In Pegasus battle, the fight for surveillance reform

Context: A year has passed since the disclosures about the Pegasus Project revealed the threat to India’s democracy.

• A study reported that the cellphones of at least 300 Indians had been hacked with Pegasus, the spyware from the Israel-based NSO Group.
• The court constituted a committee, overseen by former Supreme Court judge Justice R.V Raveendran, to look into the charges and accordingly submit a report.

What were the objectives of the committee?

• The committee was mandated to inquire, investigate and determine, among other things, if Pegasus was used to eavesdrop on phones and other devices of Indian citizens.
• Details were sought on whether the government had taken any action after reports emerged in 2019 about WhatsApp accounts being hacked by the same spyware and if the government had indeed acquired such a suite.

What is Pegasus? 

How was it used in India?

• At least 40 journalists, Cabinet Ministers, and holders of constitutional positions were possibly subjected to surveillance using Pegasus.
• Since Pegasus is graded as a cyberweapon and can only be sold to authorised government entities as per Israeli law, most reports have suggested that the governments in these countries are the clients.

Surveillance Laws in India

Communication surveillance in India takes place primarily under two laws

• Telegraph Act deals with interception of calls
• IT Act was enacted to deal with surveillance of all electronic communication

Telegraph Act

• Section 5(2) of The Indian Telegraph Act, 1885, states that the government can intercept a “message or class of messages” on certain situations.
• Certain situations — the interests of the sovereignty and integrity of India, the security of the state, friendly relations with foreign states or public order, or for preventing incitement to the commission of an offence
• These are the same restrictions imposed on free speech under Article 19(2) of the Constitution.
• These restrictions can be imposed only when there is a condition precedent — the occurrence of any public emergency, or in the interest of public safety.

The operational process and procedures for Interception

• Under Rule 419A, surveillance needs the sanction of the Home Secretary at the Central or State level, but in “unavoidable circumstance” can be cleared by a Joint Secretary or officers above, if they have the Home Secretary’s authorisation.
• In the K.S. Puttaswamy vs Union of India verdict of 2017, the Supreme Court further reiterated the need for oversight of surveillance, stating that it should be legally valid and serve a legitimate aim of the government. 
• The court also said the means adopted should be proportional to the need for surveillance, and there should be procedures to check any abuse of surveillance.

Information Technology Act, 2000

• Section 69 of the IT Act, 2000 deals with electronic surveillance.
• It facilitates government “interception or monitoring or decryption of any information through any computer resource” if it is in the interest of the “sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States or public order” or for preventing or investigating any cognizable offence.

Challenges to overcome

• An overhaul of surveillance laws is necessary to prevent the indiscriminate monitoring of people and entities by the state and private actors.
• The Information Technology Act, 2000 and the Indian Telegraph Act 1885 which empower the Government to surveil, concentrate surveillance powers in the hands of the executive, and do not contain any independent oversight provisions, judicial or parliamentary.
• These legislations are from an era before spyware such as Pegasus were developed, and, thus, do not respond to the modern-day surveillance industry.
• Lack of legislative proposals by the Union Government for surveillance reform:
• The proposed data protection law does not address these concerns
• Instead, the proposed law provides wide exemptions to the Government relating to select agencies from the application of the law; one which might be used to exempt intelligence and other law enforcement agencies.
• This gap in the surveillance framework has led to severe harm being caused to India’s democratic ideals.

Conclusion

From targeting activists and journalists for civil and political purposes, to the targeting of litigants for commercial benefits, the surveillance industry is becoming increasingly accessible, and the nature of surveillance, exponentially intrusive.

In the absence of immediate and far-reaching surveillance reform, and urgent redress to those who approach authorities against unlawful surveillance, the right to privacy may soon become obsolete.

Note: What is a zero-click attack?

Source: The Hindu

The Hindu