WhatsApp’s fight with India could have global repercussions

WhatsApp is a bat for the privacy of the citizens of the world’s largest democracy. This week, the Facebook-owned messaging platform sued the Indian government in an attempt to challenge new IT rules that require messaging apps to trace the “first author” of a message. This could force WhatsApp to weaken its end-to-end encryption, revealing the identity of senders and affecting the security of its 400 million users in India – and possibly billions more around the world.

While it is difficult to assess the possible outcomes of the trial, it could potentially dictate the type of communication technology and online security spaces available to Indians in the future, and could set a precedent for what other governments would require not only WhatsApp but other messaging apps as well. Complying with these rules would endanger the fundamental right to privacy, experts say, because undermining encryption for one would mean doing it for all. End-to-end traceability and encryption cannot coexist.

India’s internet regulations for social media platforms, messaging apps, online media and video streaming services were passed by decree in February. The platforms had three months to comply, the deadline for which ended earlier this week. One of the new guidelines requires messaging platforms with more than 5 million users in the country – which includes not only WhatsApp but Signal as well – to allow identification of the first source of information if a court or agency government decision requires it. For content that started outside the country, these services are required to identify its first instance in India.

Currently, providers of end-to-end encrypted platforms such as WhatsApp and Signal cannot see what messages contain, which means they cannot track specific content. Having to keep messages traceable would not only mean treating each individual as a potential criminal subject, but it would also be onerous for the company to keep large amounts of data.

“Traceability will force end-to-end encrypted platforms to change their architecture in a way that will negatively impact online privacy and security. They will need to develop the ability to track who sent which message to whom and to store this information indefinitely, ”said Namrata Maheshwari, technology policy advocate. “This is an onerous obligation that seriously undermines end-to-end encryption and endangers the privacy, security and freedom of expression of users.”

The Indian government says its intention is not to violate anyone’s privacy and that tracing will only be used “for the prevention, investigation or punishment of very serious offenses related to sovereignty and integrity of India, state security, friendly relations with foreign states, public order or incitement to an offense relating to the foregoing or relating to rape, sexually explicit material or child sexual abuse material. “

But these definitions leave a lot of room for interpretation. The government could track down someone who is spreading dangerous misinformation, but it could just as easily use that power to track how political content flows between individuals or to hunt down activists and political opponents.

“As soon as you create a system that can go back in time and unmask a few people submitting content, you’ve created a system that can unmask anyone who submits any content,” says Matthew Green, cryptographer at Johns Hopkins University. “There is no such thing as simply collecting information from bad guys. It is very dangerous to start revealing this information because you don’t know where it will end. “

This is not the first time that such a request has been made to WhatsApp. The platform faces a similar call from Brazil, its second market after India. Other countries, including the United States, Canada and the United Kingdom, have also pressured WhatsApp to weaken its encryption. But this is the first time that the traceability requirement has been officially imposed, and on the platform’s largest market.

–

.

–