Fri, 01/02/2019 - 10:02

FSMI SUBMISSION ON DRAFT OF INTERMEDIARY GUIDELINES

In December 2018, the Ministy of Electronics and Information Technology (MeitY) has come up with a 'Draft of Intermediary Guidelines 2018', a part of the IT Act, 2000. Subsequently, MeitY has called for comments on this draft. The following is the submission of FSMI on this draft guidelines. 

 

Dear Sir/Madam
The following is the submission of the Free Software Movement of India in response to the invitation of comments/suggestions on the Draft Information Technology (Intermediary Guidelines) Rules 2018.

Duties of Intermediaries Under the Information Technology Act, 2000

Intermediary is defined under section 2(w) of the Information Technology Act, 2000 as reproduced below:

(w) "intermediary", with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecoms service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes;

This definition is broad and encompasses services associated with information technology whether virtual or physical.

Section 79 of the Information Technology Act, 2000 lays down conditions under which intermediaries will attract liability as well as the conditions under which liability will not be attracted.

The circumstances under which immunity from liability will be available to intermediaries are:

  • the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; or
  • the intermediary does not:
    • initiate the transmission
    • select the receiver of the transmission,
    • select or modify the information contained in the transmission
  • the intermediary observes due diligence while discharging his duties under the Act and also observes such other guidelines as the Central Government may prescribe in this behalf.

Whereas the circumstances under which the intermediaries will be held liable are:

  • the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise in the commission of the unlawful act;
  • upon receiving actual knowledge, or on being notified by the appropriate Government or its agency that any information, data or communication link residing in or connected to a computer resource, controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

Third party information under this section refers to information dealt with by an intermediary in the capacity of an intermediary.

Section 87(zg) empowers the Central Government to frame Rules regarding the guidelines that intermediaries are to observe under section 79(2).

Section 69(3) mandates that The subscriber or intermediary or any person in-charge of the computer resource shall, when called upon by any agency referred to in sub-section (1), extend all facilities and technical assistance to:

  • provide access to or secure access to the computer resource generating, transmitting, receiving or storing such information; or
  • intercept, monitor, or decrypt the information, as the case may be; or
  • provide information stored in computer resource.

The caveat here is that the duty of a subscriber, intermediary or any person in charge of a computer resource is invoked only when called upon by an agency referred to in subsection 1.

Failing this, subsection 4 states that:
The subscriber or intermediary or any person who fails to assist the agency referred to in sub-section (3) shall be punished with imprisonment for a term which may extend to seven years and shall also be liable to fine.]

Subsection 1 of section 69 allows any agency authorised by the Central Government by order, with reasons recorded in writing to intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource.

The conditions under which such order may be passed are that the Central Government or any of its authorised officers should be satisfied that it is necessary or expedient to do in the interest of:

  • the sovereignty or integrity of India,
  • defence of India,
  • security of the State,
  • friendly relations with foreign States or
  • public order or
  • for preventing incitement to the commission of any cognizable offence relating to above or
  • for investigation of any offence.

Thus it can be seen that:

  1. Intermediary has a wide definition under the Act (section 2(w)).
  2. Intermediaries do not attract liability where they play no role in the generation of information (section 79(2) and (3)(a)).
  3. Intermediaries will attract liability under section 79(2)(c) for failing to observe the guidelines prescribed under section 87(zg).
  4. Intermediaries will attract liability under section 79(3)(b) for failing to expeditiously remove or disable access to material without vitiating the evidence that is used to commit an unlawful act.
  5. Intermediaries will also attract liability under section 69(4) for failing to comply with section 69(3).

The Draft Information Technology [Intermediaries Guidelines (Amendment) Rules, 2018

Under Rule 2, two definitions clauses have been added, i.e. the definitions of “Appropriate Government” and “Critical Information Infrastructure”, for which the definitions under sections 2(1)(e) and the Explanation in section 70(1) of the Act respectively.

In Rule 3(2) the words “terms and conditions” have been substituted with “privacy policy”. However, “privacy policy” as such has not been defined in the parent Act, nor the Rules.

