Why WhatsApp Pay Has Not Been Able To Roll Out In India?

There are conspiracy theories galore as to why WhatsApp, the messaging application of the global social media monopoly, Facebook Inc., has been unable to offer a mobile internet-based payments service to its 400 million-plus users in India.

Is it on account of lawsuits pending before the Supreme Court? Are two organisations, the country’s central bank and apex monetary authority, the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI), the umbrella body vetting online retail payments in the country, standing in the way of WhatsApp Pay getting a final green signal after it received their approval to start trial runs in February 2018? Are those in power in New Delhi exerting political pressure on Facebook, among the biggest corporate conglomerates on the planet?

The global digital monopoly is currently facing a lot of flak over allegations that its top officials in India have been complicit in promoting hate speech by functionaries and supporters of the ruling Right-wing, Hindu nationalist Bharatiya Janata Party (BJP).

Is the Facebook-owned WhatsApp being “persuaded” to change the contours of its association with partners in India, following its $5.7 billion (Rs 43,574 crore) investment in a 9.99% stake in Jio Platforms, part of Reliance Industries Limited (RIL), the country’s biggest private corporate entity headed by India’s, Asia’s––and one of the world’s––richest men, Mukesh Ambani? (Incidentally, this was the biggest deal struck by Facebook since its $22 billion buyout of WhatsApp in 2014.)

Whatever be the answers to these questions and the truth behind the intense speculation, one fact is simple to comprehend. WhatsApp, which had been operating in India even before it was acquired by Facebook in February 2014 and became the world’s most-used messaging application the following year, has not earned a single rupee so far in this country that has its biggest number of users after having spent undisclosed (but substantial) amounts of money in India.

“Facebook is not a philanthropic organisation and it is desperately keen to earn big bucks by monetising its popular service in the country where it has the largest number of users, well over 40 crore,” said a Mumbai-based information technology analyst on condition of anonymity, adding: “Having been shut out of China, it is eyeing India lasciviously and will do anything to get a toehold into our burgeoning digital payments market.”

This analyst, like quite a few of the dozen individuals we spoke to over the past few weeks to put together this article, said there were “too many unanswered questions” and “rumours” about top government officials putting pressure on WhatsApp to accede to demands for “trace-ability” of voice, still pictures and video messages, ostensibly to book criminals and those accused of committing heinous crimes, but also to enable “mass surveillance” operations. WhatsApp has consistently claimed that its “end-to-end encryption” technology does not allow it to enable government agencies to conduct such operations that may be considered “covert.”

WhatsApp’s Unified Payments Interface (UPI) feature has been in limbo since it was introduced in the country for “beta” trials for around a million users more than two and a half years ago. India is the first country in the world where WhatsApp has tested its digital payments service. However, a full-scale launch of WhatsApp Pay, possibly in partnership with one of India’s largest private banks, ICICI Bank, remains uncertain for the time being. Why? That indeed, is a billion-dollar question.

UPI is a system that powers multiple bank accounts into a single mobile application (of any participating bank), merging several banking features, seamless fund routing and merchant payments under one “hood.” Among the mobile payments applications that are currently using the UPI system in India are PhonePe, Google Pay and PayTM.

It’s not just in India that WhatsApp Pay is struggling to launch itself––its digital payments service was rolled out in Brazil on June 25, a week before the central bank of that country suspended trial runs after stating that there was a possibility of damage to the payments system, besides raising concerns about data privacy, efficacy and competition. Brazil currently has over 120 million users of WhatsApp and is led by the Right-wing President Jair Bolsonaro.

On February 11, 2019, Sourya Majumder and one of the writers of this article had published a report in NewsClick titled “A Mobile Payments Monopoly With A Beep?” that pointed out how a call for bids by the NPCI to set up proximity-based mobile payments facilities potentially facilitated the formation of a private monopoly that could not just be illegal but also disproportionately benefit a few, notably the corporate groups led by Anil Ambani, Nandan Nilekani, co-founder of Infosys, and a key associate of the ruling dispensation, Arvind Gupta. The proposal was placed on hold and remains in limbo.

Soon after the NPCI, an initiative of the RBI, announced on February 16, 2018, that WhatsApp Pay had been granted approval for beta testing of its UPI service in India, the Union Ministry of Electronics and Information Technology (MEITY) wrote two letters to the NPCI in March and May that year raising issues relating to the data storage policy of WhatsApp and whether user data would get shared with its parent company, Facebook, based in Menlo Park, California. MEITY also asked if the proposed payments service would use RBI’s two-factor authentication process, a security process in which users provide two different authentication or verification factors.

