How (Not) to Regulate the Internet: Lessons From the Indian Subcontinent

In February, the Indian government enacted the highly anticipated amendments to its intermediary liability regime. Titled the “Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021,” which we refer to as “the 2021 rules,” these regulations supersede a decade-old set of rules on the same subject, ostensibly coming on the heels of a series of disinformation-mediated offline harms and high-profile litigation on the culpability of online intermediaries in the spread of sexual abuse imagery. These new rules seek to comprehensively regulate intermediaries by requiring a host of technical measures, compliance with stringent content takedown requests, and the incorporation of supposed standards of transparency and accountability in their processes. Further, these rules also seek to regulate a new set of entities under the encompassing term “digital media,” essentially comprising online news “publishers” and online curated content providers (OCCPs) such as Netflix and Amazon Prime. 

The content of the 2021 rules became the subject of immediate controversy. Many digital rights organizations and media houses criticized the rules for, among other things, being undemocratic, encouraging self-censorship and undermining privacy. At least 17 petitions challenging the validity of the rules have also been lodged in constitutional courts around the country by various individuals, news organizations and associations, and entities such as Facebook and WhatsApp. Fourteen prominent international civil society organizations called upon the government recently to withdraw the rules and put an end to digital censorship.

Given that the scope of the rules goes beyond online intermediaries, and extends to digital news publishers and OCCPs, the implications would be extensive. By enacting these rules, India has become the newest hotspot of content regulation in South Asia. It joins other South Asian governments that have leveraged stringent, controversial norms on digital entities operating on their territories in the past five years, especially social media intermediaries and digital news publishers. While each of these interventions has been passed with purported legitimate aims and—as we explore in this post—strikingly similar rationales, their cumulative impact on internet freedom and expression online has been dire. The freedom of speech and expression on the South Asian internet appears to be visibly curtailed, as waves of polarization across South Asia are driving even relatively older democracies such as India into systematic democratic regression. 

The New Amendments 

Background of the Indian Intermediary Liability Regime

India’s intermediary liability law follows what the human rights organization Article 19 terms a “conditional immunity” model: An intermediary is guaranteed a “safe harbor” exemption on the fulfillment of specific statutory conditions. This legal model is administered chiefly via section 79 of the Information Technology (IT) Act and the rules thereunder. 

The 2021 rules supersede the regulations on intermediary liability issued in 2011 via the rule-making power granted under Section 79. In 2018, following a calling attention motion on “Misuse of Social Media platforms and spreading of fake news” in the Parliament, the government had floated a draft version of amendments to the 2011 rules, which was subject to a period of public consultation. The draft rules imposed a host of stringent legal obligations and technical requirements on intermediaries: a general proactive monitoring obligation for “unlawful” content, as well as a traceability obligation for intermediaries to enable “tracing” of content creators. 

The draft amendments drew considerable attention from various companies and organizations, at both domestic and international levels. Github, Cloudflare and Mozilla, for instance, wrote an open letter to the Ministry of Electronics and Information Technology, stating that “[i]mposing the obligations proposed in these new rules would place a tremendous, and in many cases fatal, burden on many online intermediaries—especially new organizations and companies.”

What Do the Amendments Say?

In the two years between the draft amendments and the notification of the actual rules, the subject of intermediary liability reform received continuous attention from civil society organizations in India. The government also reportedly sought additional advice from the Ministry of Law and Justice on the legality of the rules. As a result, the final text of the rules differs from what was earlier proposed, and it is arguably more nuanced in certain respects. 

However, there is much in the rules that still causes concern. The extension of the original scope of the rules from mere intermediaries to digital entities such as digital news publishers and OCCPs has been a thorny point of contention from the beginning—and rightly so. The IT Act, the parent legislation, does not empower the government to make rules regarding these entities: There is a strong case that the part containing provisions regulating digital news publishers and OCCPs is ultra vires the parent legislation. 

More importantly, the rules envisage regulating these entities via a three-tiered grievance redressal mechanism that, though ostensibly self-regulatory, is largely executive driven. While at the first tier, the nodal point of contact for regulation is a grievance officer appointed by the publisher, the self-regulatory bodies at the second tier are required to register with the Ministry of Information and Broadcasting. This ministry oversees such entities. Finally, membership of the oversight mechanism at the third tier is to be shared among different government ministries. This structure comes coupled with an expansive code of ethics comprising “guidance” on the content that these entities ought to publish. 

