NEW DELHI: Bribes.fyi began as a side project and, within 48 hours, clocked 5 million requests and 2 lakh new users. It shut down as suddenly as its meteoric rise took social media by surprise.Built by 20-year-old Delhi BTech student Aryan Nishad, it displayed a neon-red map of India for anonymous reports of alleged bribe demands. By Aug 17, it had logged reports from 253 cities—against police, RTOs, and revenue and land records offices, and passport offices. 37% were, interestingly, marked “refused”, meaning users said they did not pay and still got their work done. The site stressed these were user submissions, not verified cases.The site then abruptly went offline, citing traffic, data security, spam, duplicate entries and misuse. Calling the shutdown voluntary and precautionary, the team said: “What we did not build was the infrastructure to carry that kind of attention safely”. They acknowledged it was “not the right custodian for it at that scale”.In their farewell note, they said: “Shutting it down was our decision. It was always meant to send a signal, not point fingers. I think the signal was sent.”The website and the traction it got from the public has generated huge conversation, with lawyers and experts weighing in. Section 8 of the Prevention of Corruption Act criminalises giving or promising an undue advantage to a public servant, punishable with up to seven years’ imprisonment after a 2018 amendment. An exception applies to someone compelled to pay who reports the demand within seven days. But a public admission on a website falls outside that protection.“So a person writing, ‘I paid Rs 5,000 to get my licence issued’ may be making a statement potentially relevant to their own criminal liability,” said Mishi Choudhary, technology lawyer and founder of Software Freedom Law Center (SFLC.in). The law has a policy problem, she said, and platforms must build “anonymity and security by design… from the beginning” and “not collect identity at all”.The safest approach, she said, is to collect minimum data because complainants “can’t be punished twice for doing what the system is forcing them to do”. Such a service is “a repository of sensitive personal data, allegations of criminal conduct and police information”, she added.The platform also raises intermediary-liability questions because it collected, moderated, categorised and mapped allegations instead of merely hosting them.“Safe harbour under Section 79 protects an intermediary that does not select or modify the information it hosts,” said Apar Gupta, founder director of Internet Freedom Foundation. “Moderating and approving reports… is an active function” that may exceed that role, he said, citing ongoing Wikipedia litigation in Delhi. Under Shreya Singhal vs Union of India 2015, removal requires a court order or govt notification, not a private complaint, though IT Rules prescribe grievance timelines. “A disclaimer offers no protection by itself.” Officials, he said, “complain to the police, not to the courts.”Platforms collecting names, phone numbers or IP addresses are data fiduciaries under the DPDP Act and face penalties up to Rs 250 crore for security failures, though Section 17 exempts govt agencies. “A platform cannot promise anonymity while retaining identifying records,” Gupta said. Data must be handed over within 72 hours of an authorised request, while disproportionate demands can be challenged under Puttaswamy.Join conversationView All Comments →Share your thoughts in the commentsInsightfulAgreeDisagreeSkepticalConcerningPromisingWorth ReadingBig DevelopmentPost CommentBe respectful · TOI community guidelines Yet “there is little protection for complainants”. Gupta cited a Lokniti-CSDS survey finding nearly two-thirds fear legal action for online speech. The Whistle Blowers Protection Act, 2014 was never operationalised.For a relaunch, Gupta recommended no accounts, no IP logs, stripped metadata, aggregate figures instead of names, referrals to newsrooms, a grievance officer and transparency reports. “Decentralisation is not a legal defence,” he said, noting BitChat and GitHub were blocked during July’s Delhi protests.Get the latest India News and Live updates. Download the TOI app.About the AuthorIsmat AraAt The Times of India, Ismat Ara covers politics, people, and societies, with a focus on accountability, justice, and lived experience. Shaped by years of rigorous reporting across cities, small towns, and remote villages, she is drawn to the human stories tucked beneath policy and paperwork.Read MoreEnd of ArticleFollow Us On Social MediaVideos‘Making Provocative Remarks Against India For Years’: MEA Slams US Body Over RSS Sanctions CallRevanth Reddy’s US Trip Cancelled After MEA Denies Clearance, Telangana Delegation Goes AheadPellet-gun Row: Rahul Gandhi At Parliament Street Police Station To Lodge Complaint With DCP‘Don’t Politicise Our School’: Villagers Block CJP Visit As Party Alleges BJP Attack In RajasthanModi Pushes AI, Youth And Data Agenda, Tells Secretaries To Break Government Silos And InnovatePirates Hijack Two Ships Carrying 22 Indians Off Yemen And Somalia, Crew Safety Raises Concern‘NEET, Delimitation, Cauvery, Drugs’: Vijay’s Key Requests Before Amit Shah At Tamil Nadu MeetingPolicy Shift Or Just Words? Inside US Envoy Gor’s ‘Kashmir’ Remark That Rattled PakistanJharkhand High Court Stays Soren Govt’s Order To Cancel JPSC