Social Media and Internal Security: Fake News, Encryption and the IT Rules 2021

Social Media as a Security Challenge

Misuse by Non-State Actors for Recruitment and Mobilisation

Social networking sites are online platforms on which users build a profile, connect with others and share text, images and video with them. Their reach, low cost and speed, and the anonymity they allow, make them useful to groups that want to recruit members, spread an ideology or mobilise crowds without a visible organisation.

Online radicalisation is the clearest case. Radical groups use encrypted messaging applications such as Signal, Telegram, Viber and WhatsApp, as well as the dark web, to connect with like-minded people, and this has proved a major challenge for security agencies. Recruiters target young people who are gullible, depressed or alienated. As of December 2024, the National Investigation Agency (NIA) was investigating 67 cases of online radicalisation, apart from those with State Police; 325 accused had been arrested, 336 charge-sheeted and 63 convicted.

Militancy in Jammu and Kashmir showed how one face on social media can draw recruits. Burhan Wani, a commander of the terrorist organisation Hizbul Mujahideen, became a popular figure mainly through a strong social media presence; a post showing him with armed militants went viral, and his videos urging young people to take up arms continued until he was killed on 8 July 2016. His use of social media helped turn the insurgency into a youth-oriented movement.

The State's counter-measures begin with watching the same spaces. Cyber patrolling identifies accounts and content that spread radical ideology, and websites or accounts that carry communal or anti-India propaganda affecting the sovereignty and integrity of India are sent to the Ministry of Electronics and Information Technology (MeitY) for blocking. The Indian Cyber Crime Coordination Centre (I4C) of the Ministry of Home Affairs is also designated to issue takedown notices to platforms under Section 79(3)⁠(b) of the IT Act.

Fake News, Deepfakes and Public Order

Rumours, Riots and Coordinated Disinformation

Fake news, false information presented as genuine news, threatens internal security when a false claim moves people to violence, panic or hatred faster than the State can correct it. Three Indian episodes show the pattern.

• The exodus of 2012: After the violence in Assam in 2012, threatening messages sent by bulk SMS and MMS warned people from the Northeast to leave Bangalore and other cities. In August 2012, about 30,000 people from the Northeast fled Bangalore, and the Union Home Ministry banned bulk SMS and MMS for 15 days to stop the rumours.
• Muzaffarnagar, 2013: Tension before the riots rose when a video that claimed to show the murder of two cousins circulated; it was in fact footage of unrelated violence in Pakistan from several years earlier.
• Lynchings over WhatsApp rumours: From May 2017, when seven men were killed in Jharkhand, rumours of child abduction and organ harvesting, spread on WhatsApp, led mobs to attack and kill people. The messages carried locally specific details and real videos attached to false claims.

The National Crime Records Bureau (NCRB) compiles "fake news on social media" as a separate crime head. Police registered 578 such cases in 2020, 179 in 2021, 230 in 2022, 209 in 2023 and 483 in 2024. In 2024 they also registered two cases of publishing false or misleading information jeopardising the sovereignty, unity, integrity or security of India, the new offence in Section 197(1)⁠(d) of the Bharatiya Nyaya Sanhita, 2023 (BNS).

Some campaigns are organised from across the border. In December 2021, the Ministry of Information and Broadcasting blocked 20 YouTube channels and two websites of a coordinated disinformation network operating from Pakistan, including the Naya Pakistan Group. The channels had over 35 lakh subscribers and over 55 crore views, and posted divisive content on Kashmir, the Indian Army and minority communities.

Spread of Disinformation: Bots, Forwards and Coordinated Campaigns

Disinformation is false or misleading information spread deliberately to deceive people or to secure economic or political gain, and it may cause public harm. Misinformation is false information that comes from honest error. The difference lies in intent, and the law follows it: Section 353 of the BNS punishes false statements, rumours or reports that cause fear or alarm or incite one community against another, but it excuses a person who believed on reasonable grounds that the statement was true and shared it in good faith.

False content travels through three channels.

• Bots: A social bot is a fully or partly automated account that likes, posts and chats like a real user. Many bots acting together can make a fringe claim look popular.
• Forwards: In messaging groups, a message passes from person to person and loses its origin on the way. Encryption keeps the content hidden from everyone except the members of each chat.
• Coordinated campaigns: In astroturfing, the sponsors of a message hide behind accounts made to look like ordinary citizens, so that a planned campaign appears to be a grassroots movement.

