India puts WhatsApp's impending payments service on ice due to data localisation fracas

What an irony it would be if a government of a large democracy initiated an illegal hack into the private and encrypted WhatsApp messages of those it deemed a threat to the nation and then used that same hack as one of the reasons to ban the service from launching a lucrative new feature.

This, and more, is what seems to have unraveled in India and it all started when Indian academics and lawyers accused the government of Narendra Modi of hacking into their phones.

It kicked off a few weeks ago when Pegasus spyware, made by Israeli company NSO Group, was injected into the user's phone through a video call regardless of whether it was picked up or not. That pretty much sealed the fate of the recipient whose phone's contents -- messages, calls, passwords, contact lists, you name it -- was now commandeered by the attacker. Apparently some 1,400 numbers globally were targeted in a two-week period and 17 in India. NSO's technology is used almost exclusively by governments and intelligence agencies. 

In India, the targets were all the usual suspects that an authoritarian government would want to spy on: Activists, journalists, lawyers, and scholars. For instance, one of them was an assistant professor of political science at Delhi University, Saroj Giri, who studies the Maoist rebellion in India. Another was Seema Azad, a human rights lawyer and a frequent critic of Modi. 

The Indian government denied any role in the infiltration. Instead, it blamed Whatsapp for the attack.

"We have asked WhatsApp to explain the kind of breach and what it is doing to safeguard the privacy of millions of Indian citizens," said Ravi Shankar Prasad, India's electronics and information technology minister, in a tweet.

In the latest development, the Indian government has gone one step further and, via the Reserve Bank of India, issued an edict that has put the brakes on WhatsApp's greatly anticipated new payments service that was supposed to launch in December, and was being tested for over a year in the country.

Some of that may have to do with the security breach but the real reason seems to be the one thorny issue that has dogged non-Indian companies and put them at loggerheads with the Indian government: Data localisation.

See also: Indian government likely to cave in on data localisation stance after pressure from US

The Indian government has started acting aggressively to prevent customer-sensitive data from being stored abroad. In the case of WhatsApp, as the Times of India reports, it stores things like transaction IDs and reference numbers on its servers abroad for 90 days and when a customer raises an issue, a call log is shared by teams in the US and Hyderabad. Now, auditors contend that there is no payment data on these logs but the RBI says that many customer email messages do in fact contain sensitive account information and screen shots that can be easily appropriated.

Whether it is a case of protectionism or a judicious move, the fact is foreign companies are not going to like what's coming in three months. The Supreme Court of India has allowed the government to draw up legally-binding requirements that enforce data localisation. Companies such as WhatsApp are complaining bitterly about this, stating that they cannot do so while also ensuring their trademark end-to-end encryption. And, for now, WhatsApp is officially barred from launching a payments service in India.

This is disastrous news for the instant messaging company. We've seen how messaging app-driven payments have taken India's similarly populous neighbour China by storm. 

Popular messaging platform WeChat, for instance, made $5.5 billion this year and along the way has helped its owner Tencent touch $500 billion in market cap. So you can imagine the spigot of riches about to flow in India from payments. 

Moreover, WhatsApp has a ready-made, loyal, active user-base of 400 million Indian users -- the largest by a long shot in the country -- who are ostensibly ready to open their pocketbooks via the messaging service. As Facebook's growth slows, its messenger could be the goose that lays its golden egg.

The other reason why WhatsApp should be concerned about the RBI edict is because the payments space in India is sizzling. For a while, Warren Buffet-backed Paytm was ahead of the pack thanks to a first mover advantage, but Flipkart's Phone Pe and Google Pay have rapidly gained market share. All services have to go through the United Payments Interface -- an instant real-time payment system that meshes multiple bank accounts into a single app -- launched three years ago and has already logged over 800 million transactions in July. A hundred and forty three banks are also on this payment gateway. 

UPI transactions are already accounting for 40% of all payments versus 44% that are made by cards. Although the transaction values of UPI payments are much smaller, the sheer volume of this rapidly growing system means that being forced to wait on the sidelines will be the unkindest cut of all.

Related Coverage

WhatsApp launches fingerprint security lock support for Android devices

What Apple's iOS has already received is now available for Android handsets.

WhatsApp banned nearly half a million accounts during Brazilian elections

The information was submitted by the messaging app as part of ongoing investigations into the spread of fake news.

Facebook accused of being 'megaphone for hate' in northeastern India

Facebook's pathetically low number of content moderators, as well as the total incapability of its artificial intelligence in throttling hate speech on its platform, means that a human rights disaster of epic proportions may be just around the corner.

Details for 1.3 million Indian payment cards put up for sale on Joker's Stash

Exclusive: Today's Indian card dump considered one of the largest of its kind; prized at more than $130 million.

Pixel 4 skips India, Japan waiting on Motion Sense

Country by country decisions throughout the Asia-Pacific region means a Pixel 4 in some places is not the same Pixel 4 in others, even if it is the same phone.