Many of these testimonies were shared by anonymous social media handles to protect the survivors of assault from reprisals by their alleged abusers.
Now the Delhi High Court has ordered Facebook to unmask one such anonymous account. Subodh Gupta, an influential Indian artist whose works are often auctioned for millions of dollars, is suing the as-yet-unknown users of an Instagram handle called HerdSceneAnd for civil defamation and Rs 5 crore (approximately $700,000) in damages.
The HerdSceneAnd handle popped up on Instagram last year as a platform for women to share experiences of abuse and harassment in India’s art world. Anonymous testimonies on the handle accused Gupta of a range of misconduct ranging from inappropriate sexual comments to unwanted, persistent advances and inappropriate touching. Gupta has denied the allegations.
On September 20 2019, Justice Rajiv Sahai Endlaw ordered Facebook to provide “the particulars of the person behind the Instagram account” in a sealed envelope in time for the next hearing on November 18 this year.
Facebook, which owns Instagram, has declined to comment on what it will do next. But the social media giant’s decisions in India next month could have wide-ranging effects on the privacy and anonymity of the over 2.4 billion users of Facebook, WhatsApp and Instagram across the world.
Any user information that Facebook puts before Indian courts is likely to fuel a raging debate on the magnitude and granularity of data that big tech companies like Google, Facebook and Amazon routinely gather about us all, and how this data is deployed.
In the recent past, social media giants have been only too happy to portray themselves as guardians of free speech and expression in the face of repressive regimes. As recently as July 2019, Twitter referenced #MeTooIndia in a glitzy consumer campaign intended to showcase the power of the platform.
Unmasking the collective behind the HerdSceneAnd Instagram account is likely to undermine claims that these platforms serve a higher social purpose.
“Anonymity is the real way whistleblowers, political dissidents, people who have experienced systemic harassment and abuse make their voice heard in societies which do not share their values,” Apar Gupta, a lawyer with the Internet Freedom Foundation, an Indian digital rights advocacy group, told HuffPost India, adding that such harm often happens precisely because the “victim is someone who lacks power in a particular setting”.
Thus far, the Delhi High Court has only asked for information about HerdSceneAnd’s operators. Should Facebook comply, the lawyer said, the company might find itself receiving more detailed requests for information. This may include all correspondence through the account which could expose the identities of women who shared their testimonies of harassment with HerdSceneAnd.
Anonymity, supporters of India’s #MeToo movement have said, is essential to protect survivors of sexual harassment and assault.
“This defamation suit against @herdsceneand is an outright move to silence the survivors and gag the platform that gave them a voice while protecting their identities,” said a statement of solidarity, circulated over email and signed by at least 38 women journalists and artists. “This is exactly what survivors have feared when choosing anonymity. This is an attempt to dissuade others from sharing further experiences of harassment and violence, and to perpetuate a culture of fear.”
Facebook declined to respond to HuffPost India’s questions.
“We will not be able to comment as the matter is sub judice. Facebook remains committed to complying with applicable laws,” a Facebook representative said in an email.
Neoma Vasdev, a lawyer for Subodh Gupta, the artist in question, also declined HuffPost India’s requests for comment.
Silencing free speech online
The Instagram handle, according to court documents, is linked to an anonymous email id — firstname.lastname@example.org — meaning Facebook could simply pass the buck on to Google, which could be the next in line to receive a court order.
Or, Facebook could start diving into the voluminous archives of user data it collects across WhatsApp, Facebook and Instagram to zero in on a list of likely users. It is common practice for Facebook and Google to assign unique advertiser ids to users (here is how to reset yours), but insist that the data is anonymised and can’t be used to identify individual users. Privacy experts have disputed these claims.
Interestingly, Instagram’s public position in the United States says the platform may share Internet Protocol (IP) addresses of users if the company is served “a valid subpoena issued in connection with an official criminal investigation”.
IP addresses, privacy experts say, are often gateways to a wealth of user information. In 2013, the Indian government ordered all Internet Service Providers to maintain detailed logs of IP activity of Indian Internet users for a minimum of one year. These logs must include a user’s name, address and contact number — data that Internet users must provide to service providers when signing up for a connection.
“People tend to have this perception that they are anonymous online, but nothing could be farther from the truth,” said Joseph Lorenzo Hall, Chief Technologist at the Center for Democracy and Technology (CDT) in Washington DC. “The ‘digital exhaust’ we leave in our wakes as we do things online is prodigious and highly identifying.”
Hall said that in the US context there are ‘John Doe’ lawsuits that seek to unmask anonymous user accounts, but these lawsuits are usually directed at Internet Service Providers.
The lawsuit against HerdSceneAnd has parallels to a case involving Diet Madison, an Instagram account that publicised allegations of sexual harassment in the US advertising industry. In the Diet Madison case, which is still underway in a Los Angeles courtroom, the judge has limited the information that can be asked for. In the India case however, the courts have directly asked Facebook for user information.
Were Facebook to hand over user data, Hall said, “it would mean that Instagram users would need to be very careful making whistleblower-like or even critical comments about people in positions of power, lest the powerful people sue and have an easy way to chill speech on Instagram.”
Encryption versus enforcement
India’s whole-hearted embrace of Facebook’s social media platforms, coupled with the Indian government’s draconian position on free speech and growing obsession with surveillance, has given the country significant leverage in the ongoing debate pitting encryption technologies against law enforcement companies. What happens in India could affect how users around the world experience these services.
The Indian government has long argued that WhatsApp’s encrypted messaging service is detrimental to national security and has demanded WhatsApp “digitally fingerprint” all messages in India. Facebook has pushed back thus far, arguing it would undermine user privacy and turn WhatsApp into a different product. Yet with over 400 million WhatsApp users in India, it is unclear how long Facebook will hold out.
Across the world, pressure on Facebook is growing. On October 4 2019, UK Home Secretary Priti Patel and US Attorney General William Barr signed an open letter to Facebook asking for the company to re-think its stance on encrypting user communications. The letter was released alongside the signing of new agreement, called the Cloud Act, meant to remove obstacles to cross-border surveillance between the US and UK.
Meanwhile, the Indian Supreme Court is hearing a petition asking that all Indian social media accounts be linked to a national ID. This emerged from the question of WhatsApp traceability, and Facebook has made itself a party to this petition, and is arguing against such a requirement. This latest defamation case feeds into the Indian government’s narrative that social media must be regulated for the public good.
Yet in this case, this so-called public good is likely to privilege a powerful, wealthy male artist against a small band of women who say he preyed on them.
“I would hope Facebook would push back strongly against efforts to identify people in these cases where there isn’t a valid public interest in disclosure,” Hall from CDT said. “I suspect in this case the person that owns and operates the accounts is merely serving as a conduit, so I doubt identifying the owner of the account will identify the person making the statements.
“This feels like an effort to intimidate the owner of the account into silence.”