🕹WhatsApp faces a tough choice in India

Privacy or Revenue?

I feel bad for WhatsApp. I really do. First, there was this whole public drama over its new privacy policy. Due to this blunder, WhatsApp ended by boosting its competitors- Signal and Telegram. Then, the Competition Commission of India(CCI) launched an antitrust probe into this new privacy policy of WhatsApp. In the middle of all this, the Indian govt delivered a knockout punch with its new law📜 that directly affected WhatsApp.

In today’s article, I’ll explain exactly why this new law📜 is a death punch for WhatsApp.


Hi friends I'm Shreyans and welcome back to another insightful💡(hopefully) and boring😴(definitely) edition of my newsletter.

If you’re new here, please subscribe. It’s free!

Let’s get started🚀🚀


🕹The name of this new law📜 is quite long:

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. So, I’ll be referring to it as the “new law📜” everywhere in this article.

The new law has 2 sections- one for social media companies like Facebook, WhatsApp, Twitter, etc, and the other for OTT companies like Netflix, Prime Video, etc. I will focus only on the first part.

The logic behind this new law📜 can be explained in one simple line:

Social media platforms have empowered ordinary users but they need accountability against its misuse and abuse.

The new law📜 has introduced some nice ways through which social media platforms can be more accountable to us.

  1. All platforms will have to appoint a Grievance Officer- this officer will receive complaints from users, and solve them within 15 days. For content related to nudity/sexuality, the deadline is much stricter- 24 hours⌚.

  2. The really big platforms(like FB, Twitter, WhatsApp, etc) have to follow some extra rules- they have to appoint a Chief Compliance Officer, Nodal Contact Person, and Resident Grievance Officer. The job of all these officers is similar- ensuring their companies are following the laws of India and helping law enforcement.

  3. Plus, these big platforms will also have to listen to our side of the story in case they block/remove our social media account.

  4. Once the govt or a court orders the big social media platforms to remove unlawful content, they’ll have to obey.

Until here, I was quite happy- the law has put a lot of emphasis on user welfare, and holding social media platforms accountable. If you look at the articles on news websites about this new law📜, none of them even mentioned its benefits. They immediately started criticizing it. I think it is important that we know the complete story here- the law isn’t all bad, it has lots of benefits as well.

Now, onto the problematic parts of the new law📜. Specifically, this phrase-

Significant social media intermediaries providing services primarily in the nature of messaging shall enable identification of the first originator of the information[…]

This one line, my friends, is the reason why every single news website is criticizing the new law📜. This is the reason why every news website is predicting the death of WhatsApp in India. The short version is this: this phrase will be good for law enforcement🚨, but bad for digital privacy.

Now let’s understand this phrase from the perspective of Govt. as well as WhatsApp.

🕹The Govt. Wants to help Law Enforcement:

I’m sure that at some point in time, all of us have received a “forwarded message” on WhatsApp that is obviously fake news. Maybe you saw this message in a WhatsApp group. Or a friend forwarded it to you. Because of WhatsApp’s strict privacy measures, we can’t know who wrote the original message. This is beneficial for criminal elements- they can spread fake news among people without the fear of getting caught.

But it’s a big headache for law enforcement: how will they identify the first originator- the person who created the fake news message?

That phrase in the new law📜 solves this problem- WhatsApp(and all other secure messaging services) will have to implement a way to find out the first originator.

The govt’s motive is completely logical- There are a lot of fake news posts on big social media platforms like FB and Twitter. On these platforms, tracking the first originator is easy. The govt simply requests info from the company, and it gets the details of the account. So why should WhatsApp be any different? There is a lot of fake news circulating on WhatsApp, and the new law📜 will help law enforcement identify the source of the fake-news messages.

🕹Understanding WhatsApp’s Perspective:

To keep the messages totally secure and private, WhatsApp uses an excellent system of encryption🔒 called End-to-end encryption(E2EE).

But if WhatsApp is forced to obey the new law📜, it will have to remove E2EE. This means zero privacy while chatting on WhatsApp.

In this case, it is pretty easy to imagine WhatsApp’s perspective: the new law📜 will take away everything WhatsApp stands for. Privacy is WhatsApp’s slogan. WhatsApp has earned people’s trust through its focus on privacy. This new law📜 is taking away all of this. Even if WhatsApp accepts this law and removes E2EE, what about the global fallout? People will no longer trust it. Other countries may also force it to remove the encryption🔒.

🕹Removing WhatsApp’s encryption🔒 is not the solution:

I completely agree with the govt’s motive: national security is no joke. Law enforcement🚨 needs info on criminal elements to safeguard us.

But I don’t agree with the way govt is approaching this problem- there is a line between digital privacy and national security. By forcing WhatsApp to remove its encryption🔒, that line will be crossed.

And we should remember that without encryption🔒, hackers and criminals👿 will easily gain access to our data.

Switching to Signal won’t work, since the new law applies to every messaging service.

Conclusion: breaking WhatsApp’s encryption🔒 is a bad idea. We need a solution that fulfills the new law📜 yet it doesn’t break WhatsApp’s encryption🔒. Kind of a middle-ground solution.

Good news😄: I found 2 such solutions on the internet🌐. Surprisingly, both of these solutions have been proposed by govt sources, which means the govt also wants a middle-ground solution to this problem. Let’s have a look at both these solutions.

Double encryption🔒:

This solution has been proposed by Professor V Kamakoti from IIT Madras, in response to an order by the Madras High Court. Here’s the short version:

Right now, WhatsApp encrypts only the message. Prof Kamakoti suggests that WhatsApp encrypts the phone number of the first originator along with the message. Only WhatsApp will hold the key to this second encryption🔒. When law enforcement agencies find a fake-news message, they can request WhatsApp to reveal the phone number of the first originator. WhatsApp will decrypt the second encryption🔒 of the required message, and turn over the details.

Hashing🔑:

This solution has been discussed by Rakesh Maheshwari from the Ministry of Electronics and Information Technology. It’s based on the concept of hashing. Here’s an explanation from Forbes India on how hashing works:

When a hard drive is seized, it is immediately hashed and the hashes are shared with both the prosecution and the defence. At a later date, if either side wants to confirm the integrity of the hard drive in question, they hash the hard drive again. A change in a single character of the hash would mean that the hard drive has been tampered with.

This concept can be used by WhatsApp to generate a hash value of every message sent on its platform. Every message will have a unique hash value. WhatsApp will store this huge pile of hash-values on its servers. When law enforcement agencies need to find the first originator of a message, WhatsApp will compare the hash value of that message with the huge pile of hash values it has stored. First originator identified🎯

🕹We understood the new law📜, its benefits, the problems with the new law📜, and potential solutions to these problems. Now what?

Now we wait for WhatsApp to come to a final decision. Note that these 2 solutions above aren’t officially discussed by WhatsApp. In fact, the head of WhatsApp has hinted that he will be forced to shut down WhatsApp in India if the govt doesn't withdraw the new law📜. He is adamant about keeping the encryption🔒 untouched. If you note, both the solutions I told above tamper with the encryption🔒, and make it less secure.

Here’s what WhatsApp said about Prof Kamakoti’s solution:

[Kamakoti’s solution would] wholly undermine [WhatsApp’s] end-to-end encryption as users would be afraid to freely express themselves if their private thoughts would forever be linked to their identities.

Even I’d feel uncomfortable in a world where every WhatsApp message I send can be traced back to me. But a world without WhatsApp is equally scary. It’s like choosing the lesser of the 2 evils😞


Share this article with a friend. I’m sure they’ll also find it informative!

Share

Thanks for being a subscriber! Bye-bye and enjoy your Sunday✨