How new telecom law will impact the way we use apps like WhatsApp

The Telecommunications Act, 2023, came into force on June 26. Even though the law had been passed in December 2023, the new provisions it has come with are raising some important issues concerning the everyday use of telecom services.At the outset, the purpose for enacting a new law was to replace the three archaic legislations that had been in use since colonial times. These were the Indian Telegraph Act, 1885; Indian Wireless Telegraphy Act, 1933; and the Telegraph Wires (Unlawful) Possession Act, 1951.So, there was an obvious need to overhaul the erstwhile framework given the massive advances that the telecom sector had undergone both in terms of coverage of telecom services and its diverse applications. But even as the Act modernises many aspects of the telecom business, it is still unclear how much cheer its provisions will bring to the average user.How it affects you and IPerhaps the most impactful aspect of the new telecom law is the rather open-ended way in which the new law defines ‘telecommunication’. Till now, the Telegraph Act, 1885, and the Indian Wireless Telegraphy Act, 1933, which regulated user-facing issues for telecom resources, defined these services in a manner that included landlines and communications services provided by cellular network operators — calls and / or SMSes / MMSes.What the new telecom law does is it allows over-the-top (OTT) communication services such as WhatsApp, Telegram, Messenger etc to be covered within its ambit. While the previous draft explicitly mentioned these services within its scope, the new Act has left it open to interpretation.Many find this problematic because it allows for the potential extension of various obligations on telecom operators to OTT communication services. Consider that, at present, when we apply for a mobile number, telecom operators are required to comply with extensive ‘know your customer’ (KYC) norms in place under the Universal Access Service Licence (UASL). Not only do these include a lot of personal details to be collected, but also submission of proofs such as permanent / local address proofs. medium nocaptionhttps://youtu.be/HVcxUnkYgfo?si=fJOcvLIOOdbTEdltImagine the application of the same every time you install or create an account on an OTT communications app such as WhatsApp, Zoom, Gmail etc. What’s more, it need not be just for apps that are primarily geared towards providing communication services but apps that provide communication as a feature such as dating apps, video-streaming apps, gaming apps, etc. This is likely to create mayhem for users.Telcos have for long demanded that the principle of “same service, same rules” be applied to OTTs so that they are regulated in the same way as basic telephony and messaging services. This is because telcos are aggrieved by the fact that while they are the ones to invest in infrastructure and bear costs of compliance, OTTs free ride on them and provide services to substitute their messaging and telephony services, thereby cutting in their revenues.Despite the assurance by the IT minister and general lack of consensus among regulators on how to regulate OTTs, there is no legal bar that prevents the government from imposing telco-like licensing agreements on OTTs in the Act itself. Apart from KYC, UASL-like licensing regiments can also increase surveillance powers of the government over OTT users.For example, the UASL bars “bulk encryption” and gives the government the power to evaluate the encryption equipment used. The government also has the right to access equipment and networks for technical scrutiny and inspection.No room to hideThe second area of concern in the notified provisions are the “duties on users”. Section 29 of the Act imposes a duty on users to not “furnish any false particulars, suppress any material information, or impersonate another person, while establishing his identity for availing of telecommunication services”. In so far as cellular services are concerned, where one has to comply with KYC norms, this makes sense.But then again, the problem lies in the scope this provision leaves for interpretation. For example, what is “material information”? Can it cover the use of virtual private networks (VPNs) for accessing OTTs? Although the use of VPNs is legal in India, can it now mean that because VPNs help in masking the actual IP address, using them would mean suppression of information from where a person is accessing the service? When does the location of access to a communication become material? Consider the scenario of using VPNs to access apps or content that is currently banned in India. A simple search online throws up a number of links that provide information on the “best VPNs” to access TikTok in India. This is an easier case to argue for violation of duty by suppressing material information than businesses using VPNs for security measures, although the act of suppression is the same in both cases. medium111517720This also begs the larger question of what such a duty means for anonymity online. If OTTs were to be included within its purview, would it mean that a user of OTT communication apps would no longer be able to use pseudonyms for their social media accounts? What would it