Note: MediaNama is hosting a #NAMA Bootcamp on Encryption in Delhi on October 4, 2019. You can apply to attend this invite-only session here.

“In my view, the government is best suited [to decide on Intermediary Rules], not this court or any high court,” Justice Deepak Gupta told a packed Court No. 13 in the Supreme Court this afternoon, as he and Justice Aniruddha Bose heard the Facebook transfer petition.

In a hearing that lasted about 30 minutes, the Court instructed Solicitor General Tushar Mehta, who appeared on behalf of Ministry of Electronics and Information Technology (MeitY) and the central government, to submit an affidavit from the Secretary of MeitY within 3 weeks with a concrete timeline on the status of the intermediary guidelines.

‘What is the status of Intermediary Guidelines?’ asks Court

Justice Gupta asked Mehta if the central government was indeed ready to come out with Intermediary Guidelines, as the central government and MeitY lawyer Venkataswamy Babu had said in the Madras High Court on September 20. Kapil Sibal (WhatsApp) and Mukul Rohatgi (Facebook) let out loud yeses, while K.K. Venugopal (State of Tamil Nadu) said that the transfer petition is about Aadhaar.

On being asked by Justice Gupta about the timeline of notification of Draft Information Technology [Intermediaries Guidelines (Amendment)] Rules, 2018, Mehta informed the court that he had taken instructions on them yesterday. “It will not be very accurate to give a timeline,” he clarified.

Justice Gupta told Mehta that the Intermediary Guidelines have to be released at the earliest. It is only after that happens that “people can challenge it on grounds of violating privacy”, etc., he said. He said, “The policy has to come from the government. It is only after the government releases its policy that courts can assess if it holds up to law.”

‘Central government, not judiciary, must come out with the policy,’ says Justice Gupta

Justice Gupta said that there are certain cases where there must be guidelines from the government. These include guidelines for intermediaries on pornographic and paedophilic content. “There cannot just be a letter from the government. You just cannot decide because one police commissioner said so,” he said, referring to how the Assistant Commissioner of Police of Tamil Nadu’s submissions before the Madras High Court led to the expansion of the original writ petitions before the court. Intermediary rules were last notified in 2011. The 2018 draft has not been notified till now.

Venugopal said that despite Rule 3(7) of Information Technology (Intermediaries Guidelines) Rules, 2011, WhatsApp has said that it cannot identify the originator. Justice Gupta nodded his head in seeming agreement.

Intermediary Guidelines Rules, 2011
3(7) When required by lawful order, the intermediary shall provide information or any such assistance to Government Agencies who are lawfully authorised for investigative, protective, cyber security activity. The information or any such assistance shall be provided for the purpose of verification of identity, or for prevention, detection, investigation, prosecution, cyber security incidents and punishment of offences under any law for the time being in force, on a request in writing staling clearly the purpose of seeking such information or any such assistance.

Venugopal then cited Rule 3(4) of the same Rules and told the court, “Thus, all you have to say is tell Facebook and WhatsApp to enact this.”

Intermediary Guidelines Rules, 2011
3(4) The intermediary, on whose computer system the information is stored or hosted or published, upon obtaining knowledge by itself or been brought to actual knowledge by an affected person in writing or through email signed with electronic signature about any such information as mentioned in sub-rule (2) above, shall act within thirty six hours and where applicable, work with user or owner of such information to disable such information that is in contravention of sub-rule (2). Further the intermediary shall preserve such information and associated records for at least ninety days for investigation purposes.

Rohatgi reminded the court that Rule 3(4) was “read down” (restricted) in Shreya Singhal vs Union of India. As a result, it is only with a court or government order that the intermediary is liable to remove contentious content.

