Cyber Security – CERTs, Policy, etc

Explained: Surveillance laws in India


From UPSC perspective, the following things are important :

Prelims level : Not Much

Mains level : Provisions of the IT Act

  • On October 30, many publications reported that phones of several dozen Indian journalists, lawyers and human rights activists had been compromised using an invasive Israeli-developed malware called Pegasus.

Is surveillance of this kind illegal in India?

  • First, it’s important to explain that there are legal routes to surveillance that can be conducted by the government.
  • The laws governing this are the Indian Telegraph Act, 1885, which deals with interception of calls and the Information Technology (IT) Act, 2000, which deals with interception of data.
  • Under both laws, only the government, under certain circumstances, is permitted to conduct surveillance, and not private actors.
  • Moreover, hacking is expressly prohibited under the IT Act. Section 43 and Section 66 of the IT Act cover the civil and criminal offences of data theft and hacking respectively.
  • Section 66B covers punishment for dishonestly receiving stolen computer resource or communication. The punishment includes imprisonment for a term which may extend to three years.

How broad are the laws regarding legal surveillance?

  • The framework for understanding the checks and balances built into these laws dates back to 1996.
  • In 1996, the Supreme Court noted that there was a lack of procedural safeguards in the Indian Telegraph Act.
  • It laid down some guidelines that were later codified into rules in 2007.
  • This included a specific rule that orders on interceptions of communication should only be issued by the Secretary in the Ministry of Home Affairs.
  • These rules were partly reflected in the IT (Procedures and Safeguards for Interception, Monitoring and Decryption of Information) Rules framed in 2009 under the IT Act.

What do the Rules say?

  • The rules state that only the competent authority can issue an order for the interception, monitoring or decryption of any information generated, transmitted, received or stored in any computer resource (mobile phones would count).
  • The competent authority is once again the Union Home Secretary or State Secretaries in charge of the Home Departments.
  • In December 2018, the Central government created a furore when it authorised 10 Central agencies to conduct surveillance.
  • In the face of criticism that it was building a ‘surveillance state’, the government countered that it was building upon the rules laid down in 2009 and the agencies would still need approval from a competent authority, usually the Union Home Secretary.
  • The 2018 action of the Union government has been challenged in the Supreme Court.

What about the Supreme Court verdict on privacy?

  • The Supreme Court in a landmark decision in August, 2017 (Justice K. S. Puttaswamy (Retd.) and Anr. vs Union Of India And Others) unanimously upheld right to privacy as a fundamental right under Articles 14, 19 and 21 of the Constitution.
  • It is a building block and an important component of the legal battles that are to come over the state’s ability to conduct surveillance.
  • But as yet a grey area remains between privacy and the state’s requirements for security.
  • In the same year, the government also constituted a Data Protection Committee under retired Justice B.N. Srikrishna.
  • It held public hearings across India and submitted a draft data protection law in 2018 which Parliament is yet to enact.
  • Experts have pointed out, however, that the draft law does not deal adequately with surveillance reform.

Do other countries have stricter laws against surveillance?

  • This continues to be a grey area around the world.
  • Take the U.S. for example. Electronic surveillance is considered a search under the Fourth Amendment which protects individuals from unreasonable search and seizure.
  • Thus the government has to obtain a warrant from a court in each case and crucially, establish probable cause to believe a search is justified.
  • It also has to provide a specific time period under which the surveillance is to be conducted and to describe in particularity the conversation that is to be intercepted.
  • There are very few exceptions or exigent circumstances under which the government may proceed without a warrant.
Notify of
Inline Feedbacks
View all comments