Should the police know who sent a personal WhatsApp message?

The Indian government wants platforms like WhatsApp and Signal to identify the originator of messages, a move that WhatsApp says could break its end-to-end encryption security, jeopardising the sanctity of private communications on its platform. 

However, according to the government, this requirement of identifying the originator of a message—also called ‘traceability’—will only be invoked for cases related to national security, law and order and circulation of child pornography, among others.

The basic principle of end-to-end encryption is this: it ensures that messages, calls, photos, and videos shared on messaging platforms can only be accessed by the sender and the receiver. No third party can intercept these conversations, not even the messaging platform.

So, what is the police’s view of traceability, and how valid is it? Entrackr spoke to the Inspector General of Maharashtra Police Brijesh Singh to find out.

On being asked why law enforcement agencies have been calling for traceability on platforms like WhatsApp, Singh said that it could help investigators in obtaining crucial evidence related to a case. 

“Investigation is a process of discovery of truth and for this you need lawful access and for this you have Section 91 of the Code of Criminal Procedure and other legislations like the Evidence Act and the IT Act. In case a bank fraud happens the police would like to go and see what has happened and obtain evidence of the transactions. The same should apply to encrypted platforms too,” Singh said. 

He said that in the Parliament attack case, one of the accused was in constant touch with a terrorist. “Now what was told by the court was that this call between these people doesn’t mean anything in itself, what is important is the content of the call,” Singh said.

According to Singh, the social media rules call for traceability in very “exceptional cases”. “Let’s say a law and order incident has happened where somebody has circulated a morphed picture of some god and that leads to widespread violence. If this has been done purposefully, then it is essential to find out who has done it,” he said. 

But according to Rahul Narayan, an Advocate on Record at the Supreme Court, the traceability requirement is flawed from the get go. 

“The government’s argument that we will not ask for the content of a message but only the originator doesn’t make sense — in all likelihood, they already probably would know the content of a message before asking who sent it,” said Narayan, who was also one of the lawyers for the petitioners in the landmark 2017 right to privacy judgement.  

“If the police are allowed to listen in to every phone call people make, I’m sure crime rates will fall down. But is that how things should be done?” Narayan asked.

When we pointed out to Singh that WhatsApp said that traceability could lead to mass surveillance, something that the civil society has also been saying, Singh denied the claims. 

Singh took the liberty to incorporate “corporate surveillance” and called it the “larger problem”. “The corporations who are trying to become great proponents of privacy, if you read their own policies, they are selling users out,” he said.

He also said that there are many cases currently unsolved because criminals have found a “safe harbour” on encrypted platforms and the police can not reach them because of the “warrant proof” structure of the encryption technology.

Also read: Explained: What the challenges to end-to-end encryption in India mean for user rights and national security

We reached out to WhatsApp for their counter-comments on Singh’s remarks and a company spokesperson said: “Requiring messaging apps to ‘trace’ chats is the equivalent of asking us to keep a fingerprint of every single message sent on WhatsApp, which would break end-to-end encryption and fundamentally undermines people’s right to privacy.”

In 2017, when the Supreme Court held the right to privacy a part of the right to life and personal liberty, thereby making it a fundamental right, it also said that any invasion of this right must meet a three-fold test: it should be legal, necessary and proportionate. 

“Ever since the IT Rules were notified, multiple cases have been filed against them from various stakeholders. Considering it’s all pending in court, the legality of these rules is questionable,” Narayan said.

On the necessity, Narayan said that “if you give the police nuclear weapons then certainly they can use those weapons. But does it mean we should give those to them?”

On being asked why metadata shared by WhatsApp with law enforcement agencies is not enough for investigation purposes, Singh said that metadata is useful but has limitations since the police do not know the contents of a message and who sent it.

Even when we pointed out that technologists around the world have said that traceability will not be possible without undermining end-to-end encryption, Singh said that the companies can create a “new mechanism” to help with traceability while keeping encryption intact. 

“I’ve handled hundreds of cases where young children are being blackmailed and their objectionable images are being circulated and sold. Which advocate of privacy will support this? Should law enforcement agencies be impeded from getting access to evidence in this case?” Singh asked.

However, when we pointed out that detection of child pornography on encrypted platforms without breaking encryption has been a huge area of interest and concern, Singh asked why there be a classification in the “type of victims” at all? 

When asked if the government believed in the idea of having anonymous conversations online, Singh said that people “absolutely” should have the right to anonymity online. 

“As long as someone is not breaking the law, there is no requirement, necessity or justification to seek their information. However, investigating agencies have the right to search online spaces too,” he added.

However, Narayan cautioned that the traceability provision could be misused under the garb of a threat to “national security” when in reality the term does not have a legal definition. “This could just be a way of spying on people, especially those who dissent against the government,” Narayan said. 

Singh immediately sidelined our question where we asked him about the issue of police overreach and what happens when a police officer, enabled with traceability, wants to settle some scores with someone. 

“Eminent domain is a fallacious argument,” he said. 

When asked why the police can not just seize the devices of suspects and then decrypt the information on their devices, Singh said that “when the police begin an investigation they can only come to the conclusion only when you first have some information.”

“If a mob lynching has happened how many devices do you expect the police to seize to decrypt messages on it?” he added.