mean for parody accounts? One can argue that it may possibly mean that the information provided to a social media intermediary while registering the account needs to be genuine, but the username could be a pseudonym.However, given the power of the government to obtain information from social media intermediaries under various IT Rules, this model would hardly be a guarantee for online anonymity. Notably, this move also seems in keeping with similar provisions under the Digital Personal Data Protection Act, 2023, that place obligations on data principals to “not impersonate another person while providing personal data”.Government on to youThird, there was quite a lot of hope that in bringing the new Act, especially in the backdrop of the development of fundamental rights jurisprudence since independence, that the government’s powers of surveillance and internet shutdowns will be more streamlined. At the time of proposing this new law, the government, in its explanatory memorandum, stated that the “Bill provides for an enabling framework for the central government to address any situations of public emergency, public safety or national security concerns… while ensuring the rights of the citizens of India”.However, the Act simply transplants the colonial-era surveillance procedures under the Telegraph Act, 1885. This is problematic not because of the extent of surveillance powers, but because of procedural inadequacies in the exercise of these powers. Prior to the new Act, the government’s power of interception of personal communications, barring online communications, was provided for under the Telegraph Act, 1885, and Rule 419-A of the Indian Telegraph Rules, 1951. medium nocaptionhttps://youtu.be/zyKu7DxzcR4?si=cVALAAg73_0h0TGCEven though the language of the provisions in both the new Act and the Telegraph Act, 1885, is the same, there is still scope in the rules framed under the new Act to imbibe procedural safeguards over and above those in Rule 419-A. A similar concern exists with the power of the government to order internet shutdowns. In 2020, the Supreme Court in Anuradha Bhasin vs Union of India laid out a number of procedural safeguards over and above those in the Temporary Suspension of Telecom Services (Public Emergency & Public Safety) Rules, 2017.Naturally, it was expected that the new Act coming after the judgment would imbibe these safeguards. However, again as with interception powers, as far as the text of the Act is concerned, there is no change from what the Telegraph Act provided for in 1885. Unless the new rules incorporate the Anuradha Bhasin judgment, users should not expect much to change with respect to internet shutdowns.An end to spam?Lastly, users can expect some relief from fraudulent and unsolicited communications. Reportedly, more than 60% of Indians have received three or more spam calls daily on an average for the past 12 months. Scam calls have become all the more prevalent with the impetus gained through deepfakes. A survey in 2023, conducted by McAfee, showed that more than 47% of Indian adults in the sample had experienced some form of AI voice scam.One of the notified sections provides that prior consent of users will be required for sending communications that intend to offer, advertise or promote goods, services, business or financial opportunities. Additionally, significant penalties — imprisonment for up to three years and / or fine up to ₹50 lakh — are prescribed for obtaining telecommunication identifiers through fraud, cheating or impersonation. Telecommunications identifiers are typically a series of digits and characters that are used to uniquely identify a user.A common example is the headers of banking SMSes that we receive. These help us identify, and provide assurance to some degree, of the authenticity of the message. The Telecom Regulatory Authority of India (Trai) assigns these headers on specific requests being made by entities. medium111517631As per Trai, an SMS header is typically in the XY-ABCDEF format, where X denotes the service provider, Y denotes the telecom circle and ABCDEF is the header requested by a specific entity that is representative of its identity. For example, VM-CBSSBI would mean that the message is sent through the Vodafone network in Mumbai by an entity that has registered the header as CBSSBI, presumably the State Bank of India. Trai, in fact, provides a public list of headers with associated principal entities, to allow users to check which entity the header belongs to.Notably, Trai also has done extensive work on curbing unsolicited and spam communications and has a specific set of regulations — the Telecom Commercial Communication Customer Preference Regulation, 2018, and the Do Not Disturb Registry set up under it. However, its enforcement has been less than ideal. In that context, the stringent penalties provided for under the new Act coupled with the central government’s resources for enforcement could arguably lead to better outcomes for the user.However, there are concerns over the overlapping authority of Trai and the central government in dealing with the issue. While the Act provides for central government rules to be “in consonance with any regulations notified by Trai”, how this will pan out remains to be seen.