Why is an Indian court order determining what you can read on the internet?

On Nov. 16, 2023, Reuters published a deeply-reported investigation about an Indian company named Appin, which the report alleged “grew from an educational startup to a hack-for-hire powerhouse that stole secrets from executives, politicians, military officials and wealthy elites around the globe.”

The piece alleged Appin “hacked on an industrial scale,” acting as a “premier provider of cyberespionage services for private investigators working on behalf of big business, law firms and wealthy clients.” But you won’t find this story online. Reuters has removed their reporting, and some other outlets have followed suit.

The orchestrators of this disappearing act? A court order against Reuters and its journalists secured in India by a group operating under the Appin name.

But this isn’t just affecting what can be read in India. Globally, even in the United States, people are unable to read reports about Appin because a court order from half a world away limits everyone’s access to online news and information.

This is a serious threat to free speech. It may hint at what’s increasingly the future of censorship online — and a weak spot for free expression, even in countries with extensive protections for it.

A lawsuit in India and its global consequences

The story begins in June 2022, when Reuters published an article about India’s emerging hacking industry that mentioned Appin as an alleged example. A lawsuit followed that November in India against Reuters and three of its journalists by the Association of Appin Training Centers, a group operating under the Appin franchise name, whose authenticity Reuters has reportedly contested, citing its incorporation “only months after it named itself as the plaintiff suing Reuters.”

The suit’s claims include defamation, “mental harassment, stalking, sexual misconduct, and trauma.” The AOATC objected to the fact that ex-employees or ex-students of the training centers were contacted by reporters of the opposite sex — an alleged “gender-biased” act. In other words: basic reporting. AOATC further complained that the reporters’ methods weren’t just upsetting to individuals to whom they reached out, they also harmed India’s national security. The suit also named LinkedIn, WhatsApp owner Meta, and the Indian job recruiter site Naukri as defendants, on grounds Reuters reporters used those services to contact their sources. AOATC sought an order requiring those sites to block the reporters’ existing and future accounts.

On Dec. 1, 2022, Judge Rakesh Kumar Singh of New Delhi’s North West district court enjoined Reuters from “publishing any defamatory article” regarding Appin, its students, or its employees. An order followed in October 2023 clarifying that the injunction encompassed only defamatory material, and nothing else.

Reuters, confident in its reporting about the firm, published the November 2023 article that led, two and a half weeks later, to a New Delhi North West district court interim order directing Reuters to take down the story, with wide-reaching ramifications. 

Blunt censorship by courts, government officials, and litigious individuals is a serious threat in the digital age. But so is self-censorship. After all, you can’t censor what isn’t said in the first place.

The district judge, Rakesh Kumar Singh, held he was “prima facie satisfied” the article was “indicative of defamation” and should not be available in the “public domain.” His order also directed Google to remove it from search result pages until further notice. (FIRE reached out to Google to ask how it responded to the order, but didn’t get a response.)

As anyone searching for the article now knows, Reuters complied. An editor’s note has replaced it on their page:

Reuters has temporarily removed the article “How an Indian startup hacked the world” to comply with a preliminary court order issued on Dec. 4, 2023, in a district court in New Delhi, India.

Reuters stands by its reporting and plans to appeal the decision.

The article, published Nov. 16, 2023, was based on interviews with hundreds of people, thousands of documents, and research from several cybersecurity firms.

The order was issued amid a pending lawsuit brought against Reuters in November 2022. As set forth in its court filings, Reuters disputes those claims.

While websites or social media platforms receiving legal notices about disputed expression often geo-block the content — meaning it’s banned or censored only in countries governed by the courts or administrations sending those notices — Reuters went a different route: It removed the story everywhere. Suddenly, as a result of a ruling in one court, in one country, the entire world’s access to a significant story was severely limited. In a deeply globalized world, even countries with extensive speech protections are susceptible to this kind of censorship, the ripple effects of which can be alarming.

This challenged Reuters story is at the center of what’s since become a nesting doll of censorship, where new threats keep adding more and more outer layers. It’s not just the original reporting that’s on the chopping block — authors of stories about the reporting, or even about the removals of it, face pressure now, too. 

Who else has removed coverage of Appin? And who hasn’t?

Indian outlets, including Timeline and The Scroll, have also taken down reporting on Appin and Appin co-founder Rajat Khare. But what is unusual and concerning is that, now, outlets outside India — that, unlike Reuters, lack offices or employees in India — are complying with an interim court order, in a lawsuit to which they are not parties, in legal systems that do not govern them.

Readers hoping to review the original Reuters piece for themselves have few options. They can find it at Distributed Denial of Secrets, a nonprofit website that shares whistleblowers’ leaks, and via screenshots on Archive.Today. But other options are scarce.

Khare succeeded in having outlets remove stories about him before the censored 2023 Reuters investigation. In 2022, his legal team reportedly obtained a court order in Switzerland against Swiss papers reporting on his and Appin’s activities. That same year, SRF, an outlet within the Swiss Broadcasting Corporation, removed Khare’s name from an investigative piece about the Qatari government’s intelligence operation against FIFA officials ahead of the World Cup, because of “an interim court order.” Khare also managed to secure post-publication edits at outlets in Luxembourg and the United Kingdom, including in an investigation by The Sunday Times.