Online advertising adds a money motive. The monetisation of user-generated content gives creators a financial reason to spread fake news, and advertising technology has been used to amplify disinformation.

Deepfakes and Synthetically Generated Content

A deepfake is an image, video or audio clip edited or generated with artificial intelligence, often to make a real person appear to say or do something they never did. The word joins "deep learning" and "fake". Deepfakes can impersonate leaders during a crisis, create false evidence of an event, defraud people through fake endorsements and harass people through morphed intimate images.

The IT Rules call such material synthetically generated information (SGI). It means audio, visual or audio-visual information artificially or algorithmically created or altered with a computer so that it appears real and depicts a person or event in a way likely to be taken as real. Routine editing, colour correction, translation, accessibility tools and the good-faith making of documents and teaching material are excluded. Text alone is not SGI, though a platform's general duties over unlawful text still apply.

The amendment of 10 February 2026, in force from 20 February 2026, sets three layers of duty.

1. Prevention: A platform that offers tools to create SGI must use technical measures, including automated tools, so that users cannot make unlawful SGI, such as child sexual abuse material, non-consensual intimate imagery, false documents, material on making explosives or arms, or a false depiction of a real person or event.
2. Labelling: All other SGI must carry a prominent visible label, or an audio disclosure at the start, and permanent metadata with a unique identifier where technically feasible. Users must not be able to remove the label or the metadata.
3. Declaration: A significant social media intermediary, a platform with 50 lakh or more registered users in India, must ask users to declare whether content is synthetic, check the declaration with technical tools and label content confirmed as synthetic before it is published.

Detection is the harder half of the problem. Under the IndiaAI Mission, projects such as Saakshya, a multi-agent deepfake detection framework built by IIT Jodhpur and IIT Madras, and a real-time voice deepfake detection system at IIT Kharagpur are being developed. The Indian Computer Emergency Response Team (CERT-In) published an advisory on deepfake threats in November 2024.

Encrypted Messaging and Traceability

End-to-End Encryption and Lawful Access

End-to-end encryption is a method of secure communication in which only the sender and the intended recipients can read a message; not even the service provider holds the keys. It protects the privacy of every user's communications. The same protection lets radical groups talk in channels that investigators cannot read, which is why security agencies treat encrypted messaging, alongside social media, as a security challenge.

The IT Act already provides a lawful route to read communications. Under Section 69 of the IT Act, the Central or a State Government may order an agency to intercept, monitor or decrypt information in the interest of the sovereignty and integrity of India, defence, the security of the State, friendly relations with foreign States, public order, preventing incitement to a cognizable offence or the investigation of any offence. Reasons must be recorded in writing, and a subscriber or intermediary who fails to assist may be punished with imprisonment of up to seven years and a fine.

Every such power must now meet the privacy test. In Justice K. S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017, a nine-judge bench unanimously held that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms in Part III. An intrusion must satisfy three tests. The first is legality, meaning a law that permits it; the second is necessity, meaning a legitimate aim of the State; the third is proportionality, meaning a rational connection between the aim and the means.

Traceability Rule for Significant Social Media Intermediaries

Rule 4(2) of the IT Rules 2021 requires a significant social media intermediary that provides mainly messaging services to enable the identification of the first originator of a piece of information when ordered to do so.

The rule carries its own limits.

• Who orders: Only a court of competent jurisdiction, or the Competent Authority under Section 69 following the interception rules of 2009, and the order must come with a copy of the information.
• For what: Only to prevent, detect, investigate, prosecute or punish an offence relating to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order, incitement to such an offence, or rape, sexually explicit material or child sexual abuse material, punishable with imprisonment of not less than five years.
• Last resort: No order may be passed where less intrusive means can identify the originator.
• Limited disclosure: The platform need not reveal the contents of any message or information about its other users.
• Origin abroad: If the first originator is outside India, the first originator within India is treated as the first originator.

WhatsApp challenged the rule in the Delhi High Court on 25 May 2021, the last day for compliance, arguing that the rule would end the privacy of its users, a right recognised in Puttaswamy.

