IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 – A Vague Notion?

I. Introduction

The Government of India had framed the Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021, in February this year. These Rules require the social media intermediaries/platforms to adhere to a vastly tighter set of rules within three months, which ended on May 25. While finalizing these rules, both the Ministries of electronics and Information technology and Ministry of Information and Broadcasting undertook elaborate consultations among themselves to have a harmonious, soft-touch oversight mechanism in relation to social media platform as well as digital media and OTT platforms etc. Till now almost all major social media intermediaries have not adhered to all the requirements. It was reported that social media platforms such as Facebook, Instagram and Twitter were yet to comply with their obligations under the 2021 rules. This gave rise to an apprehension among users of such websites that these websites could either stop operations or be banned in India for such non-compliance. It is unlikely that the intermediaries will be banned from operating in India for non-compliance. However, it may render their operations non-viable as they may be required to proactively monitor their platforms to avoid incurring liability. Non-compliance can only make things worse, especially in a situation in which the relationship between some platforms such as Twitter and the Government seems to have broken down.²

While there are positive aspects about the said guidelines, there are equally, glaring ambiguities and susceptibilities that appear to conflict with the basic tenets of democracy and constitutional values. We believe that social media is broken. The large platform owes us accountability and user rights. But a recent draft government proposal we have accessed makes this problem worse. It will increase censorship and reduce user privacy. Also, we have provisions like Section 67, 67A & 67B of IT Act, 2000 dealing with ‘Obscenity’ where dilemma of deciding what amounts to ‘Obscenity’ and differ that from ‘freedom of expression’ is still there and including international intermediaries in its ambit will create operational hindrance and a vague grievance redressal mechanism.

II. What are it rules, 2021?³

The 2021 Rules supersede the 2011 Rules. In these rules, the requirement of publication of rules and regulations, privacy policy and user agreements which stipulate that no user shall post information which would contravene any law in force has been retained. The Supreme Court’s decision in Shreya Singhal versus Union of India⁴ on the point of actual knowledge has now been embodied in the rules.

The 2021 Rules also now permit the intermediaries to take down any unlawful information on a voluntary basis and such voluntary removal would not affect the protection afforded to them under Section 79 of the Information Technology Act.⁵

In addition to these general requirements, the 2021 Rules lay down additional due diligence requirements to be observed by “significant social media intermediaries. Any intermediary who primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify, or access information using its services and has more than 50 lakh registered users been classified as a significant social media intermediary. Thus, all popular social networking platforms such as WhatsApp, Facebook, Instagram, and Twitter would be required to observe these additional due diligence requirements.

These intermediaries were given a three-month timeline for ensuring compliance of these rules. Each significant social media intermediary is required to establish a grievance redressal mechanism and appoint three officers, viz, a Chief Compliance Officer who shall be responsible for compliance of the Information Technology Act and the rules framed there under, a Nodal Contact Person who shall be responsible for communication with law enforcement agencies and a Resident Grievance Officer who shall be responsible for the grievance redressal mechanism.

All these officers are required to be residents of India. Another obligation cast upon these intermediaries is to enable identification of the ‘first originator’ of any information on its platform. An order directing an intermediary to identify the first originator can only be passed for prevention, detecting, investigating, or prosecuting any offence relating to the sovereignty or integrity of India, its security and relations with other countries, public order and in relation to information depicting rape or sexually explicit material or child sexual abuse material.⁶

III. Social media, digital media and ott platforms – all ‘culprits’ at once?⁷

Recently, there were multiple disquieting media reports about possible legislation to regulate OTT platforms which stream curated content such as Netflix, Amazon Prime, Hotstar etc. This is especially concerning after a recent controversy over the web series Tandav, which is the latest in a long line of incidents in which there was public outcry over a perceived slight to religion beliefs. Acting on this Information and Broadcasting Union Minister Prakash Javadekar has recently stated that guidelines for OTT platforms are being considered by the Government. It seems that from December 2018 to February, 2021the Draft Intermediaries Rules, 2018 have now transformed into the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

‘Regulation’ of video Streaming Platforms

The first of the three big changes we are highlighting is the regulation of OTT and news media platforms through proxy. We find this grossly unconstitutional. The draft IT Rules, 2021 have, in the Appendix to the Rules defined a “Code of Ethics and Procedure and Safeguards In Relation To Digital/Online Media” which shall apply on “applicable entities”. “Applicable entities” as contained in Rule 7 include, “publishers of news and current affairs content”; and “publishers of online curated content”; and “intermediaries which primarily enable the transmission of online curated content.”

