GURUGRAM, India — By the second week of March, India had only recorded around 50 cases of COVID-19, but the country felt on edge, poised for the outbreak to explode. On social media, rumors had begun to fly.
One claimed that the outbreak had been concocted to hide the spread of a bioweapon, which had been released by accident in Wuhan, China. Another, designed to stoke already heightened social tensions, said that Muslims were deliberately spreading the virus by spitting on bread.
As the problem spiraled further out of control, government officials asked WhatsApp, the Facebook-owned messaging service that is by some distance the most popular platform in India, for a solution. In turn, WhatsApp approached Aakrit Vaish, co-founder of Haptik Infotech.
Haptik builds chatbots that allow companies to automate their customer services, and, acting on its own initiative, had already built a coronavirus helpline. Vaish was called in to give a demonstration to government officials. After 48 hours of marathon meetings between Haptik, Facebook’s local and global offices and government ministries, they got the green light to launch a WhatsApp-based chatbot for users to ask questions about the disease. It launched five days later, and is now India’s de facto official service.
The scale and speed was incredible, Vaish said. “The … highlight for me was the pace at which [Facebook and the government] wanted to move,” he told the Nikkei Asian Review.
Around the world, social media companies have come under intense pressure since the beginning of 2020, as the COVID-19 pandemic once again demonstrated their role in facilitating the spread of dangerous misinformation — something World Health Organization Director-General Tedros Adhanom Ghebreyesus has called “an infodemic.”
It is a battle that has been playing out in India for years. While the two may have called a temporary truce to cooperate on the pandemic response, Facebook and the Indian government have been locked in a series of battles over privacy, security and online misinformation.
In India, Facebook sees a colossal market ripe for growth, and has invested heavily. On April 22, the company announced a $5.7 billion deal for 9.99% of Reliance Jio, a telecommunications network operator with 370 million subscribers. But Indian society has been riven with violence catalyzed by the unfettered spread of malicious rumor through the company’s platforms. Security services want access to private messages, while other government ministries worry about the data that Facebook is collecting on citizens.
How the two sides resolve these clashes could have implications for the way that social media and the internet are regulated globally. With 1.3 billion people, India is one of the most important players in the future of the internet. What happens here could shape policy around the world.
“The rest of the internet is collateral damage,” Nikhil Pahwa, editor of digital and telecom website MediaNama, said. “The problems of Facebook are the problems of the internet … because of how dominant they are.”
Privacy and potential
Facebook’s India offices are on the 17th floor of a glitzy modern building in Gurugram, a satellite city on the outskirts of Delhi. Unlike the glass exterior, the interiors are more reminiscent of a trendy Brooklyn warehouse, laid out in open plan under exposed beams. Bright, kitschy cushions are tossed around the common seating spaces, in a slight Indian touch. The company has outgrown the space and will soon be taking over an entire building a couple of miles away.
With 688 million internet users, India has the world’s second-largest number of people online, after China. An explosion of cheap data and affordable smartphones has seen digital platforms practically replace broadcast television as the country’s mass-reach media.
Facebook has ridden that wave. Around 328 million people have accounts, and around 300 million regularly use its WhatsApp messaging service. After an earlier failed attempt, Instagram is also seeing users sign up, although the company has declined to disclose how many. Revenues in India have been growing at least 25% year on year, up from a reported $980 million in 2018. With a few hundred million people yet to come online in the country, the potential opportunity for any business is heady.
In January 2019, Facebook announced a new leadership structure for India, separating it from its Asia-Pacific division and placing it under Ajit Mohan, vice president and managing director of Facebook India, who reports directly to the company’s headquarters in Menlo Park, California.
Mohan, 45, a native of the southern Indian state of Kerala, is slight and bespectacled, his conversation peppered with quick jabs of humor and sarcasm as he lays out India’s importance to the social networking giant. After working with global consultancy McKinsey & Co. as a media analyst in New York and then as a fellow at the McKinsey Global Institute, where he co-authored a report on building inclusive cities in India, he joined Star TV in Mumbai — then owned by Rupert Murdoch — setting up and running as CEO its hugely popular streaming service, Hotstar.
Mohan said that Menlo Park’s excitement about India goes beyond the size of the user base. Rather, it’s the company recognizing that India “is in the middle of an exciting social and economic transformation and we have the opportunity to create impact here, probably more than in any other country in the world,” he said.
Unfortunately for Mohan, some of Facebook’s impact has been profoundly concerning for policymakers.
In 2017 and 2018, a wave of vicious rumors spread across the country on social media, and especially WhatsApp. Some alleged that there were people in the neighborhood out to abduct children. Others claimed Muslims were butchering cows, sacred to Hindus. The result was multiple incidents where groups of residents lynched or beat — at times, fatally — individuals thought to be the alleged criminals.
