Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the security implications of social media? Also suggest any other remedies to address the problem.

The challenge

Platforms amplify communal incitement, fake mobilisation, deepfakes, radicalisation and financial fraud. Hashtags can organise a lynching or a stampede of panic. Foreign influence operations ride the same rails. End-to-end encryption on WhatsApp-like services means even the company cannot read the payload; law enforcement then wants traceability of the first originator, which cryptographers say is hard to do without weakening the lock for all. Closed groups are where terror and child-abuse material also travel. VPNs and offshore hosting frustrate a simple ISP block. The challenge is therefore content, cash and command, sitting on tools that also protect journalists, dissenters and ordinary privacy. Security with rights is not a slogan here; it is the design constraint.

• Peg: Open platforms (feeds) are an amplification problem; encrypted apps are an access-to-content problem.
• Peg: Deepfakes and UPI-linked phishing are the newer pair beside old communal forwards.

Measures already adopted

Statute: the IT Act, 2000 (including sections on intermediaries and cyber offences) and the Bharatiya Nyaya Sanhita provisions on incitement, false information and terrorism-related speech, used with older IPC practice. IT Rules, 2021 (and later amendments) impose grievance officers, traceability language for significant messaging services, compliance with takedown orders, and a proposed government appeals body that remains legally contested. Section 69/69A of the IT Act allow interception, monitoring and blocking under specified grounds. CERT-In directions on incident reporting, I4C (Indian Cyber Crime Coordination Centre), State cyber police, and the National Security Council Secretariat / MHA handle the operational layer. RBI and I4C have run helplines (such as 1930) against cyber financial crime. Election Commission and MIB issue takedown and silence-period directions in polls. At platform level, companies use hash-matching, fact-check partners and India grievance offices. At international level, India argues in UN, G20 and FATF spaces for cooperation against terror use of ICT, while remaining wary of a single Western speech code. Courts have both upheld blocking in some cases and struck or stayed overbroad official machinery when it looked like a censor board.

• Peg: IT Act plus 2021 Rules are the main domestic lever; CERT-In and I4C are the operational lever.
• Peg: Traceability versus encryption is the unresolved legal-technical fight inside those Rules.

Further remedies

Do not mandate a global decryption backdoor; it would be used by criminals against Indian firms and citizens as well. Do build targeted lawful access with a court or senior independent warrant, on metadata and, where a device is seized, on the endpoint. Fast-track cyber courts and trained prosecutors matter more than a new offence every year. Platform design: default forward limits, labelling of political ads, provenance watermarks for public-figure deepfakes, and real-time crisis protocols with SDMAs during riots. Media and school literacy so a forward is not treated as evidence. Follow the money: mule accounts and crypto off-ramps. Mutual legal assistance that actually returns a log from an Irish or Californian server in days, not years. Community fact networks in regional languages. Protect whistle-blowers and journalists so the same toolkit is not only a political takedown machine. The remedy set is governance of speed, not a fantasy of a fully transparent chat.

• Peg: Literacy plus warrant-based access plus faster MLATs is a rights-compatible package.
• Peg: A riot SOP that includes the platform liaison cell should be as normal as a police control room.