Fake Profile Racket: Decoding The Many Legal, Technical Grey Areas

Singer Bhoomi Trivedi recently approached Mumbai Police seeking action against creation of a fake Instagram account.

Singer Bhoomi Trivedi recently approached Mumbai Police seeking action against people who had created a fake Instagram account impersonating her.

(Illustration: Arnica Kala/The Quint)

Mumbai police announced on 16 July it had unearthed a major international racket involving social media marketing companies that create and operate fake profiles and engage in dishonest business practises.

The issue came to light on 11 July after vocal artiste Bhoomi Trivedi had approached Commissioner of Mumbai Police, Parambir Singh. She sought action against unknown persons who had created a fake profile of her on Instagram and had generated fake chat logs showing her negotiating deals to get her account verified.

Following the registration of a formal complaint, police’s crime branch arrested 20-year-old Abhishek Daude, who works for a website called followerskart.com that allegedly provides fake followers to Instagram users for a fee.

A host of issues including impersonation, freedom of speech, anonymity, false social media metrics, liability of social media platforms and the legal standing of bots, have triggered questions that emerge from the crevices between legality and criminal offence.

The Quint wades through the grey areas of the long-standing debate to decode the technological and legal aspects of the case.

How Is Mumbai Police Investigating This?

The Criminal Intelligence Unit (CIU) had taken up the investigation which is headed by Deputy Commissioner of Police Nandkumar Thakur with former ‘encounter specialist’ Sachin Vaze as the chief investigating officer.

According to reports, a first-of-its-kind Special Investigation Team (SIT) has been formed to probe social media marketing businesses operating in violation of the Indian Penal Code and the Information Technology Act.

What Has the Investigation Revealed So Far?

According to an NDTV report, Joint Commissioner of Police (Law and Order) Vinoy Choubey said, “There is a huge international racket which is involved in creation of fake profiles as well as fraudulent activities on social media marketing front.”

According to the investigation, the police has unearthed at least 54 companies operating in India that are involved in creating fake profiles and fake identities.

“This, they do manually and with the help of software called bots," Choubey added.

The police had said that Daude’s interrogation revealed that he had provided over 5 lakh fake profiles for at least 176 accounts. On 17 July, police had recorded statements of 16 of Daude’s alleged clients who had allegedly used the services of the company, according to a report in The Indian Express.

Isn't Impersonation a Criminal Offence?

Impersonation is indeed a criminal offence under provisions of the Indian Penal Code and the Information Technology Act, 2000.

The sections of the Indian Penal Code dealing with impersonation would include 415 (cheating), 416 (cheating by personation), and 499 (defamation).

Section 468 of the Indian Penal Code, which deals with committing forgery of a document or electronic record for the purposes of cheating can also be applied in some cases, legal experts say.

Under the IT Act, which deals with cyber and electronic resources, section 66D states, “Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend up to three years and shall also be liable to a fine which may extend up to one lakh rupees”.

Was Bhumi Trivedi Cheated By The Fake Profile?

This is an interesting question given the lack of precedence in cases involving transactions in fake profiles.

Section 416 of the IPC (Cheating by personation) states, “A person is said to ‘cheat by personation’ if he cheats by pretending to be some other person, or by knowingly substituting one person for another, or representing that he or any other person is a person other than he or such other person really is.”

The grey area here is that Abhishek Daude himself did not impersonate Bhoomi Trivedi but used her image to cause harm to reputation. Therefore, cheating by impersonation and forgery are likely to come into play.

“If one has to read this provision technically, this is still a somewhat simpler case because a real person was indeed being impersonated by a fake profile,” said Arpit Gupta, senior associate at Ikigai Law, that specialises in regulatory counsel to technology-led businesses.

“It really depends on the context of the fakeness,” Gupta added

This leads us to our next question.

What About Fake Profiles That Do Not Impersonate Anyone?

There is no specific law as such in India that deal with cases involving only the buying and selling of fake accounts. Law enforcement agencies have little to work with in terms of precedence where a fake profile is being sold but isn’t impersonating or causing any specific harm.

An answer to this question would require clarity of the specific context in which a fake profile is operating. Such a profile, if not impersonation, could still end up committing crimes under hate speech or abuse or outrage the modesty of a woman.