Further, under sub-rule (3) of Rule 8, the Rules lay down a three-tier structure for observance and adherence to the Code which is as follows, “Level 1 – Self-regulation by the applicable entity”; “Level 2 – Self-regulation by the self-regulating bodies of the applicable entities”; “Level 3 – Oversight mechanism by the Central Government.” What does this mean? Likely, government oversight and more censorship.

This oversight mechanism is being created without any clear legislative backing and will now increasingly perform functions like those played by the Ministry of Information and Broadcasting for TV regulation. For instance, as pr Rule 13(4) this also now includes powers of censorship such as apology scrolls, but also blocking of content! All of this being planned to be done without any legislative backing or a clear law made by parliament.

Any potential legislation regarding the OTT video streaming sector in India may cause immense harm to individual rights as well as the national interest. Today, India is no longer a consumer but a producer of original high quality video content that provides employment and entertainment to audiences locally and globally. It competes actively with other countries such as South Korea and needs an environment that recognizes that traditional cinema or television-based regulation may irreparably harm the sector. Any such model of regulation will likely have a substantial impact on citizens’ digital rights, result in economic harm, and negatively India’s growing cultural influence through the production of modern and contemporary video formats entertainment.

On February 12, 2021, the Mint also published a report titled, “17 OTT platforms release self-regulation toolkit”,⁸ which stated that 17 of India’s largest streaming services have launched a self-regulation toolkit, under the aegis of the Internet and Mobile Association of India (IAMAI), pre-empting government plans to bring out a code for all over-the-top (OTT) services. This toolkit builds upon the Self-Regulation Code of Online Curated Content Providers adopted by 15 Indian streaming services and digital companies. The Code has several issues itself, including providing a significant impetus towards self-censorship. More importantly, the provisions of the code relating to self-regulation may harmonize with the mechanisms laid down in clauses 11, 12, and 13. Resulting in both a push towards self-censorship as well as a sizeable amount of government oversight.

Digital News Media

With respect to regulation of news media, several concerns abound. The purview of the Information Technology Act, 2000 does not extend to news media, and so the guidelines do not have the legislative backing to regulate news media. Thus, these Rules are exercising powers far beyond the parent legislation. Additionally, these guidelines are ultra vires section 79 of the IT Act, which provides a ‘safe harbor’ through an exemption from liabilities in certain cases. This makes these guidelines a camouflaged way to indirectly regulate online news media by bringing these platforms under the aegis of the Information Technology Act, 2000 instead of following the due process of parliamentary scrutiny and subsequent legislation.

The vague definition of “publisher of news and current affairs content” may also lead to further arbitrariness. The definition excludes replica e-papers of newspapers from its ambit. Now, will this mean media publications such as the Caravan magazine, which physically publishes a monthly magazine and was recently at the center of a social media storm involving blockages of its twitter accounts, falls under the category of ‘publishers of news and current affairs content’? This vagueness in definition would allow arbitrariness by the government in the exercise of significant discretionary powers and would allow them to censor media at their pleasure. Such a definition also privileges the established media houses, who may have a print newspaper as a significant component of their operations and could thus claim to be exempted from these guidelines. Smaller and independent media houses on the other hand may not have the luxury to do so, and instead rely on the internet to disseminate news and information. This discriminatory approach between online news media and traditional print newspapers and legacy media will place additional responsibilities on the former based on an ambiguous definition that lends itself to confusion and uncertainty, and thus potentially stifle independent online news media.

Moreover, it is unclear what is the purpose of requiring significant publishers of news and current affairs content to notify the Broadcast Seva established by the government. For instance, the Press and Registration of Books Act, 1867 required registration because it was aimed at preservation of copies of books and periodicals containing news printed in India. While this may have been necessary in 1867, such requirements have outlived their archival utility in the modern digital age with the internet maintaining a record of news and current affairs. Therefore, there is a need to fundamentally re-examine the purpose and scope of the notification requirement present under Rule 16 of the draft IT Rules, 2021. It should also be noted that while the government earlier planned to bring about these changes through a legislation which would have to be approved by the parliament, it may now go ahead and implement it through mere executive flat and bypass legislative debate on this issue.

