Context: Phones of two serving union ministers, three opposition leaders, one constitutional authority, current and former heads of security organisations, administrators and 40 senior journalists and activists from India were allegedly bugged using an Israeli spy software called Pegasus and put on surveillance, according to an expose by a global consortium of media organisations.
- Forensic tests conducted as part of this project, the reports say, revealed clear signs of targeting by Pegasus spyware in 37 phones, of which 10 are Indian.
- The Ministry of Electronics and Information and Technology rejected the reports of surveillance of journalists.
- The government stated that any surveillance which takes place happens through a “due process of law”.
What is Pegasus?
- Pegasus is spyware produced by the Israeli surveillance firm, the NSO Group.
- A spyware is any malicious software designed to enter your computer device, gather your data, and forward it to a third-party without your consent.
- A zero-click attack helps spyware like Pegasus gain control over a device without human interaction or human error.
- So all awareness about how to avoid a phishing attack or which links not to click is pointless if the target is the system itself.
- Most of these attacks exploit software that receives data even before it can determine whether what is coming in is trustworthy or not, like an email client.
- The vulnerability allows remote code execution capabilities and enables an attacker to remotely infect a device by sending emails that consume a significant amount of memory.
- It then begins contacting the operator’s command and control (C&C) servers to receive and execute operators’ commands, and send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps.
- The operator can even turn on the phone’s camera and microphone to capture activity in the phone’s vicinity.
What is surveillance?
- Surveillance involves paying close and sustained attention to another person.
- Furthermore the design is not to pay attention to just anyone, but to pay attention to some entity (a person or group) in particular and for a particular reason.
- It may also involve listening, as when a telephone conversation is bugged, or even smelling, as in the case of dogs trained to discover drugs, or hardware which is able to discover explosives at a distance.
Concerns with surveillance in India:
Threat to press freedom: A significant number of Indians reportedly affected by Pegasus this time are again journalists. The World Press Freedom Index produced by Reporters Without Borders has ranked India 142 out of 180 countries in 2021.
- The press requires greater protections on speech and privacy.
- In the absence of privacy, the safety of journalists, especially those whose work criticises the government, and the personal safety of their sources is jeopardised.
Issues with legal provisions for surveillance in India:
- Telephone surveillance is sanctioned under the 1885 Telegraph Act (and its rules), while electronic surveillance is authorised under the 2000 Information Technology Act (and its rules).
- The procedural structure in both cases is broadly similar, and flows from a 1997 Supreme Court judgment: surveillance requests have to be signed off by an official who is at least at the level of a Joint Secretary.
- While the provisions of the Telegraph Act relate to telephone conversations, the IT Act relates to all communications undertaken using a computer resource.
- Under Section 69 of the IT Act, the grounds of surveillance have been simply lifted from Article 19(2) of the Constitution, and pasted into the law. They include very wide phrases such as “friendly relations with foreign States” or “sovereignty and integrity of India”.
- The regime is opaque: There is almost no information available about the bases on which surveillance decisions are taken, and how the legal standards are applied.
- No provision allows the government to hack the phones of any individual since hacking of computer resources, including mobile phones and apps, is a criminal offence under the IT Act.
- In response to a Right to Information (RTI) request in 2013, the Central government had revealed that 7,500 to 9,000 orders for interception of telephones are issued by it every month.
- Undermines Right to privacy and Right to free speech: Surveillance, whether under a provision of law or without it, is a gross violation of the fundamental rights of citizens.
- The very existence of a surveillance system impacts the right to privacy and the exercise of freedom of speech and personal liberty under Articles 19 and 21 of the Constitution, respectively.
- It prevents people from reading and exchanging unorthodox, controversial or provocative ideas.
- Undermining integrity of democratic institutions: A system in which political opponents, officials of the Election Commission, and political colleagues could be subject to this kind of surveillance, will inspire less confidence.
- Lack of judicial oversight: In the absence of parliamentary or judicial oversight, electronic surveillance gives the executive the power to influence both the subject of surveillance and all classes of individuals, resulting in a chilling effect on free speech.
- Threatens balance of powers: Vesting such disproportionate power with one wing of the government threatens the separation of powers of the government.
- Such surveillance, when carried out entirely by the executive, curtails Articles 32 and 226 of the Constitution (empowering the Supreme Court and High Courts, respectively, to issue certain writs) as it happens in secret.
- This violates not only the ideals of due process and the separation of powers but also goes against the requirement of procedural safeguards as mandated in K.S. Puttaswamy (Retd) v. Union of India (2017).
- The explosive growth of surveillance technology vendors is a global security and human rights problem. It is not primarily China, but democratic states like Israel and UK, that are selling technologies for deepening the surveillance powers of states.
- Risk to national security: It is a cyber-weapon being unleashed on the Indian polity. The use of Pegasus poses a national security risk. Geopolitics is now influenced by these shadowy cyber weapons.
Role of judiciary: The use of legal or technical means to access data and intercept communications in India must be authorised only in emergency situations, under judicial control and oversight, and with other protections to safeguard our citizens.
- Only the judiciary is competent to decide whether specific instances of surveillance are proportionate, and to balance the necessity of the government’s objectives with the rights of the impacted individuals.
- It is also essential because the leaked database of targeted numbers contained the phone number of a sitting Supreme Court judge, which further calls into question the independence of the judiciary in India.
- Surveillance reform: Not only are existing protections weak but the proposed legislation related to the personal data protection of Indian citizens fails to consider surveillance while also providing wide exemptions to government authorities. The only solution is immediate and far-reaching surveillance reform.
- The Data Protection Bill, 2019: Some of the prominent features of the bill include the citizens’ ‘right to be forgotten’ online, categorises users’ personal data as ‘non-sensitive’, ‘sensitive’ and ‘critical’, and asks for websites take user consent before processing the data.
- ‘Data Protection Bill can reduce the state’s surveillance powers'
- Legislative measures must be introduced in Parliament to uphold the Right to Privacy decision of the Supreme Court of India recognising privacy as a fundamental right.
- Global initiative for controlling surveillance technologies: There needs to be a global compact, or at least one amongst democratic states, on regulating these technologies.
- The ethics of surveillance considers the moral aspects of how surveillance is employed. Is it a value-neutral activity which may be used for good or ill, or is it always problematic and if so why?
- The balance of power between individuals, or between individuals and groups such as employers or the state, is therefore an important consideration in assessing what is wrong or dangerous about many forms of surveillance.
To implement the suggestions above will require a comprehensive reform of the surveillance framework in India. Such a reform is long overdue. This is also the right time: across the world, there is an increasingly urgent debate about how to protect basic rights against encroachment by an aggressive and intrusive state.