UPDATE (October 24 3:25 pm): Article has been updated with details of the court order.

(with reporting inputs by Trisha Jalan)

Seemingly under instructions from the Advocate General of Tamil Nadu Vijay Narayan, the Attorney General of India K.K. Venugopal, representing State of Tamil Nadu in the Supreme Court, threw a curveball. Catching everyone in the court room by surprise, more than halfway through the hearing, the State of Tamil Nadu switched gears and said that they did not oppose Facebook’s transfer petition. Venugopal told the Court that the matter needed to be resolved and thus the state was no longer opposed to it. As a result, the Supreme Court granted the transfer of the WhatsApp traceability case, currently pending before the Madras High Court, to the apex court, along with all similar petitions listed before other high courts.

Balaji Srinivasan, the Additional Advocate General for the state of Tamil Nadu, told MediaNama after the hearing, “We want the matter to be heard [irrespective of the court]. We don’t want it to keep lingering.” He also said, “Now that the place and forum of hearing is certain, there is no question of who will hear the matter now. … And now it will be heard.”

Given the abrupt change in strategy, it appears that Narayan had been given full liberty by the state government to make impromptu changes to the state’s stance as he deemed fit. It is now apparent that the Union of India and the State of Tamil Nadu are making the same case, asking for decryption.

In a 30-minute hearing, the division bench, constituting Justices Deepak Gupta and Aniruddha Bose, directed the lawyers to prepare a list of all similar matters pending before the different high courts in the country, apart from the four that were part of the transfer petition, and submit it to the Supreme Court. The next hearing, on the merits of the case, is scheduled for January 30, 2020 and will be placed before an “appropriate bench” assigned by the Chief Justice of India after the Ministry of Electronics and Information Technology notifies the Intermediary Guidelines (Amendment) Rules 2018 by January 15, 2020.

Tamil Nadu government and Govt of India on the same page now

Tushar Mehta, the Solicitor General of India, appeared for the central government and MeitY and said, “We [government] have no intention of invading privacy, but intermediaries cannot provide a platform which can be used by terrorists and for anti-national activities. We have to balance [this with] national security, sovereignty, and public order, and investigation of crimes.” Venugopal interjected, “A terrorist can claim no privacy.”

Justice Gupta asked Mehta if the Intermediary Guidelines (Amendment) Rules 2018 would indeed be notified by January 15, 2020, as MeitY’s affidavit had stated. Mehta appeared to assure him that they would be.

Tamil Nadu changes its strategy, asks for decryption citing the IT Act

In another major departure from its stance in both the Madras High Court and the Supreme Court, the state of Tamil Nadu argued that Section 69 of the Information Technology Act, 2000 already has a provision for decryption; Venugopal said that Section 69 has some “elaborate rules” for it. Thus far, the state of Tamil Nadu had maintained that its law enforcement agencies wanted greater cooperation from social media companies to find the originator, and how it was carried out would have been the intermediaries’ responsibility. But yesterday, K.K. Venugopal argued that the platforms cannot establish a “non-decryption system”, presumably a reference to end-to-end decryption, and still “function in the country”. He said that if law requires decryption, intermediaries should comply and follow the rule of law.

To this, the judges remarked that they were not “technically qualified” to comment on it, echoing their previous order. However, they added that if somebody can encrypt, they could also build decrypting abilities for it. “There is a minute-to-minute development,” Justice Gupta said.

Venugopal read Section 69(1) of the Act which allows the government to direct any of its agencies “to intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource”. He further cited Section 69(3) which directs an intermediary or subscriber, when called upon by an agency, to

“extend all facilities and technical assistance to:

(a) provide access to or secure access to the computer resource generating, transmitting, receiving or storing such information; or
(b) intercept, monitor, or decrypt the information, as the case may be; or
(c) provide information stored in computer resource.”

‘Are the intermediaries obligated to decrypt, or give technical assistance?’ asks the SC

Justice Gupta looked uncertain and remarked that intermediaries must help in decryption, but not decrypt. “Do the rules require them to decrypt [information] or to give technical assistance? Is there an obligation on them [intermediaries] to decrypt?” he queried. Venugopal said that as per the IT Act, the obligation was to decrypt information, and not to simply provide technical assistance.

Justice Bose drew an analogy: “A room is locked. You [the government] want to open the room. The owner of the room is saying ‘open it yourself’, but you [the government] are demanding that they give their own key so that you can open the room.” When Venugopal reiterated that intermediaries have to give access to the “entire computer system” under the law, Justice Bose pointed out that “their servers might be located outside India”.