“The case which is currently there is strictly an offence. So, I think that’s okay. But if the state or the police start going beyond that then there may be problems. Either you put in some kind of a framework within which the police acts. Because the police cannot randomly go to someone and say she is operating an anonymous profile,” Gupta explains.

Is It a Crime To Have False Social Media Metrics?

From an ethical perspective surely but in the eyes of the law there are no provisions that specifically deal with this.

“My understanding would be that here there is no strict criminal offence that is being committed when I am showing wrong number of followers on my profile,” Gupta told The Quint.

What About Anonymous Parody Profiles?

Another grey area is anonymous profiles. There are thousands of spoof or parody profiles that publish satirical posts on Twitter posing as political leaders, historical figures and popular public personalities.

This is where questions regarding freedom of speech come in. “No one knows who operates these profiles. Does that qualify as ‘fake profile’ against which action can be taken? In that case you could be violating someone’s freedom of speech.”

Can't The Cops Just Find Out Who is Operating The Fake Profiles?

Another angle which can be drawn from this incident is the importance of having verified profiles. In the Personal Data Protection Bill there is a provision for bringing some kind of identification mechanism for people who create accounts on social media.

“When one thinks about this in the context of Bhoomi Trivedi’s case then there seems to be a valid concern on the state’s behalf as to why there has to be some kind of way of verifying who is operating the account,” Gupta said.

The question that arises is, even if a fake profile is discovered who does the police go after? There would be a lengthy and technical process to go about this where the police approaches Instagram, Twitter or Facebook.

Getting information from platforms is neither easy nor a quick process. Requests by law enforcement sometimes take months to elicit responses and there is no guarantee of platforms providing the information sought.

This is also in part because social media platforms try to verify if the request is strictly legal or if police is exceeding its scope of powers. Gupta adds, “Then there is an entire issue where they will ask the police to go to the US entity which stores the data and not the India entity.”

Can Bots Be Charged With Criminal Offences?

A bot is a software application that is programmed to do certain tasks. “Bots are automated, which means they run according to their instructions without a human user needing to start them up. Bots often imitate or replace a human user's behaviour,” web security company Cloudflare explains.

According to the police, many of the fake accounts operated by the marketing companies are run by bots.

In the United States, on 1 July 2018, California’s "Bolstering Online Transparency," or BOT Bill came into effect. Under the new rule all bots on social media that attempt to influence California residents’ voting or purchasing behaviours are required to conspicuously declare themselves.

The onus is on the owner or creator of the bot to prominently designate such accounts as automated. In India, too, those operating bot accounts would be likely held responsible for specific offences, legal experts say.

In the US, bots have often been acknowledged as a menace on social media. Bots have often been used to mislead users by mimicing human bheaviour, to artificially inflate follower counts, likes, and retweets, and to manufacture consensus on divisive issues and even get them to trend on Twitter.

What Are Social Media Platforms' Stance?

Most platforms, within their Terms of Use, have provisions against impersonation and can take action when a profile is not being operated by a person herself.

TWITTER

Impersonation is a violation of the Twitter Rules. Its terms of service specify, “Twitter accounts that pose as another person, brand, or organisation in a confusing or deceptive manner may be permanently suspended under Twitter’s impersonation policy.”

However, Twitter also clarifies “users are allowed to create parody, newsfeed, commentary, and fan accounts on Twitter, provided that the accounts follow the requirements” by clearly stating in the bio that it is a “parody”, “fake”, or “fan” account.

INSTAGRAM

On Instagram, however, the rules are different. “Only the person who's being impersonated can file a report,” its help centre states. Instagram encourages users to contact the person being impersonated to report the issue on the platform.

Can Social Media Platforms Be Held Liable?

Under intermediary liability rules in the IT ACT, there is a due diligence requirement which the platforms have to carry out in order to protect against liability for the content posted by users.

Section 79 of the IT Act provides exemption from liability intermediaries like social media platforms “observes due diligence while discharging his duties under this Act”.

“Not following them can take away this safe harbour protection. They must ensure that the account must not belong to another person and they should not impersonate another person or give out misleading impersonation. Therefore, there exists some obligations on platforms also,” Gupta explains.

There exists a contractual arrangement between the user and that platform. “You can say terms of service being violated and at the most you can have a civil remedy where I go to court saying the terms of service are being violated and pleading for action to be taken. I can’t go to police for that because this is not a criminal remedy,” Gupta added.