Beyond Pegasus: The Story of State Surveillance in India

This story is a part of EVM: Every Vote Matters, a series in collaboration with the One Vote Project. Read the first story here.

India’s sharp democratic decline has been a global story.

Despite multiple indices indicating this decline, there has