Age-old question: Is decryption of WhatsApp messages even possible?

Venugopal cited IIT Madras professor Dr V. Kamakoti’s submission and said, “The IIT Professor said it is absolutely possible, absolutely open,” to which Justice Bose asked if Dr Kamakoti had to go to WhatsApp’s office. Mukul Rohatgi, appearing for Facebook, exclaimed, “[This is] completely wrong!”

“The government must have its own agency [to decrypt the information],” he said. Prompted by Justice Bose, Justice Gupta said, “My colleague informs me that the US has an outside agency which decrypts information. Nobody prevents the system of decryption, but can we force them [the intermediaries] to decrypt?” This remark is confusing, because when it comes to end-to-end encryption, which has become the crux of this case, the US government also does not have a workaround, definitely not one which is publicly known. This is why the government of USA, along with UK and Australia’s, sent an open letter to Facebook, asking them not to introduce end-to-end encryption across all its messaging platforms.

‘We don’t have a key to the room!’ argues Facebook

Rohatgi argued, “The rules say that if I have they key, I will [have to] give the key. But I don’t have the key!” referring to Justice Bose’s analogy about the room, lock and key. He further said that there was no mandate under the IT (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules, 2009 to decrypt, citing Rule 13(3).

Rule 13 (3)
Any direction of decryption of information issued under Rule (3) to intermediary shall be limited to the extent the information is encrypted by the intermediary or the intermediary has control over the decryption key.

As per the Rules, “decryption assistance” is defined as:

(g) “decryption assistance” means any assistance to
(i) allow access, to the extent possible, to encrypted information; or
(ii) facilitate conversion of encrypted information into an intelligible form [emphasis ours]

Emphasising that “decryption assistance” was limited by the control intermediary had over the decryption key, as defined by the clause “to the extent possible”. The assistance is thus qualified and conditional. Given that WhatsApp does not have a decryption key, the question does not arise. He went as far as to say, “I will give the key if I have it!”

Need to transfer because we’re a global platform, says Facebook

Rohatgi argued that this question is of the utmost importance — to governments, police, intermediaries, users, everywhere. He further said that all this needs to be balanced under Article 21 of the Constitution. He beseeched the Court to transfer the cases citing the problems associated with going to different High Courts on similar issues. He further said that as a global platform, Facebook has to take positions worldwide and was “answerable to all kinds of people about privacy”. On the need to protect user privacy, he said, “I [Facebook] am nothing without my users.” The last statement is particularly ironic given Facebook’s global woes with protecting user privacy.

IFF asks the Court to exercise restraint

Senior Advocate Shyam Divan, on behalf of Internet Freedom Foundation, the intervener in the Madras HC case, pointed out that the Foundation had filed a writ petition challenging the constitutionality of Section 69 and the IT (Procedure and Safeguards for Interception, Monitoring and Decryption) Rules, 2009, a matter which is still pending before the court. IFF had also cited this case in its original intervener application to the Madras High Court.

While initially Divan said that IFF opposes the transfer petition, sticking to their submission to the apex court, he later said, “The court essentially faces a transfer petition and multiple special leave petitions. I request the court to not go into the issues. If the case is transferred to the Supreme Court, we will continue to assist the Supreme Court. If it is not transferred, we will continue to assist the Madras High Court,” Divan said.

Arguing against the government’s demands for decryption, Divan said that such demands put freedoms at stake. “The Solicitor General Tushar Mehta has given a timeframe. … The rules may or may not be acceptable, but for the Supreme Court to say anything now may be premature,” he said. Calling it a “momentous issue of freedom” that needs a balancing act, he said, “Rights of citizens are being trampled upon. … The Court must restrain itself.” Justice Gupta nodded, presumably in agreement.

Responses to the Supreme Court judgement allowing the transfer

Antony Clement Rubin, the person whose writ petition in the Madras High Court started the case, told MediaNama, “I am glad that the Supreme Court has taken this up on a larger scale and that they are also looking at things at a macro level. I also believe that policy change is the way forward. I am disappointed too because I don’t have access to the proceedings anymore. It is too expensive to go to Delhi, and hire an SC advocate on record.”

Janani Krishnamurthy, the other petitioner in Madras HC, said, “It’s good, right? At least it has moved from Madras High Court to the Supreme Court, so there will be more light on it. At the end of the day, the Centre has to decide whether security is important or not because we have been getting (cyber) bullied) left, right and centre. Complaints have had no effect. Now things will shift.” On whether she will follow the proceedings, she said, “Yes, I will.”