An analysis by IndiaSpend, a data journalism website, showed that between Jan. 1, 2017, and July 5, 2018, 33 people were killed and at least 99 injured in 69 reported cases of mobs attacking people they suspected were planning to abduct children. In all the cases, the charges turned out to be baseless, with 77% of the reports based on fake news that had spread through social media.
Government officials turned their ire on social media platforms, blaming them for the spread of the rumors that led to death and injury. WhatsApp, the most popular communication platform in the country, became the poster child of fake news.
Facebook responded to calls to curb the spread with full-page advertisements in 10 Indian-language newspapers and radio ads on the national broadcaster, recommending tips to stay safe on WhatsApp. The company introduced labels to show a message had been forwarded, and instituted a five-person limit to forwarding messages. That measure was later rolled out to the rest of the world.
It was not enough for the Indian government. In December 2018, they published a draft set of rules to govern social media companies operating in the country. These include a provision that, if a company receives a complaint about any content hosted on its platform from any government agency, it would be required to trace the origin of that content and provide that information to the agency — as long as the government has a court order to back its demand. Platforms would have to provide the information within 72 hours, and disable the content within 36 hours. The rules are expected to come into force after India ends its nationwide lockdown.
WhatsApp has a case pending in India’s top court on the matter. In a statement, the company said that the matter was sub judice, or before the court, and that it believed in maintaining people’s fundamental right to privacy.
The government is not buying that line. “We’re not asking them to break encryption,” said a government official in the Department of Telecommunications who declined to be named as he is not authorized to speak to media. “We just want to know who sent the [offending] message. We’re not asking for access to that person’s phone.”
It is unlikely that the originator of a message could be traced without breaking encryption, Sarvjeet Singh, executive director at the Centre for Communication Governance at the National Law University Delhi, told Nikkei. “If that’s the case, it’s a problem,” he said.
The potential for weakening or ending encryption — a security feature which, in WhatsApp’s early days, differentiated it from its rivals — has alarmed experts around the world. In January, nearly 30 experts flagged their concerns in a letter to India’s Ministry of Electronics & Information Technology through the Internet Society, an American nonprofit that works on internet-related standards. “There is no way to create ‘exceptional access’ for some without weakening the security of the system for all,” they said.
The original version of India’s draft rules also requires all platforms to proactively identify and remove all “unlawful information or content” — a move which, should it go through, would have “grave unintended consequences on the security of the Internet, the Indian economy and Internet users,” the letter warned.
National Law University’s Singh agrees. If the rules are implemented in their current form, “a lot of rights will be affected” and would not only be out of proportion, but also “would be unconstitutional,” he said.
A recent version of the draft seen by Nikkei does not include this clause, but it is not clear whether it will be included in the final version of the law.
In a statement, Internet and Mobile Association of India, an industry body, said that these companies were essentially providing a platform to host content by third parties, and any regulation on them would “impact a very broad set of services across different sectors of the economy and overregulations may hamper the digital ecosystem.”
The draft rules also require all social media platforms with more than 5 million registered users to have an office in India as well as a someone responsible for handling grievances. Facebook, brought on a grievance officer for India in August 2018 in California, and now says it has appointed one locally.
It is not just Facebook that worries about the implications of an end to encryption.
Pegasus
In October 2019, Shubhranshu Choudhary, an activist in the central Indian state of Chhattisgarh, received a phone call from The Citizen Lab, a Toronto-based organization that monitors digital threats to civil society. Choudhary, burly and bearded, works for the rights of indigenous groups caught up in ongoing clashes between Maoist guerrillas and the state. He had become something of an irritant to the state government: In March that year, he had led around 300 people on bicycles and on foot over 300 km to the state capital to demand that land be given to those displaced by the fighting. The Citizen Lab told him his phone had been hacked.
“I work on a peace process,” said Choudhary. “It’s up to the government to answer why it was keeping an eye on me.”
Choudhary was one of 121 human rights activists, lawyers, politicians and journalists targeted by the Israeli security company NSO Group, which had used WhatsApp video calls to install Pegasus spyware on targets’ smartphones. The users did not even have to accept the call for the software to be installed, giving access to all of their text and WhatsApp messages, emails, photos, passwords, contacts, and practically everything else on their phones.
Many of those targeted were activists and lawyers working for the poorest and the weakest in the country, including indigenous groups and lower-caste Dalits, and were often battling the state for their rights on their behalf.
Shalini Gera, a lawyer who works for the legal rights of indigenous people affected by Maoist violence, also in Chhattisgarh State, was hacked as well. She believes that she was targeted for her ongoing defense of union activist Sudha Bharadwaj who, along with a handful of others, had been accused of “waging war against the nation” and inciting riots through speeches.
Ph.D. student Vidhya, who declined to give her last name, initially ignored a call and message from The Citizen Lab telling her that her phone had been hacked, because it “didn’t make any sense” and she didn’t know what to do, she said. It took a similar message from WhatsApp for the reality to finally sink in for Vidhya, who has been part of several fact-finding missions to uncover sexual violence against women by the state. A private woman, the invasion has left her “on edge,” and has seen her withdraw from communicating with some people.
