Update August 1, 2019 2:37 pm: Sources confirmed to MediaNama that Dr V. Kamakoti and his team submitted their report with views and suggestions on possibility of traceability in WhatsApp yesterday, on July 31, as was instructed by the Madras High Court.
Original article published on July 25, 2019:
On July 24, Court No. 3 of the Madras High Court was packed with barely any standing room. As item no. 14 drew closer on the roster, more people jammed in. That’s because some of the biggest names in Indian legal fraternity had combined forced to make a case against implementing traceability in WhatsApp as the case examined ways in which cybercrime might be curbed with the assistance of social media companies.
Senior Advocates Kapil Sibal and Arvind Datar defended WhatsApp, as former Attorney General of India, Mukul Rohatgi, represented Facebook. The hearing began at 12:20 pm and went on for almost an hour. It saw representation from the government of Tamil Nadu (E. Manoharan), Twitter (Senior Advocate Sajan Poovayya), and Google (Senior Advocate P. S. Raman). Senior Advocate N. L. Rajah, who had represented WhatsApp in the last hearing, was also present. Internet Freedom Foundation, which had been made an intervener in the last hearing on June 27, was represented by Suhrith Parthasarathy. IFF’s executive director, Apar Gupta, was also present.
If this litany of names wasn’t enough, the presence of Brian Hennessey, the director and associate general counsel of WhatsApp, drove home the point that WhatsApp Inc. is paying particular attention to this case.
The division bench constituting Justices S. Manikumar and Subramonium presided over the hearing.
This case had originally been filed in 2018 as a PIL by Antony Clement Rubin (writ petition no. 20774/2018) and Janani Krishnamurthy (W.P. No. 20214/2018) that sought a writ mandamus (special order by court) to “declare the linking of Aadhaar or any one of the Government authorized identity proof as mandatory for the purpose of authentication while obtaining any email or user account”. In an earlier hearing, the division bench had expanded the scope of the PILs to include issues including curbing cybercrime and intermediary liability within the ambit of the legal proceedings.
As traceability and the originator once again became the protagonists of the proceedings, Justice Manikumar highlighted two aspects of the issue of the originator: if it was technically possible to trace WhatsApp messages, and what the existing guidelines that (dis)allow us to do so. Dr V. Kamakoti, a professor of computer science and engineering at IIT Madras, despite his absence left a mark.
Traceability: Technically possible?
Sibal reiterated WhatsApp’s previous argument and said, “We [WhatsApp] don’t have access to it [originator] ourselves”. Justice Manikumar promptly replied, “That’s the [whole] problem, Sir.” And Sibal volleyed back, “Yes, that’s the problem everywhere. It is true in the US, it’s true here, it’s true everywhere.”
Justice Prasad asked Sibal that, by not knowing how the originator could be traced and by being unable to control what we have created, if WhatsApp had raised a “[Frankenstein’s] monster”. Sibal said that through that logic, “all technology is monstrous”. Justice Prasad said that “fact of beating the technology is one issue”, but the fact that nothing can be done is the main issue.
Raman, on behalf of Google, said that this technical possibility must be considered on a “platform by platform” basis.
Later in the hearing, Justice Prasad drew attention to Dr V. Kamakoti’s recommendation that WhatsApp should consider including the phone number of the originator of a message whenever a message is being forwarded, and that according to the professor, this was technically possible. Sibal replied that this was a case of one scientist against another, and WhatsApp would have to independently review these recommendations.
Referring to Dr Kamakoti, Sibal argued that if there is one technical expert here, there are thousands of others. He requested that Dr Kamakoti should associate himself with the existing Union of India committee. Justice Manikumar replied that this was already under consideration.
IIT Madras experts say traceability is possible
At the behest of the court order on April 25, the Chief Secretary of the Tamil Nadu government, Dr Girija Vaidyanathan, had convened a meeting between social media companies and law enforcement agencies on May 22. At this meeting Kamakoti had suggested that WhatsApp should consider including the phone number of the originator of a message whenever a message is being forwarded, according to status report of the meeting submitted by Facebook.
At yesterday’s hearing, Kamakoti himself was not there, but his two colleagues, G. S. Madhusudan and Dr Shankar Raman, both senior project advisors at the department of Computer Science in IIT Madras were there in his stead. Madhusudan, who is also guest faculty at Tamil Nadu State Judicial Academy, addressed the court on behalf of Kamakoti.
Madhusudan pointed out to the court that Kamakoti is a part of the National Security Advisory Board under the PMO, and that they took cognisance of the broader issues related to traceability.
