Limit requests for login/logout details to heinous cases: Meta to Delhi Police

At an interactive session held at Delhi Police headquarters on October 27, the Meta team is also learnt to have said that all requests for information must include a brief background of the case and explain the relevance of the information sought in connection with the alleged crime.

The session, to discuss various issues related to cyber crime and requisitioning of data by law enforcement agencies, was held in the presence of Special CP (Special Cell) Hargobinder Singh Dhaliwal. It was attended by all Deputy Commissioners of Police (DCPs) of districts and specialised units, along with Station House Officers (SHOs) of cyber police stations.

“The Meta officials asked the Delhi Police to not ask for login or logout details in every case. They emphasised that these details should preferably be sought only in cases of heinous nature or cases of significant gravity. They have also asked to limit requests for a substantial volume of data from social media intermediaries,” said a Delhi Police officer.

“After the interaction, it was also suggested that a cap should be put on the number of queries and quality requests be prioritised. They recommended that requests to WhatsApp should be directed to their corporate address in the United States,” the officer said.

“The Delhi Police asked about the types of IP addresses provided by WhatsApp in a case. On this, the concerned official informed that only the last seen IP address and the current IP address can be provided. It was also informed that if an account is blocked, no IP information can be provided due to its unavailability,” the officer said.

According to sources, the Meta team clearly stated that requests sent by police should include a brief background of the case, explain the relevance of the information sought in connection with the alleged crime, and mention the role of individuals involved in order to enable a more effective response.

During the interaction, which lasted for about three hours, the Delhi Police raised several queries, including on providing transactional details (login and logout records), hash values of content, identification of message originators on the same platform, IMEI and device details, and methods for restoring a Meta account.

“Addressing a question related to the duration of data retention and how they can assist investigating agencies in a case where the IP address is traced to Nigeria, the Meta officials informed that data is retained for an initial period of 90 days. However, the period can subsequently be extended by generating a new request ID,” the officer said.

“Many Delhi Police officers raised the issue of social media intermediaries not providing IMEI or device details. Meta officials responded that they did not have the necessary information at the moment, but would look into the matter,” the officer said.

The Meta team is learnt to have told police that while social media accounts cannot be restored directly at the insistence of law enforcement agencies, a request can be generated by enclosing a screenshot of the hacked page or referring the matter to them.

“The Delhi Police also asked whether there is a way to detect the creators of child sexual abuse material (CSAM) or non-consensual intimate images (NCII). The Meta officials informed that a tool has been developed in this regard and is currently with the National Crime Records Bureau (NCRB), undergoing the testing stage,” the officer said.