Four reasons to be worried about India’s new IT rules that are supposed to regulate Big Tech

The Indian government’s new Information Technology rules may have been sold to citizens and the world as being of a piece with global efforts to rein in Big Tech and put a check on social media companies that many now see as being a danger to society. But the very first notice issued under the new rules this week gave us a glimpse of how they are actually likely to play out.

A journalist in Manipur on Monday was issued a notice, signed by a magistrate and delivered to him by the police, ordering him to “ furnish all the relevant documents showing that you ensure compliance of the provisions [of the new rules]... failing which steps as deemed fit shall be initiated without further notice”.

According to Paobel Chaoba, the journalist, the notice was a response to an online discussion uploaded on the Facebook page of The Frontier Manipur covering the new IT rules, titled “Media Under Siege: Are Journalists Walking a Tight Rope?”

A little while later, the notice was withdrawn, after Union Information and Broadcasting Secretary Amit Khare wrote to the Manipur Chief Secretary Rajesh Kumar saying such an order could only come from the Union Ministry of Information and Broadcasting, and not from a local magistrate or the police.

But the incident made it evident how authorities around the country are likely to see, and potentially use, the new rules – as a way of exerting more control over speech and expression on the internet, rather than as a check on technology giants.

For background, this explainer, by the Internet Freedom Foundation, goes into details about what the new rules say and what they mean for India.

But here are the very broad brushstrokes:

• Online platforms now have to be much more responsive to complaints about posts on their networks, including giving the government details about the ‘originator’ of content – effectively breaking end-to-end encryption – as well as setting up verification systems that could have a major impact on individual privacy.
  
• The rules go beyond internet platforms to also cover digital news organisations and video-streaming platforms like Netflix or JioTV, giving the government much more power to intervene, censor and re-classify online material.

The new rules have already received some praise from pro-government voices and much criticism, and their impact will start to become clearer as they are implemented as well as challenged in court.

But here are four reasons why citizens ought to be wary:

1. No legislative process

There is a reason these are “rules” and not “laws”. The government has made massive changes to the way the internet will work in India, but without having to take the matter to Parliament at all, by amending the rules under pre-existing sections of the law.

Some of that may be defensible, although lawyer Prashant Reddy has argued that “the legislative history of Section 79 [of the Information Technology Act] makes it clear that the government lacks the power to impose preconditions on internet intermediaries looking to enjoy the immunities offered by Section 79”.

But even if you accept that the government has the power to put conditions on online platforms, the expansion of the rules to cover and potentially censor digital news organisations and video streaming portals has no basis in the original laws.

As the recently passed farm laws have shown, even moving legislation through Parliament is no guarantee that of fruitful discussions and legislative safeguards. But the fact that the government has bypassed the legislative route altogether should be a warning sign.

2. No consultation

Another similarity between the farm laws and the way the government has approached this process is its unwillingness to engage with the stakeholders that matter, particularly in expanding the ambit of the rules to cover digital news organisations and online streaming services.

As Internet Freedom Foundation executive director Apar Gupta wrote,

“The purview of the Information Technology Act, 2000, is limited. It only extends to the blocking of websites and intermediary liabilities framework, but does not extend to content authors and creators. Hence, the Act does not extend to news media despite which it is being stretched to do so by executive fiat. This may seem like legal semantics but all of this visits itself in terrible outcomes...

The substance of many of the requirements were never put to public consultation or deliberation by experts. This is particularly the case for the regulations for online news portals and video streaming platforms. On these aspects, there has been opacity.”

3. Expansion of executive powers

In the government’s telling, the new rules create a system that would allow complaints about various pieces of online content to be addressed with minimal interference from the state. But in reality, the rules create a bureaucratic super-structure that gives the executive much more power over the regulation of the internet online.

As the IFF explainer points out, for example, though there is a “self-regulatory body” that will oversee complaints regarding digital news organisations and video-streaming platforms, the Ministry of Information and Broadcasting retains the power to approve the composition of this body.

And, one step above this body is an “Inter-Departmental Committee”, consisting of representatives from various ministries, which will have the power to give warnings, order publishing of disclaimers, insist on apologies or even censor material online.

Though the government already had the power to do some of these things, Access Now’s Raman Jit Singh Chima writes that the new rules give the state a pathway to censor material without having to deal with the criticism that it has engendered in the past:

“Why has the Union Government created this legally uncertain, sprawling house-of-cards-like regulatory instrument? To understand these new Internet content control rules — for that is what they essentially are — you need to not only see what they directly give to the government, but what the government is seeking to get done behind a shadow of regulatory pressure.

It appears that the government wants to send a message to all Internet ecosystem players that they desire compliance with their desires — formal or informal — regarding what content should be taken down, along with a removal of any push back against over broad demands for user data and other surveillance orders by government agencies... 

Indicating that the government has made up its mind to force these mandates by notifying them, even with doubtful legal validity, is a key signalling effect to Internet ecosystem players, especially firms keen to avoid public battles and smaller entities who do not have the resources or political position to be able to contest overboard government directives.”

4. What about privacy?

In 2019, the government tabled a Personal Data Protection Bill in Parliament. Even though the massive exemptions afforded to government surveillance in the bill were described as “Orwellian” by Justice BN Srikrishna – whose initially report formed the basis of the law – it at least sketched out the basis of a privacy law for Indian citizens.

The fact that, in 2021, the government is continuing to bring in new regulations regarding the digital space without yet having passed a privacy law relects its governance priorities.

The new rules, in fact, have a major potential impact on privacy in particular through the requirements for internet platforms to trace the ‘originator’ of information, essentially banning the use of end-to-end encryption by services like WhatsApp.

They also insist that large online platforms have a system of identity verification, which would “likely entail users sharing phone numbers or sending photos of government issued IDs to the companies” and could “incentivize the collection of sensitive personal data that are submitted for this verification, which can then be also used to profile and target users”.

With no privacy law in sight and new government rules that undermine that fundamental right, citizens ought to be concerned about the way the state is observing all online activity.