This purported self-regulatory regime must be considered against the backdrop of dwindling press freedom and the threats to creative and artistic freedom in India. Several digital news platforms in India recently have been battling strategic lawsuits against public participation—burdensome lawsuits instituted to harass citizens for speaking out—for commentary on prominent public figures and politicians in India. Similarly, a spate of criminal complaints are currently lodged against Netflix and Amazon Prime officials for allegedly “hurting religious sentiments” via shows aired on their platforms. It is in this context of rising majoritarian regulation of speech and expression, as evidenced by India’s backsliding on the World Press Freedom Index, that this grievance redressal mechanism is concerning. By conferring quasi-judicial powers on the executive, and appointing government officials to lead decision-making about the lawfulness of content, this system can potentially be used to curb counterculture and dissenting voices and make the government the judge, the jury and the executioner.

Finally, the 2021 rules retain the controversial traceability clause. This allows law enforcement agencies to demand that intermediaries enable tracing of the “first originator” of a message if an order is passed by a court or by a competent authority under the IT Act. This applied only for the investigation or prevention of offenses related to national security, sovereignty, public order or friendly relations with foreign states, or sexual violence and child sexual abuse materials (CSAM). The traceability requirement has garnered mainstream attention and importance in the wake of several internet-mediated harms in India. The first was a series of lynchings that took place following rumor-mongering via WhatsApp, where, in different instances, more than 20 people were killed by mobs in different parts of India. The second was the proliferation of CSAM on social media platforms, which had prompted a Rajya Sabha ad hoc committee report that suggested enabling traceability to deal with the problem. In the final form, the requirement applies only to significant social media intermediaries (i.e., social media intermediaries with more than 5 million users) that are primarily providing messaging services. While the purported aim is to target popular messaging apps such as WhatsApp and Telegram, without further clarification within the rules themselves, this scope can still be extended to any other significant social media intermediary that enables direct communication between its users. 

While addressing internet-mediated harms is a legitimate aim, and despite the provision enacting additional safeguards, enabling traceability nevertheless would gravely undermine user trust, discourage intermediaries from instituting end-to-end encryption and constitute a severe violation of user privacy. Unsurprisingly, WhatsApp, which boasts of having its largest market in India, has challenged the traceability requirement in court. In the event that this challenge fails, or that the rules are implemented in their current form, it will be a severe blow to communication privacy in India and force companies to undertake disproportionately pervasive surveillance measures as part of compliance. 

The Rules and Beyond: The South Asian Internets 

Broadly, countries pursue online censorship through (a) the development of regulatory apparatus, including legislation, policy measures or statutory orders passed by the executive or (b) the wielding of technological apparatus (for example, in more extreme cases, the deployment of a national firewall). More repressive regimes such as Russia (which has created a “sovereign internet”) and China (via the “Great Firewall of China”) have legitimized these technological measures through legislation. 

The 2021 rules place India alongside several other South Asian countries that have similar laws regulating digital entities, plenary or otherwise, which are directed toward “nationalizing” online content, especially online news, by maintaining government management and control over it. Such a top-down model of government-arbitered regulation has disrupted the exchange of online content between these countries and has hindered the interconnectedness of online communication, leading to distinct and inward-looking “micro-internets.” This splintering of the South Asian cyberspace may have started through executive orders before these regulations were adopted, but the regulations are the final nail in the coffin.

This sort of regulation creates a system of splintered, micro-internets that make it easier for governments to implement online censorship by having smaller internets to govern, solely through legislative measures, policy decisions and, more often than not, orders passed by the executive. For instance, by carrying out “censorship by proxy”—that is, by the coerced delegation of censorship to private actors such as intermediaries, often using intimidation tactics—governments bypass having to deploy expensive technical infrastructure. This serves as a cost-effective solution for emerging economies to maintain control online and exert their digital sovereignty. The link between the increasingly splintered South Asian internet and censorship can be illustrated by Twitter acceding to the Indian government’s orders to disable and limit access to accounts in the wake of large-scale protests. These governments benefit not from the interconnectedness of the network but, rather, from its severance.