Madhusudan said that is was an “eminently solvable problem”. He asked the court, “If you are allowing unlimited forwards, where is privacy?” The judges agreed with his assessment. His argument that WhatsApp gave up its notion of privacy was premised on the fact that the platform does not require consent for forwarding messages. “If privacy were an issue, the default should have been no forwards,” he told the court.
Madhusudan drew an analogy between Preamble–Constitution, and a message’s metadata–content to suggest that just like the Constitution, the content of the message was the most important part.
In two interviews with MediaNama, Madhusudan said that the problem did not arise in one-to-one messages, which constitute 70% of WhatsApp messages, where the sender and receiver were already known; it arose with forwarded messages. Prior to the hearing, he told us that in the absence of any consent, there could be no expectation of privacy. His idea of consent-based forwarding that champions privacy would involve default no-forwarding. In this case, a person who created the message would be held liable only if s/he enabled forwarding, he told us. If forwarding was disabled, and the message was screenshot by someone and then shared, the person who screenshot would be held liable.
During our conversation, Madhusudhan reiterated that concerns surrounding WhatsApp and traceability weren’t just “theoretical” for Dr Kamakoti and him. Both of them are involved in Tamil Nadu’s Cyber Crime Centre which is located within IIT Madras. As a result, they are involved in police investigations and their suggestions are “based on the gravity” of the crimes they witness.
The judges called on Dr Kamakoti and his team to put their suggestions in writing.
Who is the originator? What is traceability?
On Justice Prasad’s question about what happens when law enforcement agencies need information, Sibal argued that there were different kinds of information, some of which could be shared, and some which could not be. Content of the message firmly resides in the second category. Justice Prasad argued that they already knew the content. Citing the example of communal violence, the Justice said that the content is visible to everybody; we need to find the source of that content.
Sibal concurred and said that traceability and the originator were the issue. However, he nuanced it further and asked how would the originator of the content be traced when an image was taken from YouTube and made viral through WhatsApp. In such a scenario, the originator of the content is not necessarily the first person who sent the message as the content originated on another platform. Justice Prasad said, “At least we reach that point.” Sibal, of course, remained unconvinced. Raman, on behalf of Google, argued that even for YouTube, finding the originator was difficult.
Readers should note that thus far, traceability and originator haven’t been categorically defined, neither in the proposed Intermediary Liability Rules, nor in the court.
Understanding what is objectionable content
Sibal argued that the issue of traceability was a highly complex one. “It is not just a technical issues; it has global and commercial implications.” Justice Prasad interrupted him and told him that the court wasn’t discussing “global and commercial implications right now”. Later, Rohatgi reiterated Sibal’s argument that they were dealing with complex global issues. “You are dealing with 5 billion people. What is nudity or defamation in one country, is not nudity or defamation in another.”
Rohatgi argued that as far as Facebook was concerned, they obey court orders without question, and consequently pull content down, at least in India. Justice Prasad said that the question was not about content removal, it was about cooperation with law enforcement agencies. Rohatgi argued that Facebook had its own norms, including country-specific ones, but issues such as child pornography were globally a “no-no”. Rohatgi argued that police personnel often abused the system and approached Facebook with personal requests.
Rohatgi briefed the court on the two channels through which Facebook could be approached with requests: emergency route, and expanded route. Through the former, “somebody will do something as fast as possible”, and they had specially appointed a grievance officer in India to that aim. He argued that Facebook had “thousands of people” across the world looking at these requests.
Urgent need for direction from the central government on Intermediary Liability Rules
Sibal began by arguing that this issue, of the magnitude of responsibility that private platforms bear, has to be decided by the central government through a law. Justice Manikumar immediately turned to Manoharan for the state government’s response. Understandably, the Tamil Nadu state government, could not commit one way or the other on behalf of the central government.
Later in the hearing, Justice Prasad agreed that the Government of India, through the Parliament, has to pass the law which the court would follow, referring to Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018, but repeatedly asked the social media companies that if in the “interregnum” period, “the courts should try to have a regime [for according responsibility]”. To this, Sibal asked if the court would “preempt the Parliament”. He cited the Union List that defines items on which the Parliament has exclusive power to legislate. Entry 31 in the List includes “posts and telegraphs; telephones, wireless, broadcasting and other like forms of communication”.
Rohatgi, too, said that the central government needs to direct social media platforms, through a law, how to proceed. The social media platforms, he argued, could “not be governed by subjective sensibilities, individual sensibilities and concerns”. And that the government always had to be mindful of the Puttaswamy judgement that reaffirmed right to privacy as a fundamental right.
However, later, Rohatgi said that “some guidelines, regulations were already in place” and that there was “no vacuum”. “We are not hiding something, or opposing you. We want to help as much as possible,” he assured the court.
