A two-judge bench of the Karnataka High Court is now hearing a challenge filed by Proton AG, the Swiss company that runs the encrypted email service, Proton Mail. On April 29, a single judge of the high court had directed the Union government to block the service in India, setting off a wave of criticism from digital rights advocates.
Many of them told Scroll that the court’s ban set a dangerous precedent that threatens the privacy of whistle-blowers, activists, journalists, and others who rely on encryption for more secure communications. They said the court had erred in blaming encryption for Proton’s alleged non-cooperation with the Karnataka police in its investigation into online harassment by anonymous culprits through its email service.
What did the High Court order say?
The case began when a Bengaluru-based organisation approached the High Court after some of its female employees were subjected to prolonged online harassment. The company received a torrent of emails from two Proton Mail accounts containing obscene and abusive content, including morphed images of the employees.
The company filed a police complaint and reached out to Proton Mail’s abuse team. While Proton disabled the offending accounts, it could not provide the company personally identifiable details of the sender of the mail. This is because, it informed the company, under Swiss law, it could only disclose user data upon receiving a formal legal request from Swiss authorities through established international cooperation channels.
The police investigation hit a similar wall. The police told the court that they could not identify the culprit through the mutual legal assistance arrangements between India and Switzerland. However, the judgment didn’t clarify what specific steps were taken or where those efforts stalled.
Nevertheless, Justice M Nagaprasanna took a stern view of the matter in his judgment. Describing the situation as a “menace”, he noted that Proton Mail had also been used to send bomb threats to schools and even to the Chief Minister of Karnataka.
“The State machinery [is] hamstrung by the absence of enforceable cooperation from Proton AG,” Nagaprasanna observed. “This Court fails to understand the complacency of the Union of India in not taking action towards blocking the Proton Mail…”
Concluding that the court could not remain a “mute spectator”, the judge directed the Union government to initiate proceedings to block Proton Mail in India under the Information Technology Act.
‘Troubling precedent’
As of July 25, Proton Mail was still accessible in India.
While the court’s intent to protect the victims of harassment is clear, technology lawyers and digital rights advocates raised concerns about the order’s sweeping nature and its wider implications. They argue that blocking an entire service used by many for the criminal acts of a few is a disproportionate response that could undermine digital security for everyone.
The order “sets a troubling precedent,” said Raman Jit Singh Chima, Asia Pacific Policy Director at Access Now, a digital civil rights organisation. “It signals that entire encrypted services can be taken down based on allegations linked to a handful of users.”
A ban could lead to a domino effect, warned Apar Gupta, lawyer and founder director of the Internet Freedom Foundation. “Other encrypted platforms could face pressure to weaken their security or risk being blocked,” he explained. “This approach may inadvertently chill free expression, as journalists, activists and at-risk communities who rely on encrypted communications for safety might feel less secure.”
This view was echoed by technology lawyer and online civil liberties activist Mishi Choudhary. “In today’s day of heightened cyber security issues and surveillance, privacy-protecting technologies are more crucial than ever,” she said.
Blocking Proton Mail would not eliminate online abuse either, said technologist and interdisciplinary researcher Rohini Lakshané. “Malicious actors can simply migrate to other encrypted email providers or deploy additional anonymisation techniques,” she said.
The fear is that the High Court’s order could give cover to authorities to take a heavy-handed approach towards any platform that offers privacy.
“This move will embolden the bureaucracy and the political powers to act first and think later,” cautioned Tanveer Hasan, executive director of the Centre for Internet and Society, an internet and digital technologies research organisation.
As Choudhary noted, “India cannot be a destination that issues blocking orders at the drop of a hat if investigative authorities aren’t able to access some data.”
Gupta warned that the order would create legal uncertainty for overseas service providers. “Those in jurisdictions with strict privacy laws could be caught between home-country obligations and Indian court demands, deterring them from offering services in India,” he said.
Encryption versus user identification
A key point of contention is the court’s conflation of the protection of a message’s content with the ability to identify a user. The court identified encryption as a factor for the police’s failed investigation – without explaining how.
Encrypted services like Proton Mail are prevented from seeing the content of messages sent on their platforms, but may still access user metadata, such as internet protocol address – a unique alphanumerical identifier assigned to each computer connected to the internet – from which an account was created or accessed.
Nikhil Narendran, a partner at the law firm Trilegal, argued that the ban was based on a misunderstanding of the technology “Encryption only protects the content of a message but does not prevent a receiver or sender from disclosing it wilfully,” he explained. “It also doesn’t prevent a company from disclosing user information once the content is disclosed.”
This metadata can be a crucial tool for law enforcement to trace the origin of a criminal act.
In 2021, Proton Mail handed over the internet protocol address of French Proton Mail users to the French police upon an order by the Swiss government.
“So, the idea that Proton Mail is immune to legal process is simply not true,” Chima said.
Sharveya Parasnis, a journalist at the technology policy portal Medianama, questioned the court’s invocation of encryption. “I don’t know if the case is about encryption as much as it is about the obligation of foreign companies to comply with Indian law enforcement requests for user data,” he said.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 mandate that online platforms “enable the identification” of anyone communicating through the platform upon a government or court order.
The right way forward?
Experts pointed out that a blanket ban failed the three-part test for restricting fundamental rights laid down by the Supreme Court in its landmark privacy judgment in 2018. Any restriction must be lawful, necessary and, crucially, proportionate.
“Here, less intrusive options clearly existed,” Chima said.
He and other experts Scroll spoke with argued that instead of resorting to bans, Indian authorities should strengthen and use existing legal channels. India and Switzerland are both signatories to a Mutual Legal Assistance Treaty, a formal mechanism for requesting and obtaining evidence for criminal investigations.
The treaty should be reformed “so investigators can lawfully obtain data in a timely manner,” suggested Gupta. “Regulators can also establish clear, transparent protocols for engaging with encrypted services based abroad, and even update outdated agreements to address modern cybercrime.”
Rahul Narayan, a partner at the law firm Chandhiok & Mahajan who has expertise in privacy and data protection, batted for more legislative clarity in such situations. “Precise parameters for when a service may be blocked should be laid down in a legislation, rather than decided on an ad-hoc basis by courts,” he said.