In Rule 3(2) clauses (j) and (k) have been added.

Clause (j) places a duty on the intermediary to inform users not to transmit information that threatens public health or safety in the form of tobacco products, Electronic Nicotine Delivery Systems (ENDS), alcohol and other intoxicants except in in the manner and extent as may be approved under the Drugs and Cosmetics Act, 1940 and the Rules made thereunder.

Due to the wide definition of intermediary which includes telecommunication service providers, internet service providers and other platforms such as Facebook, Gmail, Youtube, WhatsApp, Amazon and Filpkart, private messages between two persons would fall foul of this Rule. Such a broad provision will not pass the test of proportionality laid down in Puttaswamy.

Clause (k)  places a duty on the intermediary to inform users not to transmit information that threatens critical information infrastructure.

Rule 3(4) has been substituted with a new provision by which intermediaries shall inform users at least once a month that in case of non-compliance with rules and regulations, user agreement and privacy policy for access or usage of intermediary computer resource, the intermediary has the right to immediately terminate access and usage rights of the user and remove the non-compliant information.

This provision does not put in place a system which provides the user a right to be heard.

Rule 3(5) lays down that the intermediary shall comply with lawful orders within 72 hours of communication to provide such information or assistance as asked for by any government agency or;

  • security of the State or cyber security;
  • or investigation or detection or
  • prosecution or prevention of offence(s);
  • protective or cyber security and matters connected with or incidental thereto.

The provision prescribes that the lawful order must be made in writing or through electronic means and state the purpose clearly. However, it should also be mentioned that the order, when made through electronic means, must also contain a digital signature as defined in section 2(p) and prescribed under section 3 of the parent Act.

Considering the impact of the Rule, it is essential that only a court order qualify as a “lawful order” in this context.

The provision also mentions that the intermediary shall enable tracing out of such originator of information on its platform as may be required by government agencies who are legally authorised. However, with the broad definition of intermediary under section 2(w) of the parent Act, even online journalistic portals fall within the ambit of “intermediary”.

This becomes problematic as the Press Council of India’s Norms of Journalistic Conduct stipulate that the confidentiality of the source is to be respected. The only circumstance where the source may be revealed is when “the source is voluntarily disclosed in proceedings before the Council by the journalist who considers it necessary to repel effectively a charge against him/her”. In this regard, this rule may be used to coerce such portals to reveal their sources, which may subject such sources to the risk of physical harm if not endless litigation.

Similarly, traceability here is a vaguely defined term and in order to do so, intermediaries may have to break encryption or even worse, create backdoors to encryption from the very beginning. This has grave implications for freedom of speech and secure communication.

Rule 3(7) makes it mandatory for intermediaries with fifty lakh or more users in India, or is in the list of notified intermediaries to be a registered company under the Companies Acts of either 1956 or 2013. The intermediary shall have a permanent registered office in India, and shall appoint a nodal person available 24x7 to coordinate with law enforcement agencies.

At the outset, the mandatory provision that the intermediary shall be a registered company is discriminatory and will hamper the growth and development of smaller entities who may be operating as partnership firms.

This Rule also does not take into account websites such as Wikipedia and Github which are knowledge sharing platforms and fall within the definition of intermediary as laid down in section 2(w) of the Act. Neither website has a physical presence in India. This may subject these websites to unnecessary litigation or even be banned under the Rules so framed. Further, neither of these websites have specific registration or subscription processes.

Rule 3(8) mandates that on the basis of a court order or a notice from the appropriate government or its agency under section 79(3)(b), the intermediary shall remove the specified objectionable material relating to Article 19(2) of the Constitution of India within 24 hours without vitiating the evidence.

Further the intermediary shall retain the information and associated records for a period of one hundred and eighty days, or for such period of time as may be required by the court or by government agencies.

However, the requirement of retaining the information and associated records for a period of one hundred and eighty days is double of what was mandated under the Rules of 2011. If retention is required for investigation purposes, copies of the requisite information can be obtained within a shorter period of time by the law enforcement agencies.

Rule 3(9) stipulates that “The Intermediary shall deploy technology based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content.”