While AOATC pursued legal action against Reuters in 2022 in India, Khare independently retained the services of lawyers — including American defamation firm Clare Locke LLP — who have reportedly sent legal demands to Reuters, WIRED, and The New Yorker, calling suggestions that Khare was tied to hacking “false” or “fundamentally flawed.”

Turning back to the Reuters piece, while it was temporarily available on Internet Archive’s Wayback Machine, it’s notably now gone even there — from a tool meant to preserve access to web pages across the Internet. As Politico recounted from Mark Graham, the Wayback Machine’s director and recipient of a December takedown demand from Khare’s attorneys: “We were faced with the decision of either keeping the article available and risking having legal action taken against us, and incurring a costly defense in an unfamiliar venue, or disabling the material and staying abreast of the case and whether the defamation claim ultimately prevails.” 

Sentinel One, a U.S. cybersecurity firm, also took down its coverage of the story, replacing it with an editor’s note explaining it was temporarily down “in light of a pending court order” and “out of an abundance of caution.” Legal and national security commentary site Lawfare updated their coverage of Reuters’ reporting so that all quotes from the piece were replaced with “[XXXXX]” after receiving a letter that “demanded” they do so. And podcast Behind the Bastards appears to have taken down two recent episodes about Khare and Appin.

Not everyone is complying, however.

When the AOATC sent a takedown notice to Professor Ronald Deibert, director at The University of Toronto’s Citizen Lab, because he linked to the Reuters report, he responded with a notice of sorts, too — in the form of middle-finger emojis.

Techdirt’s Mike Masnick, who wrote about the court order against Reuters, and MuckRock, which continues to host primary source material relied on in Reuters’ reporting, also reportedly received letters. AOATC’s notice to MuckRock, which was not signed by an attorney, pushed for removal of “defamatory content” and warned that the Appin-related documents were “contemptuous not only to the Plaintiffs concerned” but also “derogatory to the entire Indian Nation.” But MuckRock and Techdirt are represented by David Greene at the Electronic Frontier Foundation, who informed the AOATC: “The order is in no way the global takedown order your correspondence represents it to be.”

Another piece that remains available online is by The New Yorker’s David Kirkpatrick, who referenced Appin and Khare while covering India’s hacking industry — but whether that will change remains to be seen. Kirkpatrick and The New Yorker, along with Google, were also sued in India by the AOATC for defamation, and Clare Locke has reportedly warned The New Yorker on Khare’s behalf in the United States.

The future of censorship and self-censorship

What’s happening with Reuters and Appin — where local laws or courts affect speech on a global scale — is not an isolated incident.

Increasingly, would-be censors realize they have means to target critics thousands of miles away using local or foreign laws, police, or courts. Hong Kong’s national security law, for example — written to apply even to expression outside Hong Kong by people who are not residents — offers a grim reminder of what it can look like when this kind of censorship is codified into law.

EFF’s Greene says efforts to make local law international are developing into a trend. “We’ve seen a lot of efforts to use local court orders as global takedown orders over the years, and have filed intervening briefs in cases in European courts when that seems to be either the party’s or the court’s intention,” Greene told me. “The phenomenon of libel tourism is well established and the SPEECH Act was passed expressly to address it.” 

The SPEECH Act, enacted in 2010, bars American courts from enforcing foreign defamation judgements that do not align with U.S. First Amendment standards. But the SPEECH Act cannot protect targets against enforcement in other countries.

Some will fight back against this increasing tide — but others will comply without resistance, even when not required to do so by law, because they’ll deem it simply not worth the trouble.

It also may not just be government force that compels silence, but corporate self-censorship. As companies expand globally and encounter varying speech restrictions in countries in which they operate, they may decide that standing up for free expression — whether in journalism, social media, or arts and entertainment — is just not worth the trouble or threat to their bottom line.

Take AI image generator Midjourney, for example, which prevented users from making satirical images of Xi Jinping, but not other world leaders, because its founder and CEO David Holz wanted to ensure the product’s availability in China. Holz chose to make that the policy for everyone, not just potential users in China, because “the ability for people in China to use this tech is more important than your ability to generate satire.”

There’s also the case of media company Vice, whose partnership deal with the Saudi Arabian state-owned media outlet MBC Group has “enormous sums of money now flowing from Saudi Arabia.” Journalists at Vice claim senior managers at the company pulled their piece about trans rights in Saudi Arabia, purportedly to protect the company and its employees in the country.

It’s clear now that even on the Internet, where it often seems nothing truly ever disappears, it’s possible for someone with the requisite means and motivation to use threats or coercion to impose their will and make information as hard as possible to access.

These factors not only contribute to an environment that puts public knowledge at further risk, they could also encourage media outlets and other industries to shy away from sensitive investigations or controversial material altogether. Some will fight back against this increasing tide — but others will comply without resistance, even when not required to do so by law, because they’ll deem it simply not worth the trouble.

Blunt censorship by courts, government officials, and litigious individuals is a serious threat in the digital age. But so is self-censorship.

After all, you can’t censor what isn’t said in the first place.