Petitions in Supreme Court Against WhatsApp

In July 2018, a Delhi-based non-government organisation (NGO), called the Centre for Accountability and Systemic Change (CASC), filed a petition in the Supreme Court alleging, among other things, that WhatsApp had failed to comply with the RBI’s data localisation rules. Data localisation is essentially a system that is supposed to prevent financial and personal data of an individual or a corporate entity stored in a payments instrument, such as a digital payments application or a debit card, from being shared and stored in computer servers located outside the country of origin of the payments service.

WhatsApp had assured the apex court in May 2019 that it would launch its full service only after following all RBI norms. In February 2019, a fresh application to the existing petition by CASC had been filed by CASC wherein it was requested that the “unlawful trials” for payment services be stopped by the Supreme Court.

A year later, on February 28, 2020, another writ petition was filed in the Supreme Court against the social media messaging app regarding its UPI-based payments service, this time, by another NGO named Good Governance Chambers (G2C) which, by its own admission, is “unregistered.”

The petition has alleged “blatant and wilful violation” by WhatsApp Pay of the “mandatory guidelines and regulatory norms forming the very fundamentals on which the entire Unified Payment Interface (UPI) system of India rests.” The petition further claims: “Such glaring violations pose a serious threat to the monetary policy and laboriously set payment systems of India, and which could also lead to (WhatsApp Pay) being a national threat to the security and privacy of crores of citizens of India.”

In the petition, G2C claimed that WhatsApp has “consistently defaulted” in complying with the directives issued by NPCI and RBI relating to securing financial data of users, data localisation norms, the two-factor authentication processes, and “to provide a system to log a complaint and de-registration of a UPI-linked account.” The respondents in the petition are RBI, NPCI, WhatsApp, ICICI Bank, MEITY’s Computer Emergency Response Team (CERT) and the Union government.

The petition alleges that WhatsApp has not launched a separate application for UPI-enabled transactions but embedded its “messaging app” with a UPI-enabled feature. This, it is claimed, has resulted in “huge risks to the financial data of the users as the primary messenger app of WhatsApp despite claiming to have a secure and safe technology interface and infrastructure, has been known to have failed to secure sensitive data of its users and has subsequently even failed to assume accountability and responsibility for the same.”

The petition mentions the controversy surrounding the spyware Pegasus, owned by the Israel-based NSO group, which was used to hack into the systems of 1,400 users in different parts of the world by exploiting a vulnerability in its video-calling feature. In October 2019, WhatsApp had sued NSO in a California Court for developing Pegasus. A Toronto, Canada-based research body, The Citizen Lab, had published a report in September 2019 which identified 45 countries where Pegasus may have been used to spy on citizens.

Besides Pegasus, the G2C petition also mentions the Cambridge Analytica scandal. In March 2018, it was reported that Cambridge Analytica, a voter profiling company, had illegally harvested private information of more than 50 million Facebook users to help its clients win the 2014 American mid-term elections. The stolen information was reportedly used in other countries as well, including India. A documentary film on the topic titled “Great Hack” is available on Netflix.

It was reported in February 2020 that WhatsApp group chats could be found using Google, as the search engine was allegedly indexing links to conversations. The petition contends that there is “a very high possibility of data leakage” as customer data may be available in such chat windows, “leading to online scams and huge potential losses to the users.”

Given WhatsApp’s massive user base in the country, the petition apprehends that “very sensitive user financial data can be easily misused which can result in huge political and financial repercussions.” It claims that if there is loss or theft of financial data of users, “not only will it give rise to extensive and widespread … cybercrime which may not be controllable, but also lead to reading and analysis of payment patterns, buying behaviour, preferred modes of payment, etc. that may give birth to other incidental issues of political, social and economic concern.”

The G2C petition claims that besides having the potential of compromising national security and the privacy of citizens, the “bundling of a messaging app with (a) payments interface which is vulnerable and has witnessed multiple instances of fraud, cheating and privacy invasion should not be permitted.”

Accusing WhatsApp of storing customer data in the UPI-enabled apps by contravening RBI and NPCI rules, the petition alleges: “WhatsApp also permits the sharing of QR (quick response) Code of the users through the messaging service platform which can again form the basis of multiple frauds and scams leading users to lose their hard-earned money in huge numbers. This further causes customer data to form a part of screenshots on the messaging app which is also not permissible.”

