Methods for tracing WhatsApp messages - IT Rules 2021
WhatsApp traceability can be achieved in two methods —
1. Use of digital signatures
2. The metadata approach.
However, it is still open to question whether either can discharge its legal objective of establishing criminal liability.
The digital signature approach may not be foolproof because it is susceptible to impersonation. Further, the approach would require the intermediary to keep the private key of the encrypted digital signature and decrypt when ordered by the court or the government. But the key will then become vulnerable to hacking by bad actors and once successful will create havoc, targeting innocent users. This approach with other precautions can be used successfully.
The metadata contains data pertaining to source, time, date, location and other attributes minus the content. But for traceability, a humongous amount of data would be commandeered for which the security agencies neither have the time, energy or capacity to disaggregate for any meaningful result. Second, in some case it may violates the data minimisation principle, envisaged in GDPR, PDPA and other privacy laws of the world. It figures prominently in Justice Puttaswamy judgment on privacy and the PDP Bill, 2019. But in big cases large charge sheets and huge data is the norm which LEA is used to it, its just the security of the meta data and the SOP for the same needs to be evolved.
If the above two techniques are fraught with risks, is it possible to comply with IT rules with a straight-forward method of intermediary keeping the decryption key of the messages? No. Because any modification of the system to give backdoors, weakens the security architecture, rendering it vulnerable to all bad actors.
The other alternative is the client sight scanning, where hashes used in communications are matched against a database of content before sending the message to the intended recipient. But the threat again is real, once the platform gets totally exposed by hackers getting hold of the database.
What is practicability ?
It is for the intermediaries like WhatsApp to implement and comply with the traceability rule of The IT Rules,2021 and figure out whether it is possible without breaking the encryption.
The government has said time and again that it does not seek content and that originator tracing can be done without breaking encryption. Some national and international experts who maintain that traceability is not possible without breaking encryption but these experts could be wrong as the technology develops day by day.
Government needs to release illustrative guidelines for intermediaries to implement traceability. The end-to-end encryption is the bedrock of securing private messaging and online infrastructure, for ensuring safety and security of its users. Tinkering around with it will lead to a severe crisis of confidence and credibility. Innocent users of various social-media platforms have a cherished right to their privacy. Their personal information and chats cannot be used either commercially or surveilled by the state. A democratic state owes it to its free citizens.
IIT professor V Kamakoti’s in response to the Madras High Court suggested two methods to trace one was adding an originator information with every message and the other where a permission-based system which allows users to classify a message as forward-able or not forward-able.
This reputation of confidentiality that the WhatsApp enjoyed had already come under a cloud in India. Serious concerns were being raised about WhatsApp’s ability to protect a person’s privacy apart from preventing content from being transmitted and stored on its service from unauthorised access and misuse. These IT rules 2021 though not impeaching on privacy legally leaves room to do so, i think checks and audits by MEITY on WhatsApp and other social media websites and messenger service is the need of the hour.
x
Comments
Post a Comment