WhatsApp Is Fighting To Keep Millions Of Users Untraceable
WhatsApp is “a space for private conversations online.” An Indian court could make it public.
WhatsApp, the encrypted messaging service that has built a 400 million strong user base in India, is squaring off in a Tamil Nadu courthouse in a case that could force the company to weaken its privacy protections. The Madras high court recently began hearing a case filed by two petitioners asking the country to force people to link their WhatsApp accounts to their Aadhaar, India’s controversial biometric ID number for nearly all of the country’s 1.4 billion residents.
The two petitioners, Antony Clement Rubin and Janani Krishnamurthy, are private citizens. In copies of their legal filings reviewed by BuzzFeed News, they describe themselves as animal welfare activists, and say that they'd like the court to mandate users to link "any email or user account" to their Aadhaar numbers or any other form of identification, "owing to the rising instances of humiliation, disgrace and defamation [through] cyber bullying and other intolerable activities on social media."
Rubin, who filed the petition after being bullied on Facebook in 2018, told BuzzFeed News that he only did so to help law enforcement agencies track down people who indulged in abusive behavior online. "To be honest, my only concern when I filed the petition was that the platforms should be a safe environment for everyone," he said. "That said, I do acknowledge that in a case like this, there's a double-edge sword when it comes to people's privacy." Rubin also denied having links to the government and said he had filed the petition in his personal capacity.
"There's nothing wrong with this," said Krishnamurthy, who has also been a target of cyber-bullying online. "If law enforcement or the government gets access to WhatsApp messages, at least we'll get some level of security. It's possible that the government can use this capability for surveillance, but it can also use it to track down bullies and abusers. Riots can be stopped," she said. "I think I've opened a Pandora's box."
The case — the first in the country to consider traceability in social media — could set legal precedent for all tech companies operating in India. Privacy experts fear the case is a convenient opportunity for India’s nationalist government to force platforms to become surveillance tools.
“If the court directs a product change like breaking or weakening WhatsApp’s encryption, it won’t be limited to just WhatsApp but will extend to pretty much every single product and service that uses encryption in India,” Apar Gupta, director of the digital advocacy organization Internet Freedom Foundation, told BuzzFeed News. The IFF is an intervener — a third party that can join a case without the permission of the original litigants — in Rubin and Krishnamurthy’s petition. “Once you can trace a message, you can use it for methods of social control,” said Gupta. “That’s the primary objective of this.”
A WhatsApp spokesperson declined to comment on the ongoing case, but pointed BuzzFeed News to a statement issued in February that described WhatsApp as “a space for private conversations online.”
“Imagine if every message that you sent was kept with a record of the fact that you sent it and with a record of your phone number,” it said. “That would not be a place for private communications.”
After lynch mobs fueled by misinformation about child abductors spread on untraceable WhatsApp messages killed more than 45 people across India in 2018, the government has been cracking down on the Facebook-owned app. Since then, the Indian government has repeatedly asked the company to develop a way to identify senders of messages. WhatsApp has turned down the request each time.
As it rebuffs those demands, WhatsApp has fought the spread of rumors in other ways, such as limiting the number of people or groups users can forward messages to and clearly labeling forwards. It ran advertising campaigns on television, newspapers, and radio warning against the dangers of misinformation. And the company is hiring a national law enforcement liaison — one of the government’s key demands.
Nevertheless, the government remains focused on personal traceability. In October, it demanded the locations and phone numbers of people using WhatsApp for real-world violence, and in December, it proposed changes to the country’s IT law that would force platforms including WhatsApp to break their user encryption. Last month, it asked the company to digitally fingerprint every message to track the sender.
“Traceability shall be [WhatsApp’s] job,” said Ravi Shankar Prasad, India’s IT minister, last week.
WhatsApp is taking these developments seriously, flying out its top legal counsel, Brian Hennessy, to the hearing from its California headquarters. The company hired Arvind Datar and India’s former law minister Kapil Sibal, two of India’s highest-profile (and most expensive) lawyers to make its case before the judges.
Their arguments against traceability in the high court were blunt.
“Requiring WhatsApp to trace originator information is disproportionate to the laudable aim of preventing and detecting crimes, particularly since users can easily migrate to encrypted platforms that do not have such an obligation,” WhatsApp stated in a 27-page submission to the court reviewed by BuzzFeed News.
The company also stated that WhatsApp’s end-to-end encryption promoted citizens’ fundamental rights and enabled journalists, civil society organizations, members of ethnic and religious groups, activists, and artists to exercise their right to freedom of speech and expression “without fear of surveillance or retaliation.”
“Imposing a traceability requirement would undermine all of these benefits,” WhatsApp said in the submission. “Journalists could be at risk of retaliation for investigating issues that may be unpopular, civil or political activists could be at risk of retaliation for discussing certain right and criticizing or advocating for politicians or political, and personal information like sexual orientation, health, religious affiliation, Aadhaar, and financial information could be at risk of becoming publicly exposed.”
Representatives from Facebook, Google, and Twitter, each of which have millions of users in India, also attended the hearing. Facebook did not respond to BuzzFeed News’ request for comment. A Twitter spokesperson declined to comment. A Google spokesperson said that the company could not comment on the case as it was still in court.
“The outcome of this litigation could lead to a change in the product design of major social media platforms because law enforcement agencies want the [court] to direct these companies to devise a mechanism to trace the originator of a message,” the IFF wrote on its website.
In July, V. Kamakoti, a professor at the Indian Indian of Technology Madras and a member of the country’s National Security Advisory Board, a body that advises the prime minister on national security matters demanded that WhatsApp attach the original sender's phone number to every forwarded message. Kamakoti’s proposal, which is part of the Indian government’s report submitted to the court, said that WhatsApp could attach the original sender’s phone number to every message, which wouldn’t require it to break encryption but would allow law enforcement agencies to track down the sender if they wished to.
Kamakoti did not respond to multiple interview requests from BuzzFeed News.
According to sources familiar with the matter, members of WhatsApp’s legal and policy teams from its California headquarters met Kamakoti along with law enforcement agencies in Tamil Nadu in May. The purpose was to discuss how all tech platforms — not just WhatsApp — work with law enforcement in the state of Tamil Nadu. There was no resolution at the end of this meeting, a source said.
The next hearing in the case is scheduled for Aug. 21.
Countries around the world are calling for tech platforms to break their encryption or build backdoors into their products — ostensibly in service of law enforcement. On the same day that WhatsApp was making its case in the Madras high court, United States Attorney General William Barr demanded that tech firms put backdoors into their encrypted products because encryption “seriously degrades” law enforcement’s ability to “detect and prevent a crime before it occurs,” and makes prosecution more difficult. Earlier this week, intelligence agencies from the US, the UK, Australia, Canada, and New Zealand demanded special access to messages flowing through WhatsApp and other encrypted services.
But a judicial requirement to let law enforcement agencies access encrypted WhatsApp messages would hit Indians particularly hard, critics say, especially with the rise of Modi, whose five-year reign has polarized the country along religious lines.
“Free expression itself is regularly undermined in the political space in India at present especially for people who use social media,” said Gupta of the IFF. “A lot of people’s conversations on the internet are about politics and criticizing politicians. Tracking down their identities would result in a great chilling effect. There will be fear in their minds.”
Antony Rubin and Janani Krishnamurthy's comments were added to this post.
Brian Hennessy's name was misspelled in an earlier version of this post.