A screenshot of a fake resignation letter bearing the forged signature of a chief minister has triggered a legal battle in Tripura and prompted the state police to use a little-known provision of India’s information technology law to try and pierce social media giant WhatsApp’s encryption shield and force the behemoth to give up the origin of the viral message.

The controversial Rule 4(2) of the 2021 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, which are under the IT Act, allows the identification of the “first originator” of a message if the request is backed by a judicial order in cases involving serious crimes like rape or threats to national security.

Also read: Amended IT rules not meant to curb free speech, criticism: Centre to HC

This provision — known colloquially as the traceability rule — was invoked by the Tripura Police in May this year when it approached a local court for permission to track down the originator of a viral post with the forged signature of chief minister Manik Saha. Experts said it was the first time that an Indian law enforcement agency used the provision against WhatsApp.

A local court in Agartala granted the request on May 27, setting off a confrontation with WhatsApp that has touted end-to-end encryption as one of its core offerings and told several Indian courts in the last few years that it cannot trace the origins of a message without dismantling its own protections.

After months of wrangling with the Tripura Police, WhatsApp finally approached the Tripura high court on September 22, asking it to set aside the traceability order. The high court granted a stay on September 26.

But the proceedings in the landmark case might hold wider ramifications for privacy, social media companies and law enforcement, say experts.

WhatsApp and Tripura Police did not respond to requests seeking comment.

Fake letter led to a traceability order within three days

On May 25, Tipra Motha party (TMP) member Meri Debbarma’s Facebook page shared a WhatsApp screenshot of a fake resignation letter dated May 22, bearing chief minister Saha’s forged signature. It was posted with a comment that roughly translates to, “What is their future? There will be a switch this time too.”

The Bharatiya Janata Party’s (BJP) Saha was named Tripura chief minister in 2022 after Biplab Kumar Deb’s resignation.

Debbarma, who lost the 2023 state elections from the Kamalpur constituency, told HT that she does not post to her Facebook page and that a member of her IT team, Rinku Debbarma, shared the post in question.

This post, according to Tripura Police’s investigating officer (IO) Sukanta Deb’s application to the judicial magistrate, was a screenshot from a WhatsApp group named “Aamader Mukkhomontri”, or “Our Chief Minister” in Bengali. It was forwarded by an individual named “Palash Chakraborty Ji” to the group.

The officer, in his application, wrote that Meri got this message from multiple places, including in a WhatsApp group named “TIPRA 32 Matabari 3” of which she is a member. In his application, Deb listed the number of the sender in this group.

The fake post went viral and eventually caught the eye of Sujata Deb, an advocate who is the the social media convenor for the BJP’s state mahila morcha. She filed a complaint at the New Capital Complex Police Station in Agartala on May 25 itself. By then, the post had been deleted.

“I filed the complaint because it spread fake news about the CM,” she told HT.

An FIR was registered under sections 468 (forgery for purpose of cheating), 469 (forgery for purpose of harming reputation), 471 (using a forged document as a genuine document), 500 (punishment for defamation), 504 (intentional insult with the intent to provoke breach of peace) and 120B (punishment of criminal conspiracy) of the Indian Penal Code and Section 66D (punishment for cheating by personation by using computer resource) of the Information Technology (IT) Act.

Within a day, the judicial magistrate received the FIR, ordered the IO to investigate and submit a report.

A day later, on May 27, Meri Debbarma said Sukanta Deb questioned her for half an hour and seized Rinku’s phone, a black Oppo F31, along with his Airtel SIM card, according to the police’s seizures list. The same day, Deb submitted an application to the chief judicial magistrate of West Tripura district seeking an order under Rule 4(2) of the IT Rules directing WhatsApp’s nodal officer to identify the first originator of the screenshot. In his application, Deb did not mention that he had already seized Rinku’s phone and SIM card.

In his application, Deb wrote that the letter “has gone viral and is being circulated across different Whatsapp groups” and has “the potential to create massive Public Disorder” and “can act as an incitement for breakdown of law and order” in Tripura. He wrote that the message was “created with malafide intention to disturb public order and create violence” in Tripura. He argued that the perpetrator “operating to destabilize the democratically elected Government of Tripura” had to be “taken to task”.

The same day, judicial magistrate Baishali Choudhury ordered WhatsApp’s nodal officer to “disclose the identification of first originator” “without further delay”. HT has seen a copy of this order.

On May 27 itself, the Union of India, uploaded a request to furnish the first originator to WhatsApp’s “Law Enforcement Online Request System”. Two days later, the government followed up with WhatsApp with the traceability order and an email from the State of Tripura. On May 31, the State of Tripura too uploaded a request to the “Law Enforcement Online Request System”.

For almost four months, according to people aware of the matter, WhatsApp told law enforcement officials that it could not reveal the first originator because of end-to-end encryption but to no avail. It finally filed a writ petition in the Tripura high court on September 22.

Impossible to trace, matter sub judice: WhatsApp

In its petition in the high court, WhatsApp cited a May 26, 2021 press release by the Union IT ministry that said the “originator of information can only be traced in a scenario where other remedies have proven to be ineffective, making the same a last resort measure”.

This, paired with the fact that the traceability order was issued the same day as the IO’s application, shows that the order was passed “without exploring other available means of identifying ‘the first originator’”, WhatsApp argued.

Citing the Supreme Court’s 2019 Puttaswamy judgment, WhatsApp argued that the IO’s application did not demonstrate that all less intrusive investigative methods had failed. In fact, it wrote that Tripura Police “resorted to seeking a tracing order under Impugned Rule 4(2) without first pursuing other methods or remedies to identify the first originator”. The impugned order, too, does “not demonstrate any consideration of possible alternatives, and if they were tested to determine whether such alternatives realize the intended goal of” Tripura Police.

WhatsApp, in its petition, argued that finding the originator does not fall within the six reasons given in the already challenged Rule 4(2). It said that Deb’s application only “speculate[d]” that the content and alleged offences implicated “public order” but “fail[ed] to allege any facts” or show through supporting material that it is “reasonably or rather fairly certain” that the content creates a “clear and present danger” or “imminent lawless action”. It also argued that the IO had not offered any proof of virality of the content.

WhatsApp reiterated many of its arguments from its 2021 petition in the Delhi high court challenging the traceability rule. It also reaffirmed that end-to-end encryption prevents WhatsApp and anybody else from “being able to determine who said what on WhatsApp”.

It also argued that the police failed to establish an “intention to deceive”.

Threat to public order not established: Tripura high court

Before the Tripura high court division bench comprising chief justice Aparesh Kumar Singh and Justice T Amarnath Goud, senior advocate Mukul Rohatgi, appearing for WhatsApp, and said the investigating officer had not made out a case for an “imminent threat to public order” in his application. He argued that the judicial magistrate, too, had not referred to any “tangible threat to public order” which is a requirement for invocation of a traceability order.

Advocate general SS Dey, along with additional public prosecutor Samrat Ghosh, both appearing for Tripura, argued that as an intermediary, WhatsApp did not have any standing to object to a traceability order and said this prerogative lay only with accused people.

Eventually, the division bench ruled in WhatsApp’s favour and stayed the lower court’s traceability order.

They wrote that the trial court had not dealt with the issue of “the extent of threat to public order as contemplated under Rule 4(2)”, especially since the request for traceability was raised “only 2(two) days of the institution of the FIR”. The case is next listed for December 5.