Decoding the legality of ‘authorised’ surveillance in India
NEW DELHI: Use of Israeli spyware Pegasus for alleged phone tapping of prominent personalities, including journalists, politicians and experts in India, has given rise to host of issues pertaining to cyber security threats and state-mandated surveillance that bypass the concept of trusted communications.
In a statement in Lok Sabha, IT and Communications Minister Ashwini Vaishnaw said that “any sort of illegal surveillance” by unauthorised persons is not possible in India where statutes prescribe a well-settled procedure for carrying out lawful interception as per the due process of law.
What are the provisions allowing interception of electronic communication in India?
Pertinent provisions in the Indian Telegraph Act, 1885 and the Information Technology (Amendment) Act, 2000 authorise the Union and the state governments to intercept all types of electronic communication, including phone calls, e-mails, WhatsApp messages etc.
Under Section 5(2) of the Indian Telegraph Act, agencies at the Centre and states can intercept electronic communication “on the occurrence of any public emergency, or in the interest of the public safety”. The law empowers designated officials to put a device under surveillance on being satisfied that “it is necessary or expedient so to do in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign states or public order or for preventing incitement to the commission of an offence”. Reasons for ordering interception has to be recorded in writing by the officials concerned.
Rule 419A of the Indian Telegraph Rules identifies the officers who can order surveillance of messages. It lays down that a secretary to the Government of India in the ministry of home affairs can pass orders of interception in the case of Centre, and a secretarylevel officer who is in-charge of the home department can issue such directives in the case of a state government. In unavoidable circumstances, Rule 419A adds, such orders may be made by an officer, not below the rank of a joint secretary to the Government of India, who has been duly authorised by the Union home secretary or the state home secretary.
The directions for interception can remain in force for a period not exceeding 60 days from the date of issue and may be renewed upon an approval of the competent authority up to for a total period of 180 days. Records pertaining to interception are to be destroyed every six months unless these are likely to be required for “functional requirements”. The service providers must also destroy records pertaining to directions for interception of message within two months of discontinuance of the interception of such messages.
Rule 419A also prescribes for a review committee, separately at the level of the Centre and states. While the Cabinet Secretary heads the review committee at the Centre, the chief secretary of the concerned state is the chairman of the state review committee. All orders on interception are required to be sent to the review committee within seven working days of such directives. Review committees are obligated to ensure that interception orders are reasoned, proper and justified.
Similarly, Section 69 of the Information Technology Act 2000, together with the Information Technology (Procedure for Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009, authorises the agencies to issue directions for interception or monitoring or decryption of information through any computer resource, including mobile phones.
Section 69 states that interception is permissible “in the interest of the sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence”.
How have constitutional courts viewed the power of surveillance with State?
The first major judgment by the Supreme Court on the issue sur veillance came in 1964. A sevenjudge bench, in Kharak Singh Vs The State of Uttar Pradesh, adjudicated whether a police officer was entitled under the UP Police Regulations to visit any individual’s house for a physical “surveillance” and if such “domiciliary visits at night” violated any fundamental right. The Constitution bench held that such a surveillance was violative of Article 21 (right to life and liberty) of individuals since there was no law under which the said regulation could be Justified. “An unauthorised intrusion into a person’s home and the disturbance caused to him thereby, is as it were the violation of a common law right of a man- an ultimate essential of ordered liberty, if not of the very concept of civilisation,” held the court.
The next case saw a shift from physical surveillance to surveillance through intercepting devices. An important case on interception and the power to do so was instituted in the Supreme Court by NGO People’s Union for Civil Liberties (PUCL) in 1991. PUCL had argued that any order for telephone tapping should be sanctioned by judicial authorities at the Centre and in the states to prevent arbitrary and politically motivated decisions to tap telephones of different people. The NGO challenged the constitutional validity of Section 5(2) of the Indian Telegraph Act. In the alternative, the petition pleaded that the said provisions be suitably read down to include procedural safeguards to rule out arbitrariness and to prevent the indiscriminate telephone tapping.