IV. ‘Execution’ and ‘privacy’ – digital rights at stake⁹

The draft IT Rules, 2021 have, under sub-rule (2) of Rule 5, made it mandatory for a significant social media intermediary providing services primarily in the nature of messaging, such as WhatsApp, Signal, Telegram etc., to enable the identification of the first originator of the information. This introduces the requirement of traceability which would break end-to-end encryption. It should be noted that previous proposals which seek to implement traceability in a manner which is compatible with end-to-end encryption have been shown to be vulnerable to spoofing where bad actors can falsely modify the originator information to frame an innocent person. Further, the originator of the message has no control over who forwards the content, or how many times it is forwarded, or in which fora.

Many platforms (WhatsApp, Signal, Telegram but even other platforms) retain minimal user data for electronic information exchange and deploy end-to-end encryption to provide reliability, security, and privacy to users. These are used by millions of Indians to prevent identity theft, code injection attacks and many other threats. Encryption becomes even more important now as more of our lives involve our personal data being aggravated and analyzed at a scale that was never possible before.

Without thought or involving technical experts in an open consultative process, without any data protection law or surveillance reform, this is being tinkered with by introducing the requirement of “traceability”. This introduction of a traceability requirement has important consequences for everyday users of online services and should also be seen in the context of the MHA notification which activates the IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 that hold the power to direct, “decryption”. We do not have any proper parliamentary oversight or judicial check on surveillance, and the latest draft rules, if they go through, would be tremendous expansion in the power of the government over ordinary citizens eerily reminiscent of China’s blocking and breaking of user encryption to surveil its citizens.

Development of AI to automate censorship?

Further, under sub-rule (4) of Rule 5, the draft IT Rules made it mandatory for a significant social media intermediary (such as WhatsApp, Signal, Twitter, Instagram, or Facebook etc.) to deploy technology-based measures, including automated tools or other mechanisms to proactively identify information that depicts any act or simulation in any form depicting rape, child sexual abuse or conduct, whether explicit or implicit.

Automated tools to investigate the content of messages and discover offending messages will also bring end-to-end encryption to an end. This means that an intermediary will have to develop a system which has the capacity to look into the content of messages. It is not clear whether it is technically feasible and viable for a system to weed out specific content at all and ignore the rest altogether; this is a purely technological requirement imposed by the government, but only a suggestion. It remains to be seen whether it is made mandatory at a later stage.

V. Conclusion

The Special Rapporteurs from the United Nations argues that IT Rules, 2021 does not meet the requirements of international law and standards related to the rights to privacy and freedom of expression, as protected by the International Covenant on Civil and Political Rights, which India acceded to in 1979.¹⁰

Also, the new Rules for intermediaries have been brought into force at a time when anyone expressing dissent or an opinion contrary to the government is being prosecuted for sedition or being slapped with charges under the Unlawful Activities (Prevention) Act (UAPA). FIRs are being lodged left, right and center, in what is an attempt to stifle free debate and discussion. Therefore, these Rules, which would ordinarily seem to be bringing order to a medium which is difficult to control, must be seen with a lens of suspicion. These Rules are another tool in the hands of the government to use law enforcement agencies and other means to go after individuals who express opinions which run contrary to its ideas and interests.

The inclusion of inclusive definitions gives too much leeway to the government to add more categories at a later stage and increase the scope of the Rules at its convenience.

The requirements to prominently display privacy policies and make them accessible and remind users at least once a year is a welcome step. Suggesting mechanisms which enable complaints which users can make regarding content they deem to be offensive by sharing the content with the intermediary is also a measure which can elicit little objection. However, there are two measures in the Rules which will handicap end-to-end encryption in its present form:

• Enabling the tracing of the first originator of the message
• Developing automated tools to weed out sexual content which is prima facie without consent etc.

The nature of messaging platforms today is such that the amount of information they have about users is limited by design, which is what data protection laws around the globe are advocating. The platform today can ostensibly also not see the content of our messages. Therefore, having to alter a system to enable traceability necessarily adds a layer of information which will be available in the hands of the platform, and consequently, that which may be accessed by government agencies or bad actors.¹¹

The Supreme Court, in the case of Life Insurance Corporation of India vs Prof. Manubhai D. Shah (1992) had elevated ‘the freedom to circulate one’s views as the lifeline of any democratic institution’.¹²

In this context, five industry bodies, including the CII, FICCI and the U.S.-India Business Council have sought an extension of 6-12 months for compliance. This is an opportunity for the Government to hear out the industry and shed its high-handed way of rulemaking.¹³

*****