The WhatsApp-Pegasus scandal: India must now reform its surveillance law
Last week, it was revealed that Israeli software, Pegasus, had been used to hack the WhatsApp accounts of — and spy on — numerous Indian human rights defenders, activists, and lawyers. It is yet to be determined who authorised this surveillance — and why — but the revelations placed a renewed spotlight upon the legal framework governing privacy and surveillance in India. In this context, a judgment by the Bombay High Court — delivered just a few days before the Pegasus scandal broke — restated some important and fundamental principles, and deserves to be studied carefully.
In Vinit Kumar v Central Bureau of Investigation (CBI), the CBI had placed a businessman under surveillance, on suspicion of corruption. The surveillance orders were challenged in the Bombay High Court, and a twojudge bench of Justices R More and N Jamdar found that they were illegal and unconstitutional. The basis of the high court’s ruling was that under the 1885 Telegraph Act (and its accompanying rules), surveillance was not meant to be a routine or ordinary investigation tactic. It was limited to situations of “public emergency” or “public safety”.
There was clearly no emergency, and “public safety” meant “the state or condition of freedom from danger or risk for the people at large” — or, in other words, a social threat that existed on some scale. There were also a number of procedural safeguards that were required to be fulfilled (such as the approval of a high-level government official). The high court found that the CBI had failed to justify how public safety required keeping the businessman under surveillance, and also found that procedural safeguards had not been complied with. For this reason, the surveillance orders were quashed.
After reaching this finding, the high court drew two further — important — conclusions.
First, it held that if interception was illegal, then copies of the intercepted material had to be destroyed. Second — and more important — the high court held that the evidence that had been obtained through illegal surveillance could not be used by the CBI in court.
The reason for this was that illegal surveillance amounted to a breach of the fundamental right of privacy; and as unconstitutional methods had been used to collect the said evidence, they could not then be used against the very person whose constitutional rights had been breached.
A significant part of the high court’s ruling was based upon the famous Puttaswamy judgment of the Supreme Court, where a nine-judge bench held that privacy was a fundamental right under the Constitution; the reasoning in the Puttaswamy judgment heralded a revival of a rights-oriented constitutionalism, where the individual was placed at the centre of the constitutional scheme — especially when it came to the question of limiting arbitrary and unaccountable State power.
At a time where a large amount of surveillance takes place extra-legally — as the Pegasus affair shows — laws, the rule of law, and courts will never by themselves be enough to protect and vindicate the right to privacy against State intrusion.
For that, conscientious whistleblowers, and a free and active press will be required. However, the Bombay High Court’s excellent judgment shows us that when cases of extra-legal and unauthorised surveillance come to light, the courts have a role to play in ensuring that the rule of law is upheld and vindicated, and — most important — that the State is not permitted to take advantage of breaking the law and illegally snooping on citizens.
In that context, it is also important to note that the law itself ought to be reformed. The legal framework for surveillance remains the antiquated 1885 Telegraph Act, and its attendant rules.
Disappointingly, the data protection bill that is presently pending before the Union Cabinet makes no mention of surveillance reform. It is the urgent need of the hour to bring in laws that limit the State’s powers of surveillance only to those situations where it is strictly necessary (and never conducted in bulk, upon the entire population) — and more important, introduce stringent penalties for illegal surveillance, if — and when — that comes to light. The WhatsApp-Pegasus controversy affords a golden opportunity to do just that.