The Indian government’s latest tussle with WhatsApp has raised concerns about the censorship of app features globally.
On June 29, WhatsApp began rolling out usernames globally, allowing users to chat without sharing their phone numbers. The Indian government has objected to the feature, arguing that pseudonymous accounts could make it easier for bad actors to impersonate others and carry out scams and financial fraud.
India has also sought explanations from Telegram and Signal, which already allow users to create accounts using usernames instead of phone numbers. The government asked all three platforms to respond by July 9. WhatsApp has reportedly submitted a written response, which the government is reviewing.
If WhatsApp gives in to India’s pressure, and modifies or scraps the feature, it could lead to far-reaching consequences that may discourage innovation and encourage copycat demands globally, Namrata Maheshwari, senior policy counsel and encryption policy lead at international nonprofit Access Now, told Rest of World.
“It’s a slippery slope because the moment you concede something in one jurisdiction and make it known as something that is possible to do technically, other countries will follow suit,” Maheshwari said. “Most governments around the world are vying to co-opt the kind of power and access that technology companies have over people’s lives and personal data.”
India is WhatsApp’s largest market with over 850 million users. The app underpins everything from personal messaging to banking, ticketing, and shopping in the country. Even without the username feature, the app has faced several allegations of propagating financial fraud, data theft, and misinformation.
Username versus phone number
Experts say the Indian government has not backed up its argument with evidence.
“Yes, WhatsApp can be misused for cybercrimes. So can email. So can your phone. So can everything. That’s pretty much the definition of infrastructure: It can be used for good and for bad,” security technologist Bruce Schneier told Rest of World.
Allowing usernames could help users separate online identities from real-world identities, protecting those facing harassment or political retaliation, Erica Portnoy, senior staff technologist at nonprofit Electronic Frontier Foundation, told Rest of World.
Meanwhile, authorities can still trace user information through legal channels, if needed.
“The ability to use a username is not yet live and will roll out slowly later this year,” a WhatsApp spokesperson told Rest of World. “To protect against impersonation, we’ve held the highest-profile names — think public figures, government entities, celebrities, verified Meta accounts — so they can only ever be claimed by their legitimate owners, and lookalike derivatives of known names are held as well. Users still require a phone number to use WhatsApp. and we’ve built multiple layers of defense against scams into usernames.”
People will need to know the exact username to contact anyone for the first time, and users can add an optional username key, the company said. WhatsApp will limit how many new people an account can contact, block repeated attempts to guess someone’s username key, and have systems to detect and remove activity showing common impersonation and abuse patterns.
Telegram launched in 2013 with optional public usernames and without end-to-end encryption. Signal, on the other hand, is among the world’s most secure messaging apps that collects minimal user data.
“If India’s IT ministry wants to make the argument that Telegram and Signal’s username features have led to a notable increase in cybercrime, they are welcome to make their case, but they make no attempt to do so here,” Eva Galperin, director of cybersecurity at Electronic Frontier Foundation, told Rest of World.
The threat
Several governments have blocked social media and messaging apps over content and security concerns in the past. But this is a rare case where a government is opposing a design feature.
“India is doing something different,” Apar Gupta, founder-director at digital rights advocacy group Internet Freedom Foundation, told Rest of World. “It is objecting to a design before any harm has occurred, and asking companies to justify a feature ‘to the satisfaction of the government.’ No law allows that.”
Government and Big Tech have historically addressed product design questions in closed rooms, and this public notice is a “less harsh form of regulation than blocking or investigating the service,” Rihan Shareef, research analyst at nonprofit public research institution Aapti Institute, told Rest of World. “However, the question of government overreach and control remains.”
The Indian government’s move may lead companies to ship different versions of secure communication tools in different jurisdictions, which “risks weakening privacy protections incrementally, one market at a time, and that does not bode well for citizens, journalists, and anyone who wants privacy without being treated as suspects,” Mishi Choudhary, technology lawyer and founder of nonprofit SFLC.in, told Rest of World.
Usernames aren’t a minor feature to be tweaked for individual markets, Mallory Knodel, executive director and founder of San Francisco-based nonprofit Social Web Foundation, told Rest of World. It’s “a rather large overhaul from an architectural point of view,” which affects contact discovery, security standards, and more.
WhatsApp has addressed the Indian government’s concerns in the past, adding forwarding limits and labels, and complying with law enforcement requests. But it has also been resisting the requirement for traceability of the “first originator” of certain messages — an ask that’s incompatible with end-to-end encryption.