The Supreme Court, in its judgment in the PUCL case in 1996, held that right to privacy would certainly include telephonic conversation in the privacy of one’s home or office and, “telephone tapping would, thus, infract Article 21 of the Constitution of India unless it is permitted under the procedure established by law.” It ruled that “public emergency” and “interest of public safety” are the precursors to any phone tapping and all interception must arise out of these concerns. The court further noted that there were no rules in vogue to guide such interception and issued a slew of directions on how and when a phone can be tapped, holding “it is necessary to lay down procedural safeguards for the exercise of power”. The court said that the directions issued by it will remain operational till the time the Centre framed suitable rules under the Act. Subsequently, the Centre codified the guidelines in 2007 by engrafting Rule 419A, borrowing from the directions issued by the apex court. However, considering the fact that there was an absence of any provision in the Telegraph Act permitting judicial oversight of phone tapping orders and also the fact that in a similar law in UK — the Interception of the Communications Act, 1985, interception did not require judicial oversight, the Supreme Court did not issue any direction on judicial oversight of interception orders.
Right to privacy Vs Surveillance
Starting from the Kharak Singh case in 1964, the Supreme Court acknowledged the significance of right to privacy whenever the issue of surveillance by a state agency came up. The judgment in Kharak Singh underscored that “nothing is more deleterious to a man’s physical happiness and health than a calculated interference with his privacy”. All the seven judges were unanimous that right to privacy is a part of the right to “protection of life and personal liberty” guaranteed under Article 21.
In R Rajgopal alias RR Gopal and another Vs State of Tamil Nadu (1994), the Supreme Court held that the right to privacy is implicit in the right to life and liberty guaranteed to the citizens of this country by Article 21. The judgment added that it is a “right to be let alone” and every citizen has a right “to safeguard the privacy of his own, his family, marriage, procreation, motherhood, child-bearing and education among other matters”.
Taking a cue from these declarations, the apex court in the PUCL case, too, said that the right to hold a telephone conversation in the privacy of one’s home or office without interference can certainly be claimed as “right to privacy” and there must be a just and fair procedure established by the law to curtail this liberty in the larger public interest.
Meanwhile, in 2010, former chairman of the Tata Group and industrialist Ratan Tata filed a writ petition, alleging violation of his right to privacy following the leak of the Niira Radia tapes. Between 2008 and 2009, the income tax department tapped the phone lines of Nira Radia, a political lobbyist, for almost a year. Subsequently, in 2010, some of the recorded tapes were leaked, resulting in the publication of a small portion of the tapes recorded by the department. These tapes included conversations between Radia and a number of public figures, including politicians, journalists, and business houses. One such public figure was Ratan Tata. Tata’s petition emphasised that the government has no right to intercept telephonic conversations if it did not have a mechanism to protect the privacy of citizens. It sought a probe into the leak and a directive to the authorities to retrieve all leaked recordings. Importantly, Tata did not challenge the right of the government to intercept.
This case had an effective hearing last in August 2013 when the court framed three issues: Right to privacy vis-a-vis the Government; right to privacy visa-vis the Press; and right to know the information. The last time this case got listed was in July 2019 after which it has not come up for a hearing yet.
The judicial debate on the status of the right to privacy was, however, settled in August 2017 when a nine-judge bench held that right to privacy is a fundamental right that will be protected by the constitutional courts in the country. This judgment highlighted that the informational traces are also an area which falls within the realm of the right of privacy and such data is as personal as that of the choice of appearance and apparel. “Telephone tappings and internet hacking by State, of personal data is another area which falls within the realm of privacy,” added the court.
The privacy judgment lays down a four-fold test that needs to be fulfilled before state intervention in the right to privacy: 1) The state action must be sanctioned by law; 2) In a democratic society, there must be a legitimate aim for action; 3) Action must be proportionate to the need for such interference; and 4) It must be subject to procedural guarantees against abuse of the power to interfere.
PROVISIONS IN THE INDIAN TELEGRAPH ACT AND THE IT ACT AUTHORISE THE UNION AND THE STATE GOVERNMENTS TO INTERCEPT ALL TYPES OF ELECTRONIC COMMUNICATION