Legal Framework: IT Act and the IT Rules 2021

IT Rules 2021: Parts, Ministries and Purpose

The IT Rules 2021, made by the Central Government under Section 87 of the IT Act, lay down the due diligence every intermediary must observe and a code of ethics for digital news publishers and streaming platforms. Notified on 25 February 2021, they replaced the Information Technology (Intermediaries Guidelines) Rules, 2011. MeitY administers the rules for intermediaries in Part II, and the Ministry of Information and Broadcasting administers the code of ethics, with its three-level grievance mechanism, for publishers in Part III. Every duty in the Act and the Rules is limited by the freedom of speech in Article 19(1)⁠(a) and by the right to privacy, and several of them have been challenged in court.

Section 69A Blocking and the Shreya Singhal Judgment

Section 69A of the IT Act empowers the Central Government, or an officer it specially authorises, to direct any government agency or intermediary to block public access to any information in a computer resource. The grounds are the interest of the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States or public order, or preventing incitement to a cognizable offence relating to these. Reasons must be recorded in writing, the procedure is set by the blocking rules of 2009, and an intermediary that fails to comply may be punished with imprisonment of up to seven years and a fine.

The provision is used heavily in security crises. MeitY directed the blocking of 9,845 URLs between January and October 2024, including radical content. During Operation Sindoor in May 2025, when fake news campaigns were run largely from outside India, the Government directed the blocking of over 1,400 URLs that carried false, misleading and communally sensitive content, mostly from Pakistan-based accounts, and inciteful content against the Indian Armed Forces. Part III of the IT Rules adds an emergency route, under which the Secretary of the Ministry of Information and Broadcasting may block content as an interim measure without a hearing; a committee must then consider the matter within 48 hours.

The Supreme Court tested these powers in Shreya Singhal v. Union of India, decided on 24 March 2015.

• Section 66A struck down: The section, which punished "grossly offensive" or "menacing" messages and false messages sent for annoyance, was held vague and over-broad, outside the reasonable restrictions of Article 19(2), and therefore void under Article 19(1)⁠(a). The Jan Vishwas (Amendment of Provisions) Act, 2023, removed it from the statute book.
• Section 69A upheld: The Court found it a narrowly drawn provision with adequate safeguards, including reasons recorded in writing.
• Section 79 read down: "Actual knowledge" means a court order, or a notice from the appropriate government or its agency as Section 79(3)⁠(b) itself provides, and not every private complaint.

Safe Harbour Under Section 79 and Due Diligence

Safe harbour is the protection Section 79 gives an intermediary from liability for third-party information it carries. The protection holds only if the platform merely provides access or does not start the transmission, choose the receiver or alter the content, and if it observes due diligence and the Government's guidelines. It is lost if the platform conspires in an unlawful act or fails to remove unlawful material expeditiously after receiving actual knowledge or a notice from the appropriate government or its agency.

The IT Rules 2021 spell out that due diligence. Rule 3(1)⁠(b) requires platforms to make reasonable efforts so that users do not host or share information that, among other things, is obscene or invasive of privacy, promotes enmity between religious or caste groups with intent to incite violence, knowingly communicates misinformation or patently false information, impersonates another person, or threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States or public order.

Takedown on notice now follows a strict procedure, as amended in 2025 and 2026.

1. The notice: Actual knowledge arises only from a court order or a reasoned written intimation by an officer not below the rank of Joint Secretary, or a Director where no Joint Secretary is appointed, of the Central or State Government; for the police, an officer not below the rank of Deputy Inspector General of Police (DIG).
2. Its contents: The intimation must state the legal basis, the unlawful act and the exact URL or location of the content.
3. The deadline: The platform must remove or disable the content within three hours.
4. Review: An officer not below the rank of Secretary reviews all such intimations every month to check that they are necessary and proportionate.

Platforms must also run their own grievance system. A Grievance Officer acknowledges a complaint within 24 hours and resolves it within seven days; a request to remove prohibited content is resolved within 36 hours, and a complaint about intimate images, nudity or impersonation, including morphed images, is acted on within two hours. Removed content and its records are preserved for 180 days for investigation, and information sought by a lawfully authorised agency is provided within 72 hours of a written order. A significant social media intermediary must also appoint a Chief Compliance Officer, a nodal contact person for round-the-clock coordination with law enforcement and a Resident Grievance Officer, all resident in India, and publish a compliance report every month.

Amendments to the IT Rules: Grievance Appellate Committees and Synthetic Content

The IT Rules 2021 have been amended four times, and each amendment answered a specific weakness.

