The government’s move to amend Section 79 of the Information Technology Act, 2000, has primarily drawn a thumbs down from the industry as well as activists who are of the view that most of the amendments proposed will curb internet freedom and privacy while increasing compliance for intermediaries. Industry associations representing information technology (IT) companies, telecom operators as well as internet companies said many of the proposed changes are not required as the existing laws are enough to tackle problems. A majority of them rejected the amendment regarding the tracing obligation.
“We suggest that the requirement to enable tracing the originator of content does not appear to meet the tests of necessity and proportionality and should be deleted,” Nasscom said in its submission to the ministry of electronics and IT (MeitY). The government is trying to amend the Act in a manner that social media platforms such as WhatsApp, Facebook, or Google as well as other intermediaries would have to comply with its direction on providing information and assistance within 72 hours of a request made with regard to the origin of any content deemed unlawful and remove it.
For a change, even the telecom industry has agreed with its counterparts in the technology sector on the issue, saying that the tracing obligation is deeply problematic from a privacy perspective and would be difficult to operationalize, given that the intermediary does not control or monitor content. “This requirement would not be applicable to telecom companies as the same may not be practically possible to implement as in case of information that flows through a series of intermediaries, each intermediary would only be able to assist to the extent of the origin of the information at their end,” COAI said.
Reliance Jio, which is also a member of COAI, differs though. The newest entrant in the telecom space said the government must take all the steps to tackle the problem of fake news and ignore the protests that mandating platform service providers would violate speech and expression. The telco said fake news and rumors often threaten peace, harmony and social fabric of the country and hence, it becomes imperative that originators of such misleading information be identified and held accountable.
“We strongly recommend that the intermediary should enable tracing out of originator of such information on its platform, which will help government agencies identify the originator and hold them accountable in order to maintain cyber security, required for national security and prevention of offense,” Reliance Jio said.
However, COAI said the obligation undermines the uses of encryption technology, which ensures that content is not accessible to the intermediary or third parties. “Thus, placing the obligation of tracing on an intermediary creates a restrictive regime which seeks to dictate the underlying technology governing the intermediary’s business,” it said. The basic elements of the proposed changes are that social media platforms, apart from being required to give information and assistance to any government agency within 72 hours of request, will also need to trace the originator of the information on their respective platforms; the platforms will need to remove access to “unlawful acts” as ordered by an appropriate government agency; and the platforms need to deploy automated tools to remove, disable access to unlawful information or content.
Further, such rules will apply to social media platforms having more than five million users and they need to have a permanent registered office in India and appoint a nodal point of contact for 24×7 coordination with law enforcement agencies. As per Internet and Mobile Association of India (IAMAI), asking intermediaries to assist in investigations and enable tracing cannot be a condition for intermediary rights while US-INDIA Business Council said absolute traceability and attribution is not technically feasible in all instances. In order to protect privacy and prevent cybersecurity breaches, some products utilize encryption features that preclude or severely limit the ability of intermediaries to track and trace content.
The US-INDIA Business Council further said it is important that intermediaries are responsive to lawful orders in a timely manner. However, the insertion of “within 72 hours of communication” may be unreasonable in certain situations. It has also been brought to the notice of the government that there are several intermediaries who are already regulated under the law. For example, payment intermediaries are regulated by Reserve Bank of India and telecom service providers by the Department of Telecom. Many of the obligations under the applicable laws are even more stringent that the intermediary guidelines 2011.
About the requirement to have a physical presence in India, Nasscom said it may act as a disincentive for platforms to enter the Indian market and deprive Indians of access to foreign platforms. “Such a policy would go against the ethos of free and open internet. We believe this would also have the unintended effect of reducing competition in the digital economy,” Nasscom said.
The requirement to have a physical presence in India is likely to give rise to tax concerns for such intermediaries which in turn would impact the cost of doing business with the end consumers eventually bearing the burden.―Financial Express