Exams, AppointmentsKangana Vs Ramdev: BJP MP Fires Back After Yoga Guru Questions Her Past And Controversial Remarks123PhotostoriesOptical Illusion personality test: What you spot first reveals your secret dominant traitH1N1 is rising again: Doctors explain why swine flu cases are increasing and how to stay protectedWorking out in extreme heat? How dehydration can reduce kidney function and raise the risk of acute kidney injuryRoad to longevity: 7 simple habits that may help ‘super-agers’ stay healthy beyond 1008 foods you should never reheat in the microwave and why5 smart ways to protect yourself from office politics, according to entrepreneur Ankur WarikooThe 5 beauty trends dominating Instagram in 2026Ram Kapoor’s approximately Rs 20 crore Mumbai home: A coffin-shaped bar, private theatre room and stunning art collection7 health benefits of drinking coffee that go beyond boosting energy; new study links the drink to less body fat and more muscle9 vulture species found in India: Places where travellers can see them123Hot PicksTCS laptop monitoring softwareTNEA counselling3 year practice ruleJEECUP counsellingAston Martin crashAbhijeet DipkeAnkur WarikooSIM card rulesManoj Mukund NaravaneTop TrendingHyderabad Aston Martin AccidentLadakh TouristMumbai Rape AirhostessMadhapur Road AccidentUKG Student DeathSalman Khan Gym FireAbhijeet DipkeRahul GandhiBengaluru RapidoBen Gvir
NEW DELHI: Bribes.fyi began as a side project and, within 48 hours, clocked 5 million requests and 2 lakh new users. It shut down as suddenly as its meteoric rise took social media by surprise.Built by 20-year-old Delhi BTech student Aryan Nishad, it displayed a neon-red map of India for anonymous reports of alleged bribe demands. By Aug 17, it had logged reports from 253 cities—against police, RTOs, and revenue and land records offices, and passport offices. 37% were, interestingly, marked “refused”, meaning users said they did not pay and still got their work done. The site stressed these were user submissions, not verified cases.The site then abruptly went offline, citing traffic, data security, spam, duplicate entries and misuse. Calling the shutdown voluntary and precautionary, the team said: “What we did not build was the infrastructure to carry that kind of attention safely”. They acknowledged it was “not the right custodian for it at that scale”.In their farewell note, they said: “Shutting it down was our decision. It was always meant to send a signal, not point fingers. I think the signal was sent.”The website and the traction it got from the public has generated huge conversation, with lawyers and experts weighing in. Section 8 of the Prevention of Corruption Act criminalises giving or promising an undue advantage to a public servant, punishable with up to seven years’ imprisonment after a 2018 amendment. An exception applies to someone compelled to pay who reports the demand within seven days. But a public admission on a website falls outside that protection.“So a person writing, ‘I paid Rs 5,000 to get my licence issued’ may be making a statement potentially relevant to their own criminal liability,” said Mishi Choudhary, technology lawyer and founder of Software Freedom Law Center (SFLC.in). The law has a policy problem, she said, and platforms must build “anonymity and security by design… from the beginning” and “not collect identity at all”.The safest approach, she said, is to collect minimum data because complainants “can’t be punished twice for doing what the system is forcing them to do”. Such a service is “a repository of sensitive personal data, allegations of criminal conduct and police information”, she added.The platform also raises intermediary-liability questions because it collected, moderated, categorised and mapped allegations instead of merely hosting them.“Safe harbour under Section 79 protects an intermediary that does not select or modify the information it hosts,” said Apar Gupta, founder director of Internet Freedom Foundation. “Moderating and approving reports… is an active function” that may exceed that role, he said, citing ongoing Wikipedia litigation in Delhi. Under Shreya Singhal vs Union of India 2015, removal requires a court order or govt notification, not a private complaint, though IT Rules prescribe grievance timelines. “A disclaimer offers no protection by itself.” Officials, he said, “complain to the police, not to the courts.”Platforms collecting names, phone numbers or IP addresses are data fiduciaries under the DPDP Act and face penalties up to Rs 250 crore for security failures, though Section 17 exempts govt agencies. “A platform cannot promise anonymity while retaining identifying records,” Gupta said. Data must be handed over within 72 hours of an authorised request, while disproportionate demands can be challenged under Puttaswamy.
Share your thoughts in the comments
Be respectful · TOI community guidelines
Yet “there is little protection for complainants”. Gupta cited a Lokniti-CSDS survey finding nearly two-thirds fear legal action for online speech. The Whistle Blowers Protection Act, 2014 was never operationalised.For a relaunch, Gupta recommended no accounts, no IP logs, stripped metadata, aggregate figures instead of names, referrals to newsrooms, a grievance officer and transparency reports. “Decentralisation is not a legal defence,” he said, noting BitChat and GitHub were blocked during July’s Delhi protests.
