WhatsApp owner Facebook has sued the Indian government today over changes the country is implementing to make messaging apps less private. As the Associated Press reports (via The Seattle Times), the lawsuit was filed on Wednesday in the Delhi High Court after a 90-day grace period for India’s new internet regulations expired. Those new regulations state that tech companies must make private messages—including the encrypted messages sent via WhatsApp—traceable.
But what is traceability?
WhatsApp has written a lengthy blog post on the subject. In it, the company describes traceability as the ability “to find out who sent a particular message on private messaging services.” As the company explains:
WhatsApp deployed end-to-end encryption throughout our app in 2016, so that calls, messages, photos, videos, and voice notes to friends and family are only shared with the intended recipient and no one else (not even us).
“Traceability” is intended to do the opposite by requiring private messaging services like WhatsApp to keep track of who said what and who shared what for billions of messages sent every day. Traceability requires messaging services to store information that can be used to ascertain the content of people’s messages, thereby breaking the very guarantees that end-to-end encryption provides. In order to trace even one message, services would have to trace every message.
That’s because there is no way to predict which message a government would want to investigate in the future. In doing so, a government that chooses to mandate traceability is effectively mandating a new form of mass surveillance. To comply, messaging services would have to keep giant databases of every message you send, or add a permanent identity stamp— like a fingerprint—to private messages with friends, family, colleagues, doctors, and businesses. Companies would be collecting more information about their users at a time when people want companies to have less information about them.
WhatsApp goes on to explain that traceability would force “private companies to turn over the names of people who shared something even if they did not create it, shared it out of concern, or sent it to check its accuracy.” This, the company says, would violate a person’s human rights, including the right to free expression.
Given WhatsApp owner Facebook isn’t exactly known for favoring privacy, it’s refreshing to see the company taking such a powerful stance against a government policy that would destroy much of the privacy end-to-end encrypted apps confer. And WhatsApp isn’t alone in its stance. Everyone from Mozilla and the Center for Democracy and Technology to the Electronic Frontier Foundation has opposed India’s traceability requirements. Those interested should be sure to read WhatsApp’s entire post, which goes into lengthy details about the issue.
As for what would happen if WhatsApp loses the court case: Facebook would have a few options: to comply with the traceability regulations—angering users and privacy advocates, leave the Indian market altogether (including leaving half a billion users), or continue to resist traceability but be subject to fines—and potentially additional legal action.