(117) Section 79(3)(b) has to be read down to mean that the intermediary upon receiving actual knowledge that a court order has been passed asking it to expeditiously remove or disable access to certain material must then fail to expeditiously remove or disable access to that material. This is for the reason that otherwise it would be very difficult for intermediaries like Google, Facebook etc. to act when millions of requests are made and the intermediary is then to judge as to which of such requests are legitimate and which are not. We have been informed that in other countries worldwide this view has gained acceptance, Argentina being in the forefront. Also, the Court order and/or the notification by the appropriate Government or its agency must strictly conform to the subject matters laid down in Article 19(2). Unlawful acts beyond what is laid down in Article 19(2) obviously cannot form any part of Section 79. With these two caveats, we refrain from striking down Section 79(3)(b).
[…]
(119) Section 79 is valid subject to Section 79(3)(b) being read down to mean that an intermediary upon receiving actual knowledge from a court order or on being notified by the appropriate government or its agency that unlawful acts relatable to Article 19(2) are going to be committed then fails to expeditiously remove or disable access to such material. Similarly, the Information Technology “Intermediary Guidelines” Rules, 2011 are valid subject to Rule 3 sub-rule (4) being read down in the same manner as indicated in the judgment.
— Shreya Singhal vs Union of India [emphasis ours]

As Rohatgi pointed out the limitations of Rule 3(4), Justice Bose queried, “But you are saying that you don’t have the technology to find the originator?” Sibal clarified, “Only platforms with end-to-end encryption cannot trace [the originator]. Traceability is possible on all platforms except WhatApp and Apple.” Could Apple also be impleaded in this case?

Rohatgi summarily said, “High Court has no business to do it,” to which Mehta raised objection, “This [language/statement] is unacceptable.” Venugopal said, “They have no business to be in the country if they do not comply with the laws.” Sibal retorted, “Well, people are taking pictures of Spanish highways and sharing them as Indian ones. [What can WhatsApp do about that?]” Mehta immediately said, “No political campaigning in the court, please,” prompting laughter from all.

Virag Gupta, the advocate for K.N. Govindacharya who has filed an impleadment petition, said that the main issue is of Rule 3(11) which directs intermediaries to hire a grievance officer:

Intermediary Guidelines Rules, 2011
3(11) The intermediary shall publish on its website the name of the Grievance Officer and his contact details as well as mechanism by which users or any victim who suffers as a result of access or usage of computer resource by any person in violation of rule 3 can notify their complaints against such access or usage of computer resource of the intermediary or other matters pertaining to the computer resources made available by it. The Grievance Officer shall redress the complaints within one month from the date of receipt of complaint.

Justice Gupta remarked, “Do you now have to go to Ireland [to file any complaint]?” Gupta continued, “Delhi High Court had directed them [intermediaries] to appoint a grievance officer, but they appointed one in USA and EU, and not in India.”

Mehta cited Rule 3, “decryption rules”, as per which direction for decryption can also be given. We were not able to find such a reference in Section 79 of the IT Act which deals with intermediary rules, but found a reference in Section 69 of the IT Act:

Information Technology Act, 2000
Section 69
Power to issue directions for interception or monitoring or decryption of any information through any computer resource. –

(1) Where the Central Government or a State Government or any of its officers specially authorised by the Central Government or the State Government, as the case may be, in this behalf may, if satisfied that it is necessary or expedient to do in the interest of the sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence, it may, subject to the provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of the appropriate Government to intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource.

(2) The procedure and safeguards subject to which such interception or monitoring or decryption may be carried out, shall be such as may be prescribed.

(3) The subscriber or intermediary or any person in-charge of the computer resource shall, when called upon by any agency referred to in sub-section (1), extend all facilities and technical assistance to-

(a) provide access to or secure access to the computer resource generating, transmitting, receiving or storing such information; or

(b) intercept, monitor, or decrypt the information, as the case may be; or

(c) provide information stored in computer resource.

(4) The subscriber or intermediary or any person who fails to assist the agency referred to in sub-section (3) shall be punished with imprisonment for a term which may extend to seven years and shall also be liable to fine.]

Sibal replied, “But the question is whether such a direction should be given.”

Should this case be heard in Supreme Court or Madras High Court? No answer yet

Justice Gupta said, “We aren’t talking about Aadhaar”. Venugopal agreed and said, “Even in Madras High Court, the case is about finding the originator, and [perpetrator of] fake news.” Justice Gupta told him, “We are as concerned as you are about trolling and fake news.”

