The crowdfunding portal Bribes.fyi suddenly ceased operations after attracting 200 thousand new users and processing five million requests in just 48 hours. Its rapid ascent was unexpected by social media.
This resource was created by Aryan Nishad, a 20-year-old student at a technical university in Delhi. It featured a neon-red map of India intended for anonymous reports of alleged bribe demands. By August 17, the portal had registered reports from 253 cities concerning the functioning of the police, Regional Transport Offices (RTOs), as well as departments dealing with land and income tax and passport services.
Interestingly, 37% of these reports were marked as 'denied,' which, according to users, meant they managed to complete the task without paying. It should be noted that the site emphasized that all presented data were user submissions, not verified cases.
The site soon went offline, citing issues with traffic, data security, spam, duplicate entries, and misuse. The team described the shutdown as voluntary and preemptive, stating: 'We did not create infrastructure capable of safely handling such attention.' They admitted they were not a 'proper custodian at this scale.'
In its farewell note, the developers wrote: 'The decision to close was ours. It should always send a signal, not point fingers. I think the signal has been sent.'
The massive resonance caused by the website and public support sparked discussions among lawyers and experts. According to the 2018 amendment, Section 8 of the Prevention of Corruption Act criminalizes giving or promising an undue advantage to a public servant, punishable by imprisonment for up to seven years. However, there is an exception for individuals forced to pay, provided they report the demand within seven days. Nevertheless, public acknowledgment on the website goes beyond this protection.
Mishi Choudhary, a technology lawyer and founder of Software Freedom Law Center (SFLC.in), noted that a person writing: 'I paid 5000 rupees to get a license' could make a statement potentially linked to their own criminal liability. She also pointed to a policy gap in the law and insisted that platforms must build 'anonymity and security by design... from the very beginning' and 'not collect identifying data at all.'
In her view, the safest approach is to collect the minimum amount of data, as applicants 'should not be subjected to double punishment because the system forces them to.' She added that such a service constitutes a 'repository of sensitive personal data, allegations of criminal behavior, and police information.'
The platform also raises questions about intermediary liability, as it did not merely host allegations but collected, moderated, categorized, and displayed them. Apar Gupta, Founder Director of Internet Freedom Foundation, stated that a 'safe harbor under Section 79 protects an intermediary who does not take or alter the posted information.' He noted that 'moderation and approval of reports... is an active function' that can exceed this role, referencing current Wikipedia litigation in Delhi.
Under the case of Shreya Singhal vs Union of India 2015, content removal requires a court order or government notification, not a private complaint, although IT Rules set timelines for complaint review. Gupta stressed that 'a disclaimer itself does not provide protection.' He also noted that officials 'complain to the police, not to courts.'
Platforms that collect names, phone numbers, or IP addresses are considered data fiduciaries under the Digital Personal Data Protection Act (DPDP Act) and may face fines up to 250 crore rupees for security breaches, although Section 17 exempts government bodies. Gupta warned: 'A platform cannot promise anonymity while retaining identifying records.' Data must be transferred within 72 hours upon official request, and disproportionate demands can be challenged in a Puttaswamy case.
Gupta also pointed out that 'the protections for applicants are minimal.' He referred to a Lokniti-CSDS survey where nearly two-thirds of respondents fear prosecution for online statements. The Whistleblowers Protection Act of 2014 has yet to be enacted.
For a possible relaunch, Gupta recommended abandoning accounts, IP logs, and metadata, using aggregated data instead of names, directing appeals to editorial boards, having a complaints officer, and publishing transparency reports. He added that 'decentralization is not a legal defense,' mentioning that BitChat and GitHub were blocked during protests in Delhi in July.