South Asian governments have, thus, built a system that allows them to control the flow of information. While the act of applying local law to such digital entities is legitimate, per se, in the South Asian context, it has translated to increasingly authoritarian governments placing illegitimate requirements on these entities in the name of national sovereignty, ultimately eroding user privacy, freedom of expression and freedom of assembly. 

Through legislative measures, delegated or otherwise, governments have sought to censor digital news organizations by blocking their content online. This has come at the expense of exceeding their constitutional mandates.

For instance, Bangladesh, via its Digital Security Act, 2018 (DSA), has outlawed the publication of “false” information and has restricted information that hampers “financial activities” or “religious values or public discipline of the country or any part thereof,” which are beyond its constitutionally placed reasonable restrictions. Even before the DSA was enforced, Bangladesh, under its National Telecommunication Monitoring Center, had set up an intricate system for the regulation of online content, which was legitimized through the 2006 Amendment to its Telecommunication Act, called the Content Blocking and Filtering Project. Pakistan, by contrast, through the 2020 Online Content Blocking Rules, issued under the Prevention of Electronic Crimes Act, 2016 (PECA), has interpreted “fake news” to be subsumed under “public order,” which is one of the constitutional grounds that can be used to restrict the freedom of speech and expression. These rules, however, have been declared prima facie unconstitutional by the Islamabad High Court in an ongoing challenge against the rules and thus beyond the scope of the reasonable restrictions. In 2016, Nepal published a set of Online Media Directives (available only in Nepali) that, when read along with its Journalistic Code of Conduct, prohibit the publication of materials that “distort facts” or that “exaggerate news items.” These directives hamper press freedom in a way that goes beyond the reasonable restrictions on opinion and expression that may be placed under its constitution. Sri Lanka is also on the path of following suit and had proposed a code of ethics for electronic media as early as 2013.

The code of ethics laid down in the Indian 2021 rules binds digital media organizations via similar obligations. Publishers of digital news, for instance, are forbidden from publishing “half truths”—an amorphous concept not defined anywhere in Indian law. The Supreme Court of India also recently directed Indian media houses to refer to and publish the “official version” of news developments, thereby legitimizing the government’s control over the narrative. Further, the excessive executive control over the aforementioned oversight mechanism under the rules, combined with the Indian government’s continuously rising levels of censure on media, makes it likely that the rules would be utilized to harass and intimidate journalists. Lending credence to these concerns is ongoing litigation lodged by different digital media organizations challenging the validity of the rules. 

Enacted against the backdrop of rising instances of disinformation and internet-mediated violence, all of these regulations may be rooted in ostensibly legitimate aims, like public order, public protocol, and public discipline, yet they come at the expense of journalistic freedom. As the coronavirus pandemic has snowballed, governments across South Asia have been further prompted to prioritize the throttling of independent digital media. 

Blocking online media, especially such news that is not palatable to the governments, has led to disjointed networks of communication. Even before enacting its DSA, Bangladesh had blocked access to a popular Indian news outlet because of an article that implicated its military agency in the illegal detention of a prominent academician. Since the DSA’s enforcement, there has been a spate of such incidents where the Bangladeshi government has blocked leading global news outlets. Similarly, Pakistan blocked the website of a prominent Indian news magazine following the enactment of the PECA and has continued to censor other Indian websites, including those of the government. Many Pakistan government websites ending with “gov.pk” (like that of its Telecommunications Authority tasked with content blocking) cannot be accessed from India at least. Reciprocally, a lot of Indian websites do not allow access from Pakistan.

Governments have also adopted executive measures, legitimate or otherwise, that throttle access to the digital space, by blocking apps, websites or other important gatekeepers to the internet. Nepal and Bangladesh, for instance, have blocked news websites critical of the government. Similarly, Sri Lanka and Pakistan have blocked popular apps in the recent past, citing “false news reports” and public order, respectively. 

