India wants WhatsApp to break encryption and trace inflammatory messages. Should it?

India – or at least the Indian government – is not happy with WhatsApp. The messaging service claims to have 250 million monthly active users in the country, giving it a user base that is larger than many countries. Consequently, this means its reach is remarkable. But its popularity brings with it tremendous scrutiny and criticism. From being a surprisingly useful, free tool of communication to turning into a source of annoying forwards and then being blamed for mob lynchings across India, WhatsApp’s image in the country has changed dramatically over the last year. All the criticism and scrutiny, and the lives lost, have prompted the government to say it will step in.

Last week, it emerged that the American messaging service owned by social network behemoth Facebook had in August appointed a grievance officer after both the Indian government and the Supreme Court demanded the company improve its approach to safety. Over the past few months, in fact, WhatsApp has made a number of changes to its software, including making it harder and more apparent when individuals are forwarding messages. In August, the company also kicked off radio and newspaper campaigns asking people to be skeptical of news received through social media and messaging services like WhatsApp.

Much of this is a response to the mob lynchings that took place in a number of Indian states in the wake of rumours of child lifters, which were often accompanied by fake videos. Although television channels and other social networks also played a role in distributing this material, WhatsApp – because of its seeming ubiquity and the ease with which videos were forwarded through it – was blamed for the deaths of at least 29 people. In July, the government specifically asked WhatsApp to “take immediate steps to tackle the menace of misuse of their platform wherein inflammatory messages were circulated that led to unfortunate incidents”.

The messaging company did take some steps, and sent Chief Executive Office Chris Daniels to India to meet Telecom Minister Ravi Shankar Prasad. But even that may not be enough. Prasad’s ministry is reportedly considering sending a third notice to WhatsApp, asking it to bring in “traceability” of messages on the service.

Mass communication

The problem is essentially this: WhatsApp is huge. Even if its claim of 250 million active monthly users in India is something of an exaggeration, it still means its reach is tremendous. The spread of smartphones, coupled with the cheap data revolution ushered in by Reliance Jio, has expanded its penetration massively in the last two years alone.

And, crucially, WhatsApp is not just a person-to-person messaging service. It allows you to create groups, which can feature as many as 256 people at the same time. Put 10 of those together, and copy paste a message into each one, and suddenly in a matter of seconds you have sent the same message to thousands of people. The company insists that this is not how most people use the app, with a spokesperson saying nearly 25% of people in India are not in a group, the “majority of groups continue to be small [less than 10 people]” and that nine in 10 message sent are directly from one person to another.

Yet, group messaging is still massive, and has becoming one of the core reasons WhatsApp is popular. It, in fact, is how political parties are using the medium. But it is also how fake news spreads. And that ability to broadcast messages to a large group of people is what has turned a spotlight on the messaging service.

“If you look at any other mass communication service, including newspapers, they need to get themselves registered under the law,” said T Prashant Reddy, an assistant professor at the NALSAR University of Law, who says WhatsApp should not only be looked at as a messaging service. Reddy added, “TV, radio, newspapers, these are all heavily regulated. It’s not only state interest, there is consumer interest involved in a lot of this. If you are being defamed on a mass communication platform, you need to know who is responsible for it.”

Traceability of messages

The government would like to trace the origins of certain messages on the service, with the official reason being that it will help them combat illegal speech. The difficulty comes with WhatsApp’s design. All messaging on the service is encrypted, end-to-end. That means the company itself cannot read the content of messages sent by users. And it says it does not plan to break that encryption either.

“People rely on WhatsApp for all kinds of sensitive conversations including with their families, doctors, and banks,” a spokesperson for the company told Scroll.in. “Building a mechanism to track the author of every message would have global implications for people’s privacy and create the potential for serious misuse. WhatsApp will not weaken the protections we provide.”

Some see this as a credible stand to take, and argue that the government is simply turning WhatsApp into a scapegoat for what is otherwise a law and order problem. “Some of the identities of the victims [of mob lynchings] demonstrate that their distinction from the local communities and lack of power, their ‘othering’, and absence of state protection were significant factors in the distrust which rose to the level of organised mob violence,” wrote lawyer Apar Gupta earlier this year. “However, due to the framing of the instant problem as primarily technological, the onus for policing and public broadcasting has been primarily placed on WhatsApp.”