The petition claims WhatsApp stores payments data outside India, that it “intends” sharing such data with its parent company, Facebook, that it is not concerned about user privacy, is not following NPCI’s “procedural guidelines” and RBI’s July 2013 circular that stated that the two-factor authentication process in the UPI should include “a device fingerprint (or unique way to identify the device) and the UPI Pin/Biometrics of the user.” It further alleges that WhatsApp Pay does not provide the option “to log a complaint with regard to transactions,” which is mandatory for a UPI-enabled app, as per the NPCI guidelines.

The petitioner G2C urged the Supreme Court to “completely ban the operations of WhatsApp in the UPI ecosystem” given its “current model of operations.”

On May 13, a bench of the Supreme Court, headed by Chief Justice of India S A Bobde, and comprising Justices Indu Malhotra and Hrishikesh Roy, said that its hearings on the public interest litigation (PIL) could not prevent RBI from allowing WhatsApp Pay to roll out its app in its entirety. The petitions by CASC and G2C were also clubbed together by the court.

WhatsApp Denies Allegations, Questions Credibility of Petitioners

In an affidavit filed in the Supreme Court on June 2, 2020 by Shardull Suresh Shroff on behalf of Brian Hennessy, the director and associate general counsel of WhatsApp, besides denying the allegations made in the petitions, questioned the credentials of G2C. WhatsApp questioned why G2C was formed just two months before the filing of the PIL petition.

It questioned how Law Juno, the law firm representing G2C, was the same firm which represented lawyer Harshita Chawla who had complained against WhatsApp in the Competition Commission of India (CCI) on March 19. (The CCI is a regulatory body under the Union government which is meant to promote and sustain competition, eliminate practices that have an adverse effect on competition, protects the interests of consumers and ensure freedom of trade in the markets of India.)

Chawla’s major allegation was that WhatsApp was misusing its already prevalent market dominance to launch WhatsApp Pay. The CCI dismissed Chawla’s complaint against WhatsApp on August 18.

WhatsApp had also told the Supreme Court that G2C may have been involved with the complaint filed by Chawla but had not disclosed this information in its petition to the apex court. While referring to similar complaints made in the past that had been examined by the commission, the CCI refused to dismiss the complaint against her because she may be associated with the petition filed by G2C in the Supreme Court. It said: “The Commission notes that though on first blush this argument looks attractive, it may not be factually correct and is legally untenable…”

The domain names for Law Juno and G2C were also registered on the same date, WhatsApp alleges.

“So what?” retorts Deepak Prakash, the Delhi-based advocate-on-record for the NGO, in a telephonic conversation with one of the writers.

It is not just those associated with WhatsApp who have raised questions about G2C. An analyst who is familiar with the legal proceedings told one of the writers of this article on condition of anonymity: “It appears that the NGO was set up for the specific purpose of filing the PIL against WhatsApp. It has set up social media accounts only recently and does not appear to have a proper website or an e-mail address. Then, by its own admission, G2C is an unregistered body. It is not surprising then that there is speculation that the NGO was set up by rivals of Facebook and WhatsApp.”

The G2C petition has been filed by a 30-year-old “computer engineer” named Satwik Chinta. We made several unsuccessful attempts to reach him on the mobile number given in the petition.

One of the writers of this article paid a visit to the “office address” of G2C given in its petition located at Preet Vihar in East Delhi. The office is said to be located on the ground floor of a building that has a co-working office area called “Co-Offiz” which provides spaces on rent. The security guard present and a woman tasked with coordinating the renting out of office space said they were not aware of any organisation called Good Governance Chambers that had rented space.

Interestingly, in the complaint filed by Chawla before the CCI, the same address of “Co-Offiz” in Preet Vihar has been provided.

A “Mysterious” Petitioner

We asked advocate Prakash to answer a few questions explaining the “mystery” behind the unregistered NGO called G2C. He claimed the organisation had “socially responsible” individuals as its members, including lawyers, computer engineers and scientists and a retired colonel of the Indian Army. Prakash did not want to discuss why the organisation had not been registered. “What matters is that the petition has been accepted for hearing by the Supreme Court of India,” he added.