The 2022 amendment created Grievance Appellate Committees (GACs) under Rule 3A, so that users no longer had to go to court against a platform's decision. Each committee has a chairperson and two whole-time members. A user may appeal within 30 days of the Grievance Officer's decision, and the committee must endeavour to resolve the appeal within 30 days, entirely online at gac.gov.in. The Centre set up three GACs on 28 January 2023, and they began hearing appeals from 1 March 2023. Between then and 30 June 2024, 1,065 appeals were filed and 937 disposed of. The same amendment required platforms to respect the rights in Articles 14, 19 and 21.

The 2023 amendment brought in online gaming intermediaries and added a clause on a fact-check unit of the Central Government; content about the Centre's business that the unit identified as fake or misleading would fall among the categories platforms had to act against. The Bombay High Court later struck this clause down. The 2025 amendment tightened the takedown procedure of Rule 3(1)⁠(d) with senior officers, reasons and monthly review. The 2026 amendment brought in the duties on synthetic content and cut the deadlines.

Measures Against Social Media Misuse at Various Levels

Fact-Check Units, Sahyog Portal and Platform Takedowns

The Press Information Bureau (PIB) set up a Fact Check Unit in November 2019 to check news about the Central Government. It verifies news from authorised sources and publishes the correct information on its social media handles to reach a wide public, including people in border districts. During Operation Sindoor, it debunked Pakistani propaganda against the Indian Armed Forces and shared the false posts with platforms for action.

The attempt to give such a unit legal teeth failed in court:

1. The 2023 amendment empowered the Centre to notify a fact-check unit whose findings would oblige platforms to act, and the PIB unit was named for the purpose.
2. Kunal Kamra, the Editors Guild of India and other petitioners challenged the clause in the Bombay High Court, and on 31 January 2024 a division bench delivered a split verdict.
3. The Supreme Court stayed the notification in March 2024.
4. The third judge, Justice A. S. Chandurkar, held that the clause violated Articles 14, 19(1)⁠(a) and 19(1)⁠(g) and went beyond the IT Act, and the court struck it down in September 2024.
5. The Union appealed, and on 10 March 2026 the Supreme Court issued notice on the appeal and did not stay the High Court's judgment.

The PIB unit continues to publish fact-checks, but the rule that would have bound platforms to act on them stands struck down.

Sahyog is a portal of the I4C, operational since October 2024, through which the appropriate government or its authorised agencies send notices to platforms under Section 79(3)⁠(b) to remove or disable access to information used to commit an unlawful act. By July 2025, nine Central and 34 State or Union Territory agencies, 72 IT intermediaries and 35 virtual asset service providers had joined it. X Corp challenged the portal in the Karnataka High Court as a way around the safeguards of Sections 69A and 79. The High Court upheld the portal in 2025, calling it an "instrument of public good".

The response to social media misuse now works at several levels.

Media Literacy and Balancing Free Speech

Media literacy builds resistance where takedowns cannot reach, inside private groups and in the minds of readers. MeitY observes Cyber Security Awareness Month every October, Safer Internet Day on the second Tuesday of February and Cyber Jagrookta Diwas on the first Wednesday of every month. The National Education Policy 2020 gives priority to digital and AI literacy across levels of education. A reader who checks the source, the date and the original context of a viral video breaks the chain that a bot network depends on. Literacy also guards against cyberbullying, the use of phones, computers or online platforms to harass others by sending misleading messages, spreading false rumours or sharing personal information.

Every measure must also respect the freedom of speech. Article 19(1)⁠(a) can be restricted only on the grounds listed in Article 19(2), and the restriction must be reasonable. Three concerns recur.

• Speed against scrutiny: A three-hour deadline may push platforms to remove first and check later to keep their safe harbour, which critics say favours over-blocking.
• Executive control of truth: The Bombay High Court found the fact-check clause vague, short of procedural safeguards and likely to chill speech about the Government's own business.
• Blunt tools: Internet shutdowns, used in Manipur in 2023 to stop rumours, cut off all users at once. In Anuradha Bhasin v. Union of India, decided on 10 January 2020, the Supreme Court held that indefinite suspension of the Internet is not permissible, that shutdowns must meet the tests of necessity and proportionality, and that orders must be published and are open to judicial review.

