New rules for online intermediaries, social media companies, and media sites present a serious challenge to India’s democracy

On February 25, 2021, the Government of India released new rules for online intermediaries, social media companies, and media sites. The 15-page regulation severely limits free speech, privacy, and a free press by increasing the government’s ability to censor content it doesn’t like, undermining the encryption of services like WhatsApp and Signal, and instituting a dubious “Code of Ethics” for online news sites. While many of the new rules are likely unlawful and unconstitutional, and sure to be challenged in court, they diminish India’s democratic credentials and restrict the rights of 1.3 billion people. For online intermediaries, India is transforming from one of the biggest growth markets to one of their biggest compliance challenges (as a result, some companies may leave the market altogether). Given how many countries look to India for leadership on internet policy issues, these regulations could have global ramifications.

These rules are being enacted in the wake of a public spat with Twitter over a recent order to block more than 1,400 accounts tied to the unprecedented farmer protests rocking India’s capital for the last several months. In response to the order from the Government of India, Twitter blocked, then unblocked, and then finally reblocked most of these accounts. That said, the Government of India has been threatening new intermediary liability rules for a number of years now, and this final version is better in some respects (in that it generally uses more narrow definitions and requires court orders and due process associated with many provisions) and worse in others (it grants the government greater powers to edit and censor news content it doesn’t like).

Notably, the last draft version of the rules leaked just hours before the final rules were enacted had exempted intermediaries that enable commercial or business-oriented transactions, provide access to internet, search engines, online directories, or online storage services. The final rules contain no such exemptions, suggesting the government deliberately intends to apply these new rules to such services. The definition of social media intermediary is quite broad: “an intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information using its services’’ which could ensnare many more companies than Facebook and Twitter.

Unlike previous Indian internet regulations, including previous versions of intermediary liability rules, there was no public consultation this time. While the rules are now officially in effect, many of the most dangerous and onerous provisions have a three month implementation period, meaning there may be a short window to influence what comes next. These new rules should be ringing alarm bells for Indian citizens, online intermediaries doing business in India, and India’s democratic allies, alike.

Below is an explanation of a few of the most concerning provisions:

Threat to encryption: The rules would require “significant social media intermediaries providing services primarily in the nature of messaging” (think WhatsApp and Signal, but also potentially Facebook and Twitter) to be able to identify the “first originator” of a piece of content in response to a court order or an order under the IT Act. It is not feasible to implement this provision without weakening the protections of end-to-end encrypted messaging. A new provision in these rules is a requirement that where the first originator is not in India, the intermediary must be able to identify the first originator in the country, which makes an already impossible task more difficult. The new rules do helpfully require that the government exhaust all other less intrusive means of investigation before issuing a traceability order. This issue has already been playing out in the Madras High Court and the Supreme Court of India for a few years in cases involving WhatsApp, and will definitely be challenged in court.

User verification: In a dangerous move for the privacy and anonymity of internet users, the new rules contain a provision requiring companies to provide the option for users to voluntarily verify their identities. While the rules mention phone numbers, this will likely entail users sending photos of government issued IDs to social media companies. In the past, there have been reports that intermediaries will have to report accounts that do not verify themselves using such procedures to the government, which could make them a target for government scrutiny and investigation. This provision will incentivize the collection of sensitive personal data from government IDs that are submitted for this verification, which could be used with the user’s “express consent” to profile and target users (which could arguably be accomplished by adding a clause to a platform’s terms of service). This is not hypothetical conjecture, as we have already seen phone numbers collected for security purposes being used to target ads. This provision will also increase the risk from data breaches and entrench power in the hands of large players in the social media space who can afford to build and maintain such verification systems. There is no evidence to prove that this measure will help fight misinformation (its stated intention), and it ignores the benefits that anonymity can bring to the internet, such as whistleblowing and protection from stalkers.

Censorship: Within 36 hours of receiving a court order or an order from an authorized government agency, an online intermediary must remove or disable access to content that is unlawful, immoral, or indecent (among other categories). While the Indian government already has pretty broad powers under the IT Act, this further clarifies that the government can effectively censor whatever information it doesn’t like.

24 hours to take down revenge porn and deep fakes: The new rules also require all online intermediaries, in response to a request from an individual, to take down any sexual content depicting that individual or “is in the nature of impersonation in an electronic form, including artificially morphed images of such individual” (think deep fakes). While these are real and important issues, many online intermediaries do not have the operational capacity to respond in 24 hours to such requests and there are no exceptions (e.g., satire). Allowing users to demand content takedowns would also seem to contravene the Supreme Court’s precedent in Shreya Singhal, which generally requires a court or government order to remove content.