Datar intervened and said, “[When] there’s no law, then there is vacuum.” He cited Common Cause (Regd. Society) v Union of India ((2017) 7 SCC 158) where the SC said,
… it is not the province of the Court to express any opinion on the exercise of the legislative prerogative in this regard. … the exercise of the amendment of the Act, which is presently underway, must be allowed to be completed without any intervention of the Court. Any other view and any interference, at this juncture, would negate the basic constitutional principle that the legislature is supreme in the sphere of law-making. Reading down a statute to make it workable in a situation where an exercise of amendment of the law is pending, will not be justified either.
Sibal also mentioned the letter that David Kaye, the UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, wrote to the Indian government in February 2019 raising concerns about the proposed Intermediary Liability Rules. MediaNama can confirm that this letter was also shared with all respondents in this case by WhatsApp in the company’s response to government’s common report that listed 1600 requests that the Tamil Nadu government had made to the five social media companies.
Sibal: No encryption, no WhatsApp
Sibal argued that the matter of end-to-end encryption had been raised in the Supreme Court case over removal of child porn across different platforms as well. He argued that the Supreme Court understood that even on a matter as serious as child pornography, WhatsApp’s hands were tied because of end-to-end encryption.
Offering an impassioned defence of encryption, Sibal said, “If you open up the encryption, there is no platform. We have helped law enforcement agencies … with kidnappings [etc.] … If my platform is decrypted, it is like any other platform in the world. For one jurisdiction, can I change the nature of the platform? Scientists use it, people in defence use it.”
Justice Prasad said, “We are not asking for complete decryption. Only for when it is required.”
Sibal cited American law enforcement agencies whom WhatsApp supports in every which way by giving them all the information, referring to metadata of the message, except encrypted messages as their decryption is technically impossible. He argued that American agencies have solved cases using metadata. “Why should we destroy the platform if normal investigative machinery can do it [solve cases]? If [Indian] law enforcement agencies cannot do it, do we destroy the platform?”
Rohatgi also asked the court to consider “the enormity of these platforms”.
Social media companies critical of TN government’s submissions on requests made
Rohatgi criticised the government’s common report that said that Facebook had fulfilled only 50% content takedown requests. He argued that the government had not given details about how this requests had been filed — some requests were missing FIR numbers, some were not in proper format, some were not mandated by court. He assured the court that proper requests had always been considered.
WhatsApp’s latest submissions to the court included a Ministry of Home Affairs letter that specified the format of the Letter Rogatory (letter of Request) that must be used to petition foreign governments/companies to cooperate with investigations of Indian law enforcement agencies.
The court directed Madhusudan, and the rest of Kamakoti’s team, to submit their views on the issue by July 31. Sibal said that WhatsApp’s experts would also need to look at the report and respond to it. He sought a September hearing, saying that WhatsApp’s team in USA would also need to look at the report. However, the judges refused, presumably because the court roster would be changed on August 31. With their tongues firmly in their cheeks (because judges must always be firm), they asked Sibal if he could send the technical report to WhatsApp’s American team by email. Sibal said no, evoking knowing smirks from the judges. Ultimately, the judges decided to give WhatsApp two weeks thence to submit their response.
It is not necessary for the Tamil Nadu government to respond to Kamakoti’s report, but they have been given a week to submit a response. Parthasarathy also sought the court’s permission for IFF as the intervener to respond to the two reports. Justice Manikumar did not consider the intervener’s response important, but allowed IFF to also respond.
Apar Gupta, the executive director of IFF, told MediaNama that Dr Kamakoti’s remarks were also a part of the government common report, and not separately annexed. IFF’s response to that is already available here. If the need for a fresh response arises, Gupta said that IFF would file one. On the question of IFF hiring a technical expert to assess Kamakoti and WhatsApp/Facebook’s expected submissions, Gupta said, “We won’t be hiring anything like that because we don’t know what will be the model of engagement. I can’t commit to that publicly yet.”
- July 31: Report from Kamakoti’s team recording their suggestions
- August 14: Response from WhatsApp’s Indian and American teams
- August 21: Next hearing (expected to be a two-day hearing, with the second day being either August 21, or August 23)
As the hearing ended, the courtroom practically emptied out as Sibal, Datar and Rohatgi met in the corridor to brief Hennessy about what the judges had directed them to do. Soon enough, the group walked off, plausibly to draw their battle plans.
For our complete coverage of this case, please visit this link.
Update August 1, 2019 2:37 pm: Dr V. Kamakoti and his team submitted their report with views and suggestions on possibility of traceability in WhatsApp yesterday, on July 31, sources confirmed to MediaNama. The original article was published on July 25, 2019.