India’s tryst with access to digital spaces has followed a similar trajectory, with the government showing a propensity for blocking a variety of items online.The Indian government utilized its blocking powers recently to temporarily restrict access to an environmental activism website and Twitter accounts of media organizations critical of the government. In the ongoing tussle between Twitter and the Indian government, there is potential for the government to take further drastic measures by permanently throttling access to gatekeepers critical to the internet. In the past few months, the government has unilaterally submitted in court that Twitter has lost its safe harbor and is now criminally liable for third-party content as a result of noncompliance with the 2021 Rules. In addition, the government supposedly raided Twitter India’s office over the company’s decision to apply a “manipulated media” tag on a post by a ruling party spokesperson. The Delhi High Court has shown its disinclination toward granting protection to Twitter at a time when Twitter and its officials are already facing four criminal cases in India.

Similar to the sanctions on digital publishers, these disruptive measures are underscored by seemingly legitimate government aims—public order, national security, maintenance of peace—and yet, in most cases, they have constituted a disproportionate means to an end. The practical implications are that local alternatives (like Koo, a rising, right-wing-approved alternative in India that is looking to replace Twitter in India and abroad) would likely comply with the government’s writ willingly, putting citizens’ freedom of expression in jeopardy. 

By introducing country-specific conditions on social media platforms and other online intermediaries, digital entities are being made to adopt dubious regulations disguised in the legitimate cloak of law enforcement. Examples include mandating surveillance of social media live streams in Pakistan or breaking of end-to-end encryption in India through traceability. The self-regulatory mechanisms of such entities are, thus, overridden by such regulations. Pakistan has gone a step further and misplaced data localization requirements in its 2020 blocking rules. While doing so may be a legitimate exercise to further its digital sovereignty, the correct place for a data localization clause is in data protection legislation, which Pakistan does not currently have, and not content-blocking regulation. This illustrates the general climate of digital protectionism in the region.

Final Thoughts 

Free speech is vital for emerging economies, especially in times of crisis. The existence of an open media in democratic countries allows the government to face opposition, public pressure, and criticism, and to stop crises from exacerbating. An undemocratic state of affairs and restrictions on the press lead to the absence of public discourse and then to the absence of the correct policy decisions. Attempts to censor digital media or social media spaces make the country’s populace vulnerable and potentially result in denial of vital socioeconomic rights. Disinformation thrives where human rights are most constrained. Journalists and civil society are, perhaps, the most suited to challenge falsehoods and present alternative viewpoints to mitigate this “information disorder.”

India’s 2021 rules cast a wide net over its various digital entities by defining terms such as “publisher” and “social media intermediary” broadly and, thus, set an example for other nations to subject these entities to ex ante regulation and to weaken private speech. This push for stringent regulation and an emerging precedent for “official,” state-supported speech will only serve as a template for other democracies to shift from a democratic, open internet to a state-controlled one, mirroring the examples of China and, more recently, Russia. Mauritius, for instance, already cites India’s 2021 rules in an attempt to muzzle social media. Pakistan—which seeks to establish an all-encompassing body bolstering its control of media, including “digital media”—also developed the draft ordinance keeping in mind the Indian law.

Both India and Pakistan have exploited a time of crisis to implement these policies, pushing for restrictive internet regulation during the pandemic.

In one way, India’s position on the regulation of the internet has come full circle. The safe harbor model of regulation—which had previously allowed various social media platforms in India to flourish—was originally instituted following litigation and the prosecution of the managing director of a subsidiary company of eBay for an unlawful clip circulated on the e-commerce platform. India is once again bringing individuals to court (a concerned head of Amazon Prime India for hurting religious sentiments, for instance), allegedly raiding Twitter’s office without any legal basis and questioning and warning of prosecuting its managing director. By enacting these rules, the Indian government has effectively diluted this safe harbor protection, resulting in the internet being increasingly run and administered by forces operating on-ground such as the police under the watch of the political executive. Indian internet regulation is thus back with a vengeance, as a result of the government having legitimized such practices this time around.

The populace of the Indian subcontinent is caught in the crossfire of the ongoing war between tech companies and government. As South Asian nations force these corporations into yielding, the potential of the state to control the citizenry through these corporations is clear. The region is witnessing the gradual erosion of human rights. Thus, the loser remains the citizenry. It remains to be seen whether this model of internet regulation will serve as a template and be exported to other developing nations in other regions. Hopefully, the South Asian example does not herald a democratically barren digital world in the years to come.