Further Remedies Against Fake News and Subversive Use

Several remedies follow from the gaps the existing measures leave.

• Transparency of orders: Publishing reasoned blocking and takedown orders, wherever security allows, would let courts and users test each one against Article 19(2), as Anuradha Bhasin requires for shutdowns.
• Detection at scale: Indigenous deepfake and bot detection tools, of the kind funded under the IndiaAI Mission, would let platforms and agencies find synthetic content before it spreads.
• Faster, verified correction: Official fact-checks issued in Indian languages within the same hours as a rumour, through community radio and local media as well as social media, would reach the people most exposed.
• Coordination across levels: Common standards for State police notices, joint training through I4C and regular review of the Sahyog portal would reduce both misuse and gaps.
• Accountable platforms: Clear reports on how many notices are received and acted upon, and on how recommendation systems treat flagged content, would show whether due diligence is real.

Sources

• MeitY: Information Technology Act, 2000
• MeitY: Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as updated on 10 February 2026
• MeitY: Frequently Asked Questions on the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026
• MeitY: Draft IT (Intermediary Guidelines and Digital Media Ethics Code) Second Amendment Rules, 2026, March 2026 draft
• MeitY: Draft IT (Intermediary Guidelines and Digital Media Ethics Code) Second Amendment Rules, 2026, April 2026 draft
• MeitY: Office Memorandum on the Jan Vishwas (Amendment of Provisions) Act, 2023, and the IT Act (3 November 2023)
• India Code: Bharatiya Nyaya Sanhita, 2023
• PIB, Ministry of Electronics and IT: Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes (6 August 2026)
• PIB, Ministry of Electronics and IT: Government Has Issued Multiple Advisories Emphasizing the Observance of Due Diligence Obligations Under the IT Act and IT Rules (25 March 2026)
• PIB, Ministry of Electronics and IT: India Well-Equipped to Tackle Evolving Online Harms and Cyber Crimes (8 August 2025)
• PIB, Ministry of Home Affairs: National Cyber Crime Data (21 July 2026)
• PIB, Ministry of Home Affairs: Curbing Threat of Online Radicalisation (11 December 2024)
• PIB, Ministry of Home Affairs: Strategy to Control Cyber Crimes in the Country (23 July 2025)
• PIB, Ministry of Information and Broadcasting: Government Debunks Pakistani Propaganda Against India and Armed Forces via Official Fact-Check Unit (30 July 2025)
• PIB, Ministry of Information and Broadcasting: Government Deploys Multi-Tier Mechanism to Curb Fake News (2 April 2026)
• PIB, Ministry of Information and Broadcasting: India Dismantles Pakistani Coordinated Disinformation Operation (21 December 2021)
• PIB, Ministry of Electronics and IT: Three Grievance Appellate Committees Notified on the Recently Amended IT Rules 2021 (28 January 2023)
• PIB, Ministry of Electronics and IT: 1,065 Cases Filed and 937 Disposed of by the Grievance Appellate Committees Under IT Rules, 2021 (2 August 2024)
• PIB Backgrounder: M.A.N.A.V., PM Narendra Modi's Human-Centric AI Odyssey (19 February 2026)
• Wikipedia: Shreya Singhal v. Union of India
• Wikipedia: Puttaswamy v. Union of India
• Wikipedia: Kunal Kamra v. Union of India
• Wikipedia: Internet censorship in India
• Wikipedia: Information Technology Rules, 2021
• Wikipedia: Indian WhatsApp lynchings
• Wikipedia: 2012 Assam violence
• Wikipedia: 2013 Muzaffarnagar riots
• Wikipedia: Burhan Wani
• Wikipedia: Disinformation
• Wikipedia: Social bot
• Wikipedia: Coordinated inauthentic behavior
• Wikipedia: Deepfake
• Wikipedia: End-to-end encryption
• Wikipedia: Fundamental rights in India
• Wikipedia: Directive Principles
• MeitY: Notice extending the consultation on the draft amendments to the IT Rules, 2021 (21 April 2026)
• The Hindu: SC seeks balance; govt. says IT Rules do not curb satire (Delhi edition, 11 March 2026)
• Supreme Court of India: Anuradha Bhasin v. Union of India, judgment of 10 January 2020
• NCERT: Class 7 Curiosity (Science), Chapter 6
• UPSC: Civil Services Examination question papers