Venugopal told the court that the Madras High Court division bench, constituting Justices S. Manikumar and Subramonium Prasad, had to hear the matter. Justice Gupta cut him off and said, “But the bench has changed!” to Justices M. Sathyanarayanan and N. Seshasayee. To this, Venugopal said that Madras HC will decide the matter in the next hearing on October 1, prompting Rohtagi to let out a series of vehement nos.

Justice Gupta remarked, “Neither us nor the High Court are competent to decide the Intermediary Guidelines. That is the government’s job.” Rohatgi and Sibal soundly agreed. Rohatgi said, “They [Tamil Nadu government] are saying that we will get an IIT professor for cross-examination.”

Venugopal clarified that the HC was only going into “the question of cooperation with law enforcement agencies, nothing else”. “The Court had sought an IIT professor’s view as WhatsApp’s case had said that traceability would require decryption but IIT professor says this is how you do it [without breaking encryption]. This is a matter of public interest.”

On behalf of Tamil Nadu, Venugopal said, “We have an objection that these multinational companies got an inkling of where the case is going and thus approached the Supreme Court. We are indifferent to whether you decide it or the High Court.”

Justice Bose asked why the High Court had to decide on traceability and cooperation with law enforcement agencies in the first place, stating that the Information Technology Act should lay out the law in the first place. Venugopal replied, “But WhatsApp is saying that they do not have the technology to do it. Also, we are not asking for the content [of the message], but just the originator.”

Sibal repeated his seemingly favourite argument — this is a worldwide issue — to which Justice Gupta said, “But we have to find an answer, Mr Sibal. And we just cannot say that we do not have the technology.” He later told the court, “We will worry about international ramifications later. We will worry about our country first.”

In a light-hearted moment, Justice Gupta rued owning a smartphone. “I am thinking of giving up my smartphone.” Sibal, whom the readers know as the counsel for WhatsApp, piped up, “Smart decision.” Mehta wasn’t to be left behind: “Some of us have already implemented it.”

Justice Gupta later remarked, “After the last hearing, it took me 5 minutes to reach the Dark Web.” Mehta commiserated with him and said that “recipes to create bombs were available online”.

Sibal asked the bench, “What do we do in Madras High Court?” Justice Gupta remarked, “The bench has changed. … Let them decide. At times just showing the order to the bench suffices.” All lawyers shrugged at this non-committal response. In the absence of any further direction, as per the last SC order, the Madras HC can continue with the hearings, but not pass any “effective orders”.

‘Can individuals approach intermediaries?’ Justice Gupta asks

Mehta belaboured the topic of fake news and said, “Human excreta was shown on a religion’s, I will not say which religion’s, holy book by people using false names.” When he mentioned Tanzania, Justice Gupta interrupted him and said, “This is happening everyday. The problem is there. Whoever wants to say something can say it without fear.” Mehta concurred and said there was no accountability. Justice Gupta continued, “If someone says something against someone, why can’t we approach the intermediary to find out who [s/]he is?”

Venugopal said, “Kapil Sibal says that we can disclose the originator.” Sibal immediately protested, “I never said anything of the sort.” Sibal was right.

Justice Gupta also asked if there was any provision for defamation: “I haven’t gone through the rules, but are there any provisions for an individual to file a case? Such as in cases of defamation?” Venugopal said that that could be done via law enforcement agencies by filing a criminal case. Justice Gupta asked, “But why shouldn’t there be a right for individuals to approach the intermediaries directly?” Mehta gave an example of morphed pictures.

“State is powerful enough to look after its own rights, but what about the individuals?” — Justice Deepak Gupta

Is traceability without undermining E2E encryption actually possible?

Justice Gupta asked for the name of the IIT professor who had made his submission before the Madras High Court. As he was told Dr Kamakoti’s name and affiliation with the National Security Advisory Board, Sibal said that another IIT professor said the opposite, referring to Dr Manoj Prabhakaran’s submission on behalf of Internet Freedom Foundation. Justice Gupta laughingly remarked, “There are enough scientific brains in India to decide who is right.”