This Rule goes beyond the scope of the role of an intermediary as laid down in the parent Act as an intermediary is not a content creator and cannot have essentially editorial functions. Pre-censorship would be an editorial function and not envisaged for an intermediary.

Under section 79(2)(b)(iii) of the parent Act, the intermediary is not liable if the intermediary does not select or modify the information contained in the transmission. However, draft Rule 3(9) mandates that the intermediary shall play a proactive role in identifying and removing or disabling public access to unlawful information or content.

This would then extinguish the immunity offered by section 79(2)(b)(iii) of the parent Act. Further, the failure to comply with this guideline will extinguish the immunity offered by section 79(2)(c) of the parent Act. This creates a situation where the intermediary will lose an immunity offered under law whether complying with the guidelines or not.

The use of automated tools for what is essentially censorship has the following problems:

  • 1) There are no accepted standards for the functionality of such AI tools, which raises serious questions on its deployment on the large scale as suggested in the Rule.
  • 2) Such automated tools cannot distinguish between reporting that is critical of the government or reporting in the mainstream media, and fake news, material that is intended to arouse hatred or cause violence.
  • 3) The only way such automated tools would work is by only allowing a dumbed down version of news and views.
  • 4) The cost of even such automated tools is well beyond the power of most intermediaries and therefore heavily weighed in favour of the large global monopolies.

This Rule by mandating the use of “technology based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying and removing or disabling public access to unlawful information or content” does not provide for the application of mind.

In effect this provision empowers the intermediary to play the role of a censor without the application of mind nor an adequate mechanism for appeal. This Rule is arbitrary and will violate Article 14 of the Constitution which operates as a guarantee against arbitrariness.

The Hon’ble Supreme Court in Shreya Singhal vs Union of India on March 24, 2015 when reading down section 79(3)(b) and the Information Technology (Intermediaries Guidelines) Rules, 2011 made it clear that the intermediary’s liability in relation to orders whether from a court or from the appropriate government or its agencies, is limited to a specific request to block or remove such offensive material to the extent that it is struck by Article 19(2). In this regard, this provision violates the principle of delegata potestas non potest delegari (no delegated powers can be further delegated) as it delegates the powers of the State agencies to identify unlawful content and take appropriate action to the intermediaries.

It further gives such intermediaries quasi judicial powers by forcing them to take private decisions on what content is legally permissible. In the context of online news portals, the Press Council of India guidelines can regulate the content. However, giving such editorial jurisdiction to internet service providers, telecommunication service providers and other such intermediaries greater power and obligations than is desired, both by content creators as well as the intermediary.The right to freedom of speech and expression as contained in Article 19(1)(a) of the Constitution can only be restrained by Article 19(2) provided that such restraint passes the test of Article 14. This Rule empowers the intermediary beyond the scope of the parent Act.

The Supreme Court has held in numerous cases, notably in The Secretary, Ministry of Information and Broadcasting v. Cricket Association of Bengal, AIR 1995 SC 1236, that “The freedom of speech and expression includes the right to acquire information and to disseminate it. Freedom of speech and expression is necessary, for self expression which is an important means of free conscience and self fulfillment… The right to communicate includes right to communicate through any media that is available whether print or electronic or audio-visual. .. This freedom includes the freedom to communicate or circulate one's opinion without interference to as large a population in the country as well as abroad as is possible to reach. This fundamental right can be limited only by reasonable restrictions under a law made for the purposes mentioned in Article 19(2) of the Constitution. ” In the context of television, the Supreme Court stated “The broadcasting media should be under the control of the public as distinct from Government. This is the command implicit in Article 19(1)(a). It should be operated by a public statutory corporation whose composition must be such as to ensure its impartiality in political, economic and social matters and on all other public issues... Airwaves being public property, it is the duty of the State to see that airwaves are so utilised as to advance the free speech right of the citizens which is served by ensuring plurality and diversity of views, opinions and ideas. This is imperative in every democracy where freedom of speech is assured.”

Under such circumstances, Rule 3(9) should not be written into law.

Regards
Y. Kiran Chandra
General Secretary
Free Software Movement of India