What Happens to Privacy After Pegasus?

An independent judiciary, freedom of the press, the right to peacefully protest, and accountability through free and fair elections: these are the promises of the Indian constitutional system that supposedly controls executive power. Yet, as the Pegasus Project has revealed, many Indian journalists, activists and leaders of the Opposition were targeted by spyware that gathered intimate details of their lives and work. Snooping threatens them from carrying out their roles freely, thus sending the checks and balances of the Constitution into paralysis. How would a judge be fair if he knows his every online move gets tracked? How would journalists protect sources if the information on their devices gets secretly leaked to unknown listeners and viewers? If the fading of checks and balances fuels authoritarian tendencies, snooping on ministers of a ruling party makes these tendencies seem real.

A decade ago, the Indian government introduced Aadhaar cards without an architecture for privacy protection. It said Aadhaar is voluntary in response to court petitions that challenged the platform. Yet, in practice, Aadhaar has become the most important document to access government schemes. Aadhaar was implemented without a data protection law either. As the Personal Data Protection (PDP) Bill is pending in Parliament, at present, data gets regulated under the Information Technology Act.

Section 28 of the proposed PDP Bill allows individuals to ‘voluntarily” identify themselves on social media platforms using government ID. It is an unnecessary provision, seen in no privacy law of other countries. It creates the possibility of compulsory identification, as has happened with Aadhaar. The government has also retained the power to snoop, which, linked with the need for identification, raises even more privacy concerns.

The PDP Bill, modelled on the Srikrishna Committee recommendations, got Cabinet approval in December 2019. However, Justice BN Srikrishna, who led the committee that drafted the bill, has said that the government version of the proposed law has “dangerous” provisions that mark an “Orwellian” state. The troubling proposals in the draft relate to changes in the role of central agencies compared to what the Srikrishna Committee recommended.

The government wants the right to exempt certain agencies from the rules to process personal data based on concerns of national security, public order, and friendly relations with foreign states. While these concerns are fine on paper, the government-tabled bill lacks procedures, safeguards and mechanisms to oversee granting exemptions. “The Select Committee has the right to change this. If they call me, I will tell them this is nonsense. I believe there should be judicial oversight on government access,” Justice Srikrishna told the Economic Times newspaper. At the moment, the PDP Bill is with a joint parliamentary committee that it got referred to after Opposition protests.

Secret vote versus muscle and money power in elections

The secret ballot is a crucial democratic norm, but we have now to examine this right in the context of the Pegasus revelations and the previous Cambridge Analytica episode. The former can conduct targeted snooping, while the latter can manipulate voter behaviour using big data. Democratic governance is accepted because it guarantees the natural right of liberty to individuals. Citizens are free to choose their representatives through elections. In a democracy, power lies with elected representatives and checks and balances ensure accountability. That is why, periodically, leaders need to seek popular consent.

A healthy democracy gives citizens the right to a secret ballot to quell intimidation by those with muscle and money power. They could vote according to their mind to satisfy their interests. If the secret ballot guaranteed free and fair elections in the pre-digital era, what do we have in the information age? Now, technology allows data to be analysed to influence people’s choices.

Case of Pegasus

NSO, the Israeli company that created Pegasus, says it does not sell its spyware to non-government entities. Therefore, governments might procure it to catch organised crime and terrorist networks. In India, the right to privacy is not absolute. The Telegraph Act, 1885 and the Information Technology Act, 2000, allow the government to conduct surveillance operations. Under the Telegraph Act, the government can intercept calls only in certain situations: to protect the sovereignty, integrity and security of the State; for friendly relations with foreign states; to preserve public order and prevent incitement to an offence. The same restrictions apply to free speech under Article 19(2) of the Constitution. There are additional safeguards to ensure freedom of the press. Only high-ranking secretary-level officers from the Home departments of the Centre or States can authorise tapping (of phones), and officers not below the rank of joint secretary in case of unavoidable circumstances.

The Information Technology (Procedure for Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, enacted under section 69 of the IT Act, provide an additional legal framework for electronic surveillance. This section allows broader snooping by interception, monitoring, and decryption of digital information “for the investigation of an offense”. Under the IT Act, all electronic transmission of data can be intercepted. It thus allows broader surveillance by the government.

Therefore, in any Pegasus-like instance of surveillance, the government would invoke these acts to snoop. It brings us to former IT minister Ravi Shankar Prasad, who has asked why, if over 45 countries used Pegasus, must we “target just India”? He stopped short of denying Indian authorities procured Pegasus. Present Information Technology and Communications Minister Ashwini Vaishnaw told the Lok Sabha that illegal surveillance is impossible in India, though he did not deny Pegasus got deployed in India.

Even an iota of doubt that Big Brother is watching restricts free expression because it represents the threat of persecution by government machinery. If people cannot debate issues or articulate their demands, and if the government does not receive honest feedback for its policies, the welfare state fails, and democracy is at risk.

Cambridge Analytica

Cambridge Analytica used the data of millions of Facebook users across countries to fashion electoral strategies for a global client list. It influenced the 2016 United States Presidential Election and contributed to the victory of Donald Trump. It also worked for leaders and parties across the political spectrum in India. Cambridge Analytica used individual data to study their ideological orientation, identified fence-sitters, targeted them with surveys and news. These undecided voters, who can have a substantial presence in constituencies, were shown online content that batted against the Democratic position and favoured the Republican stance. It thus influenced the voting behaviour of many in the US poll, in favour of Republican and against Democratic candidates. Further, users’ data was transmitted to Cambridge Analytica from Facebook in the commercial interest, without the informed consent of individuals.

We saw in this episode that data is a fulcrum of the political economy, used for consumer-targeted advertisements that create and influence individual decisions, including political behaviour. Unregulated data collection, usage and transmission can severely dent democracy, as happened in the United States presidential election. For the sanctity of the vote, an individual should get a private space to contemplate decisions and choices. Manipulating voting behaviour using targeted content impedes free thought and choice. It is a denial of liberty and the reason why a data protection law is critical for a free and fair electoral process.

Right to privacy and democratic functioning

When a person does not have rights, individual dignity gets violated. JS Mill distinguished between “self-regarding action” and “other-regarding action”. In the former, the State should not interfere unless an individual is injurious to himself. However, Pegasus-like targeted snooping violates individual rights and dignity. It follows that other-regarding action—for example, in the sphere of political activity—also needs to be free to let people express and organise themselves. So, in every way, privacy is not just an individual good but also a public good in a democracy.

The author is a PhD student specialising in privacy at Savitribai Phule Pune University. The views are personal.