Proactive monitoring: Significant social media intermediaries — defined as a social media intermediary with more than 5 million registered users in India — “shall endeavor” (which could mean it’s voluntary) to deploy technology-based measures such as automated tools to proactively identify information that depicts rape, child sexual abuse, or any information that that is “exactly identical” to information that was previously removed or access to which was disabled. Although they are not well-defined, there are some important limitations around the use of automated tools, they must be:

• Proportionate with regard to free speech and privacy;
• Subject to human review; and
• Evaluated with regard to the accuracy and fairness of such tools, the propensity of bias and discrimination in such tools and the impact on privacy and security of such tools.

Presence in India: Under another particularly onerous provision, significant social media intermediaries will have to appoint/hire several senior managerial employees resident in India to serve as Chief Compliance Officer “responsible for ensuring compliance with the Act and rules made thereunder and shall be liable in any proceedings relating to any relevant third-party information, data or communication link made available or hosted by that intermediary where he fails to ensure that such intermediary observes due diligence while discharging its duties under the Act and rules made thereunder”, a Resident Grievance Officer, and “appoint a nodal contact person for 24×7 coordination with law enforcement agencies and officers to ensure compliance to their orders or requisitions made in accordance with the provisions of law or rules made thereunder.” This is effectively a backdoor to data localization. Some companies will comply and thereby accept legal process in India and be subject to other Indian laws, and others will likely choose to leave the market rather than be bound by these rules and other regulations in India. Companies who continue to operate in India are likely to be much more susceptible to government pressure.

Media Code of Ethics: The rules also include a new Code of Ethics which applies to publishers of news and current affairs content, dangerously also including news aggregators, and publishers of online curated content which operate in India or conducts systematic business activity of making its content available in India. While print newspapers are seemingly exempt, this would apply to online news sites as well as streaming services like Netflix and Amazon Prime as well as the curated sections of otherwise user-generated content platforms like YouTube Originals and Facebook Watch. While there are some provisions establishing a self-regulatory process, at the end of the day, the government itself or any user can appeal to a new Inter-Departmental Committee, consisting of representatives from the Ministry of Information and Broadcasting, Ministry of Women and Child Development, Ministry of Law and Justice, Ministry of Home Affairs, Ministry of Electronics and Information Technology, Ministry of External Affairs, Ministry of Defence, and such other ministries and organizations, including domain experts, that it may decide to include in the Committee.

The powers of this Committee include:

a. warning, censuring, admonishing or reprimanding such entity; or

b. requiring an apology by such entity; or

c. requiring such entity to include a warning card or a disclaimer; or

d. in case of online curated content, direct a publisher to —

i.reclassify ratings of relevant content; or

ii.edit synopsis of relevant content; or

iii.make appropriate modification in the content descriptor, age classification and parental or access control;

e. delete or modify content for preventing incitement to the commission of a cognisable offence relating to public order

This code is ripe for abuse and an attack on the free press. While there are some procedural hoops to jump through, the government would effectively be able to edit or censor any unfavorable coverage from directly on online news outlets, new aggregators, or via intermediaries by arguing that an article threatened public order, among other nebulous criteria.

A separate section of the new rules also requires publishers of news and current affairs content to provide the Ministry of Information and Broadcasting with “the details of their accounts” on various online intermediaries, which makes it much easier for the government to keep tabs on the free press.

Overall, this is another worrying step backward for free expression, privacy, and a free media in India. While many of these new rules will be challenged in court, it’s unclear if the courts will stay implementation as these cases proceed. One of the things that makes this development so concerning was the speed with which these new rules were presented, skipping over any parliamentary or public debate. Urgent action within India and from India’s democratic allies is needed to limit this blow to the world’s largest democracy. The Indian Parliament comes back into session on March 8th. Its Committees on Subordinate Legislation have the power to review and modify these rules at their discretion, and should take it up as a matter of urgency. It is critical that the international community urge the Indian government to suspend the implementation of these rules; remedy their legal, constitutional, and practical defects; and do a proper public consultation.

Jochai Ben-Avie is Non-Resident Fellow at the DFRLab and former head of international public policy at Mozilla.

Follow along for more in-depth analysis from our #DigitalSherlocks.