The TLDR: The government released draft guidelines that will soon become law—and they will likely change the landscape of your online world. Experts are still working through the implications of the so-called “soft-touch oversight mechanism” unveiled yesterday. Here’s what we know as of now.

PS: This is in addition to the move in November to impose new foreign investment rules on digital news, and move all digital content (including streaming) under the Information & Broadcasting ministry—which we explained here.

Encryption of messages

The new rule: reads as follows:

"A significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction or an order passed under Section 69 of the Act by the Competent Authority as per the Information Technology (IT) Rules, 2009."

What this means: If X sends a message to Y who then forwards it to many others, the government can force WhatsApp, Signal or any other messaging service to reveal the identity of X. If X resides outside the country, then Y is viewed as the “first originator.” To be clear: the government only wants the identity of the sender, not the content of the message.

And all the government needs to make such a demand is either a court order or simply the powers afforded by the IT Act—which recently allowed the government to direct Twitter to block and/or delete accounts without notification (explained here).

Of course, the government insists it will only do so for the purposes of:

"...prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years."

The implication: Privacy experts say there is no way any messaging service can comply with this rule without weakening end-to-end encryption—and it will take extensive reworking of their encryption systems. Right now, WhatsApp does not ‘see’ or store what you send to anyone else—and it does not link that message to your identity. The head of the Internet Freedom Foundation says:

"Traceability will break one of the core values of end-to-end encryption, which masks the identity of a person with respect to the message content, which is what allows people to have private conversations over instant messaging apps."

Point to note: Facebook issued a statement welcoming the new rules, and emphasised its commitment to the “user safety and security”—but also “people’s ability to freely and safely express themselves on our platforms.” It isn’t clear yet where they will come down on WhatsApp’s privacy guarantees.

Streaming content

The platforms will have to create and prominently display content labels for five age-based categories—U (Universal), U/A 7+, U/A 13+, U/A 16+, and A (Adult). And there have to be parental controls and age verification for adult content. More importantly, they will have to set up a three-tier “grievance redressal system”:

Level 1: requires self-regulation by the company—which will include chief compliance officer, nodal contact person and a resident grievance officer. All three will be citizens of India and reside within the country. They have to acknowledge all complaints within 24 hours, and deal with them within 15 days.

Level 2: Any complaint not satisfactorily dealt with at Level 1 will be sent up to Level 2—an industry-wide organisation headed “by a retired judge of the Supreme Court, a High Court or independent eminent person and have not more than six members.” This body will have the powers to censure a platform and demand that content be deleted or modified.

Level 3: An inter-ministerial committee sits at the very top and has overriding powers in the form of an “oversight mechanism” to censure platforms or insist they delete or modify their content. Also this:

“Over and above all this, the government has equipped itself with ‘emergency’ powers. The rules state, ‘in case of emergency nature’ the Secretary, Ministry of Information and Broadcasting may, ‘if he is satisfied that it is necessary or expedient and justifiable’ give orders to block public access of any information. The rules state that he or she has to record the reason for doing so in writing and it will be an interim measure. Importantly, such orders can be released ‘without giving an opportunity of hearing’ to the publishing platform.”

Implication: Given the vast number of easily offended people in our country, it is easy to see how this will quickly create an ongoing nightmare. More worrying will be a chilling effect—where platforms like Netflix etc. will self-censor in advance to save themselves any potential headaches.

Social media

The government makes a distinction between “significant”—with more than 50 lakh users—and regular social media platforms. One assumes the made-in-India Koo will not be deemed ‘significant’.

The significant platforms will also have to set up the three-tier system explained above. And the government laid out ten categories of content that they absolutely must not host on their platforms:

“These include content that ‘threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognizable offence or prevents investigation of any offence or is insulting any foreign States’; ‘is defamatory, obscene, pornographic, paedophilic, invasive of another’s privacy, including bodily privacy; insulting or harassing on the basis of gender; libellous, racially or ethnically objectionable; relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws of India.’”

Point to note: A court or the appropriate government agency will notify the platform when any content fits the above criteria—and it must be removed within 36 hours.

No safe harbour: The Information Technology Act provides a “safe harbour” to intermediaries that host user-generated content—and exempts them from liability for that content. But now if they fail to comply with these rules, they will lose that protection—and be punished with both jail terms and fines as per Indian law.

Implication: So now the government has the right to demand Twitter or Facebook to take content down. And if they fail to do so, its own ministerial committee will decide the fate of its grievance. Wah!

Digital media

Saving the best for last… lol! 

One: For starters, digital news media publishers will need to follow rules that apply to print and broadcast. They will now also be governed by the Press Council of India Act and Cable Television Networks Regulation Act.

Two: According to Hindustan Times, a news publisher operating in India will be classified as “significant” if it has at least 500,000 subscribers or 5 million followers. These will have to register with Broadcast Seva, a government run portal that operates under the ministry of information and technology.

Three: Digital news sites also have to put in place the three-tier self-regulation system. As of now, it is unclear whether the requirement for grievance officers etc. applies to all outlets, irrespective of size. But the system clearly empowers the self-regulatory or the ministerial committee to block access to news content or even a site—based on a complaint. 

The implication: It gives the government unparalleled powers of press censorship. And it places a huge compliance burden on independent digital news outlets—many of whom are small with limited resources.

The big legal ‘but’

The original IT Act was passed by Parliament to supervise third-party intermediaries—platforms that host user content. Using that law to censor or block content on streaming platforms and digital news sites may not be constitutional. The Internet Freedom Foundation points out:

“The purview of the Information Technology Act, 2000 does not extend to news media, and so the guidelines do not have the legislative backing to regulate news media. Thus, these Rules are exercising powers far beyond the parent legislation… The vague definition of ‘publisher of news and current affairs content’ may also lead to further arbitrariness.”

Freedom of the press is protected by Article 19 of the Constitution—which also proscribes its limits, as The Wire founder Siddharth Vardarajan makes clear:

“The Indian constitution does not grant the executive the power to sit in judgment over the suitability of content published by the media. Granting an inter-ministerial committee of bureaucrats the power to pass judgment on whether a media platform has responded adequately to grievances raised by members of the public has no basis in law… The media cannot be compelled to address ‘grievances’ that go beyond that Lakshman Rekha.”

The bottomline: If these rules remain unchallenged, they will radically limit what all Indians can watch, read or say.

Reading list

The Internet Freedom Foundation has a detailed report on the rules—with context and background. The Hindu has the most details on the three-tier redressal system. Hindustan Times looks at the rules for digital media. Times of India talked to the critics of the new rules. Indian Express looks more closely at the implications for social media, while The News Minute examines the issue of encryption.