s petition and take up all ongoing cases in three high courts about linking Aadhaar and social media accounts.
The question of WhatsApp traceability has come up most significantly in the Madras High Court case, where IIT Madras Computer Science and Engineering Professor V. Kamakoti was directed to submit a technical report detailing how the originator information of a WhatsApp message could be traced without breaking encryption.