Legal liability of an open-source P2P messaging network developer and bootstrap server operator in India

Question

► I am developing an open-source P2P messaging network called Lattice, released under GPLv3, and would like guidance regarding my potential liability under Indian law. Users communicate directly with each other over peer-to-peer connections using end-to-end encryption. I operate an official bootstrap/discovery server solely for peer discovery. The server stores only a user's public key, SHA-256-based user ID, IP address, port, and last-seen timestamp. It does not store, relay, inspect, monitor, index, or otherwise access messages, files, images, videos, or any user-generated content. After discovery, communication occurs directly between users. Both the client and bootstrap server are open source. The documentation states that the software is intended for lawful use and that users are solely responsible for their actions. I would like advice on the following: 1. Under Indian law, could I face civil or criminal liability if a third party uses the software for illegal activities without my knowledge or involvement? 2. Does operating a bootstrap/discovery server create additional legal obligations compared to merely publishing open-source software? 3. Could laws such as the IT Act, DPDP Act, intermediary rules, or other regulations apply to this type of architecture? 4. Would maintaining a privacy policy, disclaimer, terms of use, and abuse-contact process help demonstrate that I do not control or participate in user communications? 5. Are there any legal, compliance, or documentation steps you would recommend before public launch? I am seeking preventive legal advice regarding risks and best practices before making the project publicly available.

Answer 1

Dear Client,

Considering the architecture outlined above, publishing open-source software and running a discovery server that has limited functionality is less risky than running a centralized messaging service that stores/transmits users' messages. However, because there is a discovery server in the equation, it becomes clear that one is not only an author of the software but also runs an online service that handles some data about the users (public keys, IP addresses, identifiers, and metadata about connections). Although one would not normally face any civil/criminal liabilities in case someone uses the software for illegal purposes without their permission, encouragement, or participation, the risk of being held liable may grow in case authorities find out that one knowingly facilitated the misconduct, disregarded any lawful demands, or had more control over communications than advertised. Depending on the exact implementation and scope of the project, clauses from the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, and intermediary-related principles may come into play. It is good to have such measures like privacy policy, terms of use, disclaimers, transparency documentation, abuse contact details, and proper technical knowledge about the capabilities of the server; however, all of them may help to show that your involvement in the process is minimal; yet, none of them can protect you from being legally responsible. Before launching it, it would be wise to have documented the data flow, reduced the data collection, made public your data retention policy, maintained records of the technical constraints of the server, developed a procedure to deal with any legal demands or governmental requests, and received advice from an Indian technology lawyer.

I hope this helps and if you have any further issues do not hesitate to contact us.

Legal liability of an open-source P2P messaging network developer and bootstrap server operator in India

1 Answer