“I see people’s natural response of fear [to being hacked],” Vidhya said. “I don’t understand it, and I don’t want others to be bothered by it. It didn’t seem fair to them.”
The Indian government has not answered questions in parliament about whether or not it was behind the Pegasus program. NSO Group has said in the past that the software is only sold to licensed government intelligence and law enforcement agencies. Facebook has filed a case against the NSO Group in the federal court in California. The company said that it believes that “people have a fundamental right to privacy and that no one else should have access to your private conversations.”
The problem, MediaNama’s Nikhil Pahwa said, is that because some massive platforms, including WhatsApp and Facebook, have in the past been lax with rules about privacy of users, regulators are now targeting them. “These are the largest platforms in their own domains in India and they dominate all conversations around the internet,” he said.
As it tries to defend its users’ right to privacy in India, Facebook is also up against possible restrictions on its own collection of private information. A new personal data protection bill is currently under review by a parliamentary committee. If passed, it would force social media companies to have consent from users to collect and process their data. While seeking consent, they would have to state the purpose for which the personal data is to be processed and inform the user about the individuals or entities with whom such personal data may be shared, including third-party companies hired to process the data.
The bill also includes numerous exceptions for government agencies seeking to access citizens’ personal data.
The proposed legislation also demands that companies that handle large volumes of data, and have significant revenues must get permission from the data regulator before they adopt any new technology. All companies must also save at least one copy of users’ data in India. Sensitive data, such as financial, religious or biometric information, can only be stored and processed in India.
“This will have a freezing effect on offering and adoption of new technologies in India,” industry body IAMAI warned.
In a statement, Facebook said that unrestricted free flows of data was a bedrock principle of an open internet, and had greatly contributed to India’s technology boom. It added, that while any data protection regime should protect consumers, it should also “boost the ease of doing business in India.”
Digital economy
As it tries to fend off these regulatory attacks, Facebook’s pitch to India has been that it is an enabler of the digital economy. The company has been trying to bring entrepreneurs onto its various platforms, including a kit that allows small businesses to set up Wi-Fi hot spots.
To draw more startups onto its advertising platform, Facebook has tied up with a handful of venture funds in the country and is working with their portfolio companies. It has also made minority investments in a couple of startups that it believes are disruptive and can scale — a break from the playbook of the head office, which never makes minority investments. Mohan said it will do more of that. It has also been conducting training sessions in small towns for local entrepreneurs on how to use Facebook advertising to drive business.
Its 2015 attempt to broaden digital access — “Free Basics,” which allowed users onto a limited internet — was rejected by the government on the grounds that it undermined net neutrality. Now, Facebook is investing in different ways to bring the second half of the population online, including marginalized groups, women and poorer communities. It has a revenue share agreement with Oneott Intertainment, an internet service provider that is building Wi-Fi networks in slums and villages.
Oil India Chief Executive Yugal Sharma said that Facebook had accelerated his own plans to take internet services to underserved communities. “They brought global know-how and funding and that gave me scale, helped me to nip this opportunity at the right time,” he said.
Facebook is pushing WhatsApp Pay, its payments app, as a mechanism to enable small businesses to go online. The company has been running a pilot with 1 million users since February 2018, and is awaiting regulatory approval to roll it out more widely.
The company has also been on a charm offensive, sponsoring public events and taking out advertisements in an attempt, Mohan said, to “tell our story ourselves.”
Over the past three years, the conversation “has been filled with voices that have not represented us rightly,” he said.
Mohan calls the government scrutiny “completely reasonable and fair” and a “renegotiation” between large tech companies and governments and citizens where everyone is “trying to get their head around what are the trade-offs in this [for instance], privacy versus security.”
While the company believes there should be regulation, he said, it asks that the rules should be “interoperable” across the countries where it is active. “The entire power of the internet has been that there haven’t been silos, we haven’t erected artificial barriers in terms of flow of information and communication and innovation.”
On April 7, WhatsApp announced that it would again limit the number of people to whom a WhatsApp message can be forwarded to one for “highly forwarded” content — a move designed to tackle misinformation related to the COVID-19 pandemic. The measure is global, and indefinite. Some analysts have argued that, after years of resisting pressure to change, the immediacy of the coronavirus threat has led social media giants to finally take action.
It will have been noted in India. One of the main reasons that Facebook and other global tech companies are watching carefully what policies New Delhi enforces eventually is that because of the sheer number of users online in India, any rules that the government imposes here on global tech companies are bound to have a far-reaching effect.
Mohan acknowledged this, saying that “India is a big, consequential player in influencing the new rules of the internet.” However, he emphasized, so is Facebook.
“Facebook is a big part of the conversation in a world where so much emphasis is on technology, and what the new rules of the internet should be, and how technology is impacting lives,” he said. “We’re a natural participant in those conversations, given how consequential we are.”