The government recently published suggestions and comments received on the Intermediaries Guidelines (Amendment) Rules issued in 2018.
What are the rules on?
Ministry of Electronics and Information Technology proposes to amend Information Technology (Intermediaries Guidelines) Rules under Section 79 of the Information Technology Act.
Intermediaries are entities that store or transmit data on behalf of other persons.
They include internet or telecom service providers, and online market places.
The Rules could have a far-reaching impact on the way social media websites, and the Internet as a whole, operate in India.
What are the key provisions?
Monitoring - The Rules make ‘intermediaries’ such as Facebook, Google, WhatsApp, and others responsible for actively monitoring the content they host.
All intermediary companies will have to deploy technology based automated tools or mechanisms for this purpose.
This should help in proactively identifying and removing or disabling public access to unlawful information or content.
Tracing - On issue of a lawful order, the intermediary shall, within 72 hours of communication, provide such information or assistance as asked for by any government agency.
The lawful order could be in matters of state security, cyber security, or investigation of any offence.
For many companies, the provision could mean choosing between breaking their end-to-end encryption in India and stopping the service in the country altogether.
Content - Earlier, it was only content that is grossly harmful, defamatory, obscene, etc that was to be filtered.
But now, in addition, intermediaries must also filter content that -
threatens public health or safety
promotes cigarettes or any other tobacco products or consumption of intoxicant including alcohol
promotes Electronic Nicotine Delivery System (ENDS) and like products that enable nicotine delivery
Any content which threatens critical information infrastructure is also not allowed under the new Rules.
Non-compliance - Companies will have to inform their users at least once every month that in case of non-compliance, their accounts and content would be removed.
However, companies are uncertain as to how exactly this would be achieved.
Registrations - All players with more than 5 million users in India have to be incorporated under The Companies Act.
The companies will need to have a permanent registered office in India with a physical address.
Besides the 5 million-plus firms, the provision can be extended to any intermediary, which is specifically notified by the Government.
What are the limitations?
Tracing - End-to-end encryption ensures that no one can read the messages shared between two users.
This includes government, third-party, cyber criminals, and the company itself.
For global end-to-end encrypted products like WhatsApp or Signal, tracing could create problems, besides forcing them to go against the core of what their product stands for.
The tracing rules could amount to making it impossible for these firms to work in India in their current nature.
Monitoring - For many startups in India, monitoring and removing content might not always be viable or possible, given the resources that would be required.
Open-source companies like Wikipedia, GitHub, and Mozilla have formally protested, especially for the guidelines on monitoring.
GitHub is an online repository of code, Wikipedia content is generated, edited, and moderated by users, and Mozilla’s Firefox is a popular open source browser.
They have argued that it would not be possible for them to employ automated tools to monitor “unlawful” content.
Registration - The 5 million-users specification is unclear whether they mean monthly active users or daily active users.
Notably, these are the key metrics that Internet companies use to define their user base.
A service that has 5 million monthly active users in India - users who log in once a month - might not see the sense in having an office in the country.
Given the limitations, there is widespread opposition to the rules from the telecom industry.