The advocate claimed that the reason why there was no one available at the office was on account of the lockdown in the wake of the COVID-19 pandemic. Why was petitioner Chinta not responding on his mobile phone? “He is in his village in Odisha and there is no connectivity there,” he claimed.

The WhatsApp affidavit in the Supreme Court states that one Sahil Baghla registered the websites of both the law firm (Law Junmo) and the so-called “think tank,” G2C. The affidavit also points out that Baghla had been arrested earlier in connection with a $300 million “Bitcoin Ponzi scheme.” WhatsApp further pointed out that in July 2019, Baghla was charged in the Bombay High Court for alleged offences of cheating and criminal breach of trust.

Prakash said that Baghla was out on bail, that he was indeed a member of G2C, that he held a degree from an Indian Institute of Technology and that he had done nothing wrong by registering domain names of websites. The advocate said he was reluctant to discuss details as the case was pending in court. “Read our petition,” he said over and over again.

In an affidavit submitted by RBI to the Supreme Court in June, the country’s central bank stated that NPCI had informed it that WhatsApp could now open its UPI platform for the Indian public. The RBI affidavit said: “We would like to confirm that WhatsApp has satisfied the data localisation requirements based on (MEITY’s CERT’s) auditor’s reports and we hereby are giving ICICI Bank (the payment service provider bank for WhatsApp) the approval to go live.”

The advocate for G2C said he was not satisfied with the RBI’s response. “Who are the technical experts the RBI has consulted? We will urge the Supreme Court to appoint an independent team of experts who are technically qualified to look into the issues we have raised,” he said.

Prakash said Facebook and WhatsApp had many cases against them in different countries across the world and had been fined on a number of occasions.

The advocate had earlier been quoted by the Medianama website claiming that WhatsApp was not worried about “...data protection and sharing the financial data of millions of people”. “They (WhatsApp) have to answer on merit now. They have to say that we are not violating (rules).”

Prakash added that it was not clear who in WhatsApp would be responsible for dealing with customer complaints.

We contacted another advocate-on-record for the petitioner G2C, Gaurav Sharma. We had some difficulty reaching him as there was another advocate by the same name. When we got through to him over the phone, he quipped: “I know seven persons who share my name!”

Sharma was reluctant to speak with us on the ground that the “case has to be listed for final hearings before the Supreme Court.” “I cannot say anything at this point of time,” he said.

We also spoke to two senior persons close to WhatsApp who are aware of the legal proceedings that are going on. They spoke on condition that they not be named since they were not authorised to speak to journalists. One said: “WhatsApp cannot afford to be on the wrong side of the law. The NPCI specifies rules pertaining to third-party applications that can reach out to multiple banks. These would certainly be adhered to.”

Is there pressure on WhatsApp to “ditch” ICICI Bank since Jio Payments Bank in the Reliance group has a controversial joint venture with the country’s largest bank in the public sector, the State Bank of India?

As already mentioned, on April 22, Facebook announced that it had acquired a 9.99% stake in Jio Platforms by investing $ 5.7 billion, making the social media monopoly its largest minority shareholder.

Facebook’s chief executive officer Mark Zuckerberg told analysts recently that the company’s partnership with Jio Platforms would help “millions of small businesses in India” to do commerce on WhatsApp.

He said: “A big part of the partnership that we have with Jio will be to wire up and get thousands of small businesses across India on-boarded onto WhatsApp, to do commerce there… It’s very connected to what I was just talking about around messaging commerce. A lot of people use WhatsApp, especially in India. There’s a huge opportunity to enable small businesses and individuals in India to buy and sell things through WhatsApp. We want to enable that. That starts with enabling payments.”

Ajit Mohan, vice president and managing director of Facebook India, told The Mint in April: “As you know WhatsApp Payments is in the middle of a beta trial for a million users and we are hoping to get regulatory approval but this collaboration (with Jio Platforms) is only meant to really fuel the small business side of the economy.”

Is WhatsApp’s existing partnership with ICICI Bank coming in the way of a closer engagement with Reliance Jio? Will a new arrangement now have to be worked out?

Said a source in WhatsApp: “I don’t think WhatsApp’s partnership with ICICI Bank will prove to be a deal breaker.”

Then, what’s coming in the way of the RBI giving its final nod to WhatsApp Pay to roll out its payments service to all its users”

“Good question,” said one of the sources in WhatsApp we spoke to.

“I wish I knew,” said the other person who knows about the legal battle.

Over now to the Supreme Court of India.

The writers are independent journalists.