Intermediaries Liable
The Intermediary Guidelines 2021 just make things more confused. It will cover social media intermediaries on the basis of registered users and not active users which can be a big deal for many companies that have a relatively small active Indian user base. It will apply to services that provide messaging as just an ancillary service - and most digital platforms do that. Voluntary verification is also a strange requirement since it doesn’t ensure traceability because its not mandatory. Anyone who fails to comply even with the most minor requirements of the regulations will lose their intermediary liability protections.
This article was first published in The Mint. You can read the original at this link.
When the Government of India notified the Information Technology (Guidelines for Intermediaries and Digital Media Ethics Code) Rules, 2021 (the Intermediary Guidelines) last February, it gave significant social media companies three months to comply with the additional due diligence requirements under the new Rules. That grace period ran out today and from here on out these companies are going to be held to far higher standards than ever before.
As soon as the Intermediary Guidelines were notified I pored over its provisions - trying to figure out how exactly these new regulations would affect the wide range of businesses they applied to. The deeper I dug, the more obvious it became that rather than providing clarity, things were about to become significantly more confused.
The Threshold
To start with, let’s take a closer look at the threshold above which a social media intermediary will be deemed to be “significant”. Shortly after the Intermediary Guidelines were notified, the government announced that social media intermediaries with more than 5 million registered users in India would be classified as significant social media intermediaries. While the threshold might have been clearly articulated, there are several practical challenges in trying to apply the standard.
For instance, many social media intermediaries have informed me that even though they have more than 5 million registered users from India, the number of active users on their site is far lower. Some platforms offer effortless online publishing facilities and as a result have thousands of registered users who, after initially setting up their websites, are no longer actively tending to them. Other platforms, like online matrimonial sites, offer once-in-a-lifetime services where having more inactive registered users than active is actually a sign of how well the site has done its job of finding users a life partner. Yet all these entities will now have to comply with the onerous obligations of being a significant social media intermediary simply because the size of their registered user base in India is greater than the stated threshold.
Messaging
And then there is the ambiguity around what constitutes a messaging service. Under Rule 4(2), significant social media intermediaries that provide services “primarily in the nature of messaging” are required to comply with various stringent obligations. I have, in a previous article, discussed why I believe that the traceability obligations that these provisions impose are antithetical to our constitutional notions of liberty:
What concerns me most is that this policy direction represents an imperfect understanding of not only the technological underpinnings of end-to-end encryption but also the guarantee of anonymity itself. A message can only be truly anonymous if information about both the content as well as the sender are obscured from the sight of all but the recipient. Disclosure of either one diminishes the guarantee of anonymity—and, as a consequence, the dignity that Justice Kaul called an essential sub-set of liberty. This is why the facile assurance that traceability will not result in disclosure of the underlying message is so worrying.
But even if we set that aside for a moment, by making the rule applicable to entities who offer services that are primarily in the nature of messaging, the new rules could well apply to businesses that allow messaging as just an ancillary offering. Today, every online service, has a messaging feature. As a result, even if it wasn’t the primary focus of the service, in time direct messages on a popular platform could well end up being a significant channel for communication between users. By not limiting the applicability of the obligations of Rule 4(2) to messaging apps, the rules introduce a worrying lack of clarity that could lead to its provisions being abused.
Voluntary Verification
There is also a new, rather inexplicable, obligation to offer users the ability to voluntarily verify themselves. Why voluntary verification? If the government’s real objective was to be able to trace online activity back to a real world identity, they should have insisted on mandatory verification of all users. Instead, by insisting that these platforms make sure that everyone who wants to be verified actually does get verified, I can’t help wonder whether this is just a case of someone in the government being upset that they weren’t given a blue tick.
One of the reasons why all this is so important is because any business that qualifies as a significant social media intermediary is obliged, under the new Intermediary Guidelines, to significantly localise its operations. Not only are they required to have a physical address in India, they are also require to appoint a Chief Compliance Officer, nodal contact persons for coordination with law enforcement and a Grievance Officer - all of whom must be physically resident in India.
Many of the companies that qualify under the thresholds set out under the Intermediary Guidelines - such as those that provide repository services for code (like Github) or which offer niche collaborative services within organisations (like Slack) - simply do not need to be in India to provide their services. As large as their registered user base is in India, their operations are designed to be neutral to where users reside since the core service is truly virtual. Now that the new Intermediary Guidelines are in force, all these entities will have to either reduce the number of registered users in India to below 5 million — or actually set up operations here.
The Real Zinger
But the real zinger is Rule 7 which states that any social media intermediary that fails to comply with any part of these rules will have its intermediary liability protections revoked. Most internet platforms that depend on user generated content rely on this exemption to keep from getting in trouble for what their users say or do — and have done so since the dawn of the internet.
I have previously written about the origins of this protection and why it is under stress. I’ve also argued that we need to think differently about how we should be moderating the internet:
Social media companies have powerful amplification tools that they use to promote popular content. What if we insist that they use these tools in reverse - so that instead of amplifying provocative content they dampen its virality. Rather than promoting it get them to use their tools to keep offensive content from trending.
The Indian government clearly has a different point of view.
Of Scalpels and Sledgehammers
I can understand why the government is so keen on regulating social media companies more strictly. We are all witness to the power and influence some of these platforms wield - the manner in which their algorithms shape the news we consume and decide what products we should purchase.
And yet as much as these platforms deserve to be regulated, we need to do so with finesse. If we really want to design new regulations so that they influence societal interactions we need to fashion them like a scalpel - finely honed so that they can precisely excise those behaviours we are trying to change. And little else.
The Intermediary Guidelines, I am sorry to say, is no scalpel. It is a sledgehammer — a blunt instrument that if applied, will end up destroying more value than it creates.
