The Indian government is investigating a reported data leak involving Tata Electronics, a key Apple supplier, and has demanded an explanation from WhatsApp regarding its username feature, which officials say could facilitate cybercrime, according to MeitY Secretary S. Krishnan.
Government Scrutiny of Username Features
Speaking on the sidelines of a CII Conference on Friday, Krishnan told ANI that the ministry has directed WhatsApp to explain why it offers a username feature, and has similarly sought explanations from other encrypted messaging platforms like Signal and Telegram. He stated, “The kind of encouragement that it provides or the facility it provides for committing more cybercrimes, which is a very serious issue... we have directed WhatsApp to explain why they have this feature and likewise we have similarly sought explanations from others.”
The government’s concerns come amid growing scrutiny of username-based messaging features, with officials examining whether such functionalities could make it easier for cybercriminals to conceal identities, impersonate users, or evade detection during online fraud and other cyber offences.
Tata Electronics Data Leak Investigation
Responding to a question on the reported Tata Electronics data leak, Krishnan confirmed, “This is also a kind of cybercrime. We are investigating it....It has been reported to us.” Reports have alleged that sensitive internal information linked to the company, which produces iPhone components in India as a major supplier in Apple’s global manufacturing supply chain, was leaked online by threat actors. The government is examining the incident to ascertain its nature, extent, and possible cybersecurity implications.
WhatsApp Response Timeline
When asked whether WhatsApp had requested additional time to respond to the government’s queries, Krishnan replied, “Not that I am aware of.”
VPN Regulation and Enforcement Challenges
On the question of whether the government is considering a legal framework for Virtual Private Networks (VPNs) to prevent users from accessing banned applications, Krishnan explained that the issue requires both legal and technological interventions. “That is a techno-legal aspect. We have to look at both a technology solution in addition to just a legal solution,” he said.
Krishnan noted that existing guidelines already require VPN service providers to register if they operate in India. However, some providers choose not to register and instead offer services from outside the country, making enforcement more challenging. “There is a requirement even under certain guidelines currently for VPNs to register. What happens is many of them choose not to register. They offer it from elsewhere and it is offered at the software level and therefore we have to find technology-based solutions to address this,” he added.
The MeitY Secretary said the government is examining the issue from both legal and technological perspectives to ensure that restrictions on applications are implemented effectively while addressing challenges posed by services operating outside India’s jurisdiction.