Readers should note that Prabhakaran’s submission did not oppose Kamakoti’s, but said that in fighting fake news, Kamakoti’s suggestions, even with modifications, would have limited effectiveness. Unlike Kamakoti’s submission that only talked about technological possibility of traceability, Prabhakaran’s also took into account the chilling effect on speech and amplification of persecution of vulnerable groups as a result of such technological changes. It is interesting that Sibal did not mention WhatsApp’s own submission that contested Kamakoti’s submission.

Court’s order

“The main issue is whether intermediaries are bound to provide information of originators of any message or communication, if the need so arises in the interest of national security, … and [against] pornography and other illegal activities.”

“Intermediaries cannot find originator because of end-to-end encryption either. In Madras High Court, IIT Professor Kamakoti can provide the content and information of the communication. There is another affidavit to counter it. It is not for this court to enter the scientific field while taking care of privacy, sovereignty of state, reputation of individual and illegal activities. Various reasons have to be ironed out. IT Act has to issue more guidelines. We have been told that on Friday, before the Madras High Court, [discussion about what to call them, Mehta called them a “statutory regime”] … Pointed out by Ms Aparna Bhat that draft rules have been framed, they just need to be notified. We request the Solicitor General to take instructions and file an affidavit from the Secretary of MeitY within 3 weeks with a concrete timeline [on the rules].

dictated by Justice Deepak Gupta in Court

The court order (given below) was released on September 25. Here are the key takeaways:

  • Solicitor General should take “complete” instructions on intermediary guidelines.
  • MeitY Secretary to file an affidavit by October 15 “placing on record the stage at which the process of framing/notifying the rules is at” and give a definite timeline about notifying the rules.
  • Status of direct recourse for individual when s/he may need “such information to protect his[/her] reputation and dignity”.
  • Need to find originators: Given the dangers associated with social media (pornography, use by paedophiles, black market, etc.), it is necessary to find the originators of such content/messages.
  • Intermediaries cannot find originators either because of end-to-end encryption.
  • Submissions by two IIT professors: The court took into account Dr Kamakoti’s submission, but the order states “he is in a position to provide the technology which would enable the intermediary to de-encrypt the encrypted message as and when the need arises. According to him, both the content and the identity of the originator of the content can be easily found. [emphasis ours]” However, readers should note that Dr Kamakoti’s suggestions don’t suggest decrypting communication at all. It appears that the bench might want further clarity on the technical aspect of the two submissions. (Read Dr Kamakoti’s submission here.)
  • Decryption could defeat the right to privacy: The order recognises that if decryption is made easily available, it could defeat the right to privacy. “Decryption of messages may be done under special circumstances but it must be ensured that the privacy of an individual is not invaded.”
  • Madras HC has said no to Aadhaar linkage: Court took cognizance of the fact that Madras High Court has withdrawn the prayer to link Aadhaar to social media accounts.

Former Attorney General Mukul Rohatgi represented the petitioner, Facebook, while Senior Advocate Kapil Sibal represented WhatsApp. The Attorney General of India K.K. Venugopal spoke on behalf of Tamil Nadu. Additional Advocate General for the State of Tamil Nadu Balaji Srinivasan was also present. In addition, Senior Advocate Neeraj Kishan Kaul and Akhil Anand appeared for Google and YouTube. Priyadarshi Banerjee was representing Twitter. Vivek Reddy appeared for Facebook, and Pavit Singh Katoch for WhatsApp. Senior Advocate Sanjay Kapur is representing TRAI.

The intervener in the Madras High Court case, and respondent in the transfer petition, Internet Freedom Foundation (IFF), was represented by Udayaditya Banerjee, Prasanna S., and Ria Singh Sawhney. Apar Gupta, IFF’s executive director, was also present. Aparna Bhat, the advocate for Prajwala, an NGO that focusses on issues of child sexual abuse and rape, was also there as the organisation has filed an impleadment application. Virag Gupta appeared for K.N. Govindacharya, an RSS ideologue, who wants to be impleaded in the transfer petition.

What next?

  • Madras High Court hearing: October 1
  • Submission from MeitY on status of Intermediary Guidelines: due October 15
  • Supreme Court hearing: October 22

Dive Deeper: Facebook Transfer Petition | WhatsApp Traceability Case

Update September 26, 2019 10:34 am: This article was updated with details of the court order. The original article was published on September 24, 2019.