 “I really, really want this case to be one of the landmark cases where something concrete comes out of it, whereby privacy is safeguarded but security too. I am 100% sure that the government and these guys [intermediaries] can figure out a way. I understand that there is a fine line between privacy and [security]. … “If they [intermediaries] can work with other governments to do this [traceability], they can do this with the Indian government.” — Janani Krishnamurthy

On traceability, she said that it is possible to “trace back to someone who is causing social unrest”. “Social media networks can’t say it is a privacy basic. It’s rubbish … but what happens to my privacy when I am abused online.”

A WhatsApp spokesperson reitereated the company’s lack of access to people’s communications. In a statement to MediaNama, they said, “WhatsApp is deeply committed to serving the people of India. We strongly support the right to privacy that the India Supreme Court has recognized and believe our service helps fulfill people’s desire to communicate privately with their loved ones. We continue to respond to requests from the Government for the information available to us, though we do not have access to people’s messages given the end-to-end encryption we provide.”

What happens next?

As per the SC order (attached below), the matter will now be listed on January 30, 2020. The order cited lack of objection to the transfer as the reason for allowing it.

  • Counsels have to submit their a list of similar matters pending before the SC by November 5. It appears that counsels will also submit similar matters from other High Courts in the list.
  • The Chief Justice of India will decide the bench for the January hearing.
  • Intervention applications by K.N. Govindacharya and the NGO Prajwala have been rejected.
  • Writ Petition 679/2019 will also be heard along with these cases.

By then, the Intermediary Guidelines (Amendment) Rules 2018 should have been notified by then.

What happens to Aadhaar-social media linkage now? There is some confusion about whether the Supreme Court will consider the original appeal anew, given that the Madras High Court had already dismissed the original plea. Since this question is still unresolved in other Courts, it might be reconsidered, but the SC has thus far not even addressed the question and instead focus on intermediary liability and law enforcement. The comments and orders made in Madras HC are expected to have some bearing on the subsequent SC hearings, but it remains to be seen if the proceedings will resume where the Supreme Court left off.

What happens to the November 8 hearing in Madras High Court? Well, that’s an interesting one. If the SC judgement is communicated to the Madras High Court in time (considering internal communication protocols and festive holidays), the matter might not be listed. However, the more likely scenario appears to be that the matter will be heard on November 8, where the division bench will acknowledge the transfer, and potentially add its final comments.

Which cases will be transferred? In addition to the four writ petitions in Madras, Bombay and Jabalpur High Courts, the lawyers have been directed to look for other related cases dealing with Aadhaar linkage to social media and online accounts. All of them will be heard as one. There is some ambiguity about whether IFF’s writ petition challenging Section 69 of the IT Act will as be heard with these cases. The judgement remains ambiguous on this.

What happens to all the intervention applications? As the judgement says, all applications for impleadment/intervention have been rejected. But, the impleadment applications pending before the Madras High Court (KPost, Mahua Moitra) will still be considered.

Former Attorney General Mukul Rohatgi represented the petitioner, Facebook, while Pavit Singh Katoch represented WhatsApp in the absence of Senior Advocate Kapil Sibal. The Attorney General of India K.K. Venugopal spoke on behalf of Tamil Nadu, and for the first time, was accompanied by the Advocate General for Tamil Nadu Vijay Narayan. Additional Advocate General for the State of Tamil Nadu Balaji Srinivasan was also present. Solicitor General of India Tushar Mehta represented MeitY and the government of India. In addition, Senior Advocate Neeraj Kishan Kaul appeared for Google and YouTube, while Senior Advocate Sajan Poovayya represented Twitter (He has been representing Twitter both in the Madras HC and the SC, but made his first appearance in the SC for the case yesterday). Senior Advocate Sanjay Kapur is representing TRAI.

The intervener in the Madras High Court case, and respondent in the transfer petition, Internet Freedom Foundation (IFF), was represented by Senior Advocate Shyam Divan. Aparna Bhat, the advocate for Prajwala, an NGO that focusses on issues of child sexual abuse and rape, was also there as the organisation has filed an impleadment application. Virag Gupta appeared for K.N. Govindacharya, an RSS ideologue, who wants to be impleaded in the transfer petition.

Update (October 24, 2019 3:23 pm): The article was updated with details of the order. The original article was published on October 23 at 10:27 pm.

Dive Deeper: Facebook Transfer Petition | WhatsApp Traceability Case