Whose fault?

Gupta specifically points out that shifting the blame to the messaging service does not just let the government pass the buck, it also creates an atmosphere that is conducive to letting the government intrude into what was otherwise a private space. But Reddy argues that this privacy argument is something of a facade, since it hides the fact that WhatsApp prefers to run as a low-cost operation with as few employees as possible and no liability for the material that turns up on its service.

“They say they’re trying to protect your privacy but by doing away with knowledge of what is being said, they are also getting out of legal liability,” Reddy said. “If there’s no knowledge, they can’t be liable. That reduces their compliance and operating costs massively. You basically don’t have to comply or cooperate with anyone in the government.”

He argued that this should not continue. Technology policy has evolved over the years to allow for companies like Facebook and Twitter to not be held liable for the material that users post on them, in part because the source of that content can be tracked. WhatsApp falls under the same laws, but adds encryption to it. In Reddy’s view, this means it should be treated differently from other technology companies and be held liable for any potentially illegal speech.

“They can continue to hide behind encryption, but then it is not necessary for the law to give them the same immunity that we give Facebook or Google... Unless you can find a way to track harmful speech,” he said.

And indeed, there are suggestions that the Indian government is thinking along the same lines. Vinay Kesari, a lawyer who specialises in technology law and policy, in an article this month pointed to a number of statements by authorities suggesting that India might alter its approach and put more liability on these platforms. “The government could be trying to interpret the law to mean that failure to implement adequate safeguards or tools to prevent the viral spread of inflammatory messages could be seen as the abetment of their spread,” Kesari wrote. “Taken together, these statements provide a strong indication that changes could be around the corner. The question is how far-reaching or radical they will be, and whether they will be applicable to all intermediaries, or only messaging platforms.”

Other options

Indeed, the suggestion of new laws might also be used by the government as leverage in convincing WhatsApp to break encryption and permit traceability. But some suggest there is middle ground between the two. Earlier this year, MediaNama’s Nikhil Pahwa suggested changes to the software that would not necessarily involve breaking encryption, especially on one-to-one chats, while adding more accountability for mass messages.

Himanshu Gupta, who formerly worked for WhatsApp competitor WeChat and is now head of growth at a fintech start-up, and Harsh Taneja, an assistant professor in the College of Media at the University of Illinois Urbana-Champaign, wrote a paper this year suggesting that the messaging service could add in traceability without breaking encryption.

In the paper, Gupta and Taneja argue that WhatsApp keeps copies of the most commonly transferred pieces of content, like videos, on its own server. If individuals can flag that content, and it is then fact-checked, WhatsApp would be able to attach a warning every time someone shares the same content, without breaking encryption.

“WhatsApp already has a pretty aggressive feature for fighting spam,” said Gupta. “You can report spam. And they are strict about it. They can easily build this also... You will not have to break encryption to do what we’re suggesting. It’s worth it in the interest of democracy and the platform.”

‘Conversation has shifted’

In response, the WhatsApp spokesperson brought up Gupta’s past, and said that there were technical issues with the paper that would make what it was suggesting unimplementable. “It’s unsurprising that a former WeChat employee would support monitoring on a private messaging app,” the spokesperson said. “We strongly disagree with their approach as it would seriously weaken people’s privacy – with important global implications.” The spokesperson went on to say, “There are also several inaccuracies, the most glaring of them is that we do not retain a log of all messages being sent and their claim that WhatsApp ‘reads and stores parts of metadata of every message being sent on its platform’ – is just flat wrong.”

Gupta said he too is not in favour of breaking encryption. He said he was a supporter of Apple when it refused to give up data on a locked iPhone to American investigators in 2016, and that he would not have written this paper that year. But, with people dying, he said he sees the danger of companies like WhatsApp refusing to do anything about it, since it gives the government an excuse to intrude.

“I don’t think they have anything malicious in their approach,” he said. “I very much respect them and think they have built a great platform. But with the current environment, when there are bad actors in play, and when new internet users are coming in large numbers, they have a role to play.” He added, “The earlier conversation was more about government versus privacy. Right now, that conversation has shifted, because of the problem of fake news and people getting hurt... Platforms should cooperate and build these tools themselves before government forces them to.”