Regulate big tech but not at the expense of user rights: Mishi Choudhary

The heavy-handed ways in which the government has been behaving in shaping the narrative and curbing dissent make even genuine attempts at regulating big tech suspicious, says Choudhary

The Ministry of Electronics and Information Technology on February 25 notified new rules under the Information Technology Act to regulate social media firms. Some of the provisions in these rules have been contentious, such as appointing three Indian residents to be liable and responsible for compliance, and having a grievance officer. The deadline to comply with these rules was May 25, which, companies say, is a very short time frame for them. In the absence of clarity or extension from the government, WhatsApp went to court against breaking end-to-end encryption, while an ongoing tussle between Twitter and the government heated up due to these rules. Mishi Choudhary, a technology lawyer who practises in New York and New Delhi, talks to Neha Alawadhi about why these rules are important, the need for the government and the firms to be more transparent  and the way ahead. Edited excerpts:

Now that the deadline for compliance is past, is going to court the only option left with the companies, like WhatsApp has done?

These rules are subordinate legislation and Parliament has not been in session since they were notified. In most cases the legislature enacts a law covering the general principles and policies and leaves detailed rule-making to the government to allow for expediency and flexibility.

The government is required to frame rules in accordance with the policy laid down by the legislature. Such rules are called subordinate legislation and may be referred to as rules, regulations, by-laws, orders, and notification. The parent Act usually provides that the rules shall be tabled in the House for a period of 30 sitting days, and MPs may move a motion to amend or annul the rules till the last date of the subsequent session. This has not happened in this case.

Unless there is an annulment motion or a motion to amend, courts are the only recourse for now.

Is the argument that traceability requirements under the new rules will undermine encryption and endanger user privacy valid?

Absolutely. Breaking end-to-end encryption to curb objectionable content online is like trying to solve one problem by creating a thousand more. Insecure communications make users more vulnerable to every known and some unknown crimes.

Currently, the Supreme Court is adjudicating on this since it has been pleaded by WhatsApp/Facebook that it is impossible for traceability to co-exist with end-to-end encryption because even WhatsApp doesn’t possess the decryption keys and hence cannot trace the originator of the message on its platform. The central question before the Supreme Court is to address whether any new feature can be added to social media platforms such as WhatsApp to enable the tracing of the originator of information. Here, the government of India had submitted that the Intermediary Rules would be notified in January 2020. The last hearing took place in January 2020, when the notification was still awaited.

Is switching to alternatives like Signal or Telegram a solution to this issue?

If users don’t want to worry about ever changing privacy policies or metadata issues, it’s better to switch to a messaging service that does not collect any data to begin with, like Signal. Therefore, there will be nothing to share with the government.

Given the current scenario, what do you think is an optimal solution to the standoff between social media companies and the government?

This is a theatrical distraction where both the government and the companies are making disingenuous arguments without protecting user rights. In 2021, we should not still be making naive and uninformed public arguments of national security vs privacy. The right to privacy must be protected and crimes can be solved with better metadata analysis.

The heavy-handed ways in which the government has been behaving in shaping the narrative and curbing dissent make even genuine attempts at regulating big tech suspicious.

On the other hand, the “we are only a sales office” argument displays a misleading jurisdictional argument by the companies who seem to suggest that it is all right to monetise Indian’s data but when it comes to participate in the legislative consultation process, they will use every excuse in the book to dodge real engagement.

What should be the guiding principles in formulating a good social media policy for the government?

The government must remember that it’s important to regulate big tech but not at the expense of user rights. There is a huge trust deficit between all stakeholders owing to the actions of the government and inaction of the companies. We must work on that with the active participation of civil society actors. The government should stop conflating several matters, i.e. of content moderation, misinformation, privacy and anti-trust. Instead of blustering bravado and rodomontade through letters and media, competent policy making should be adopted, which is possible by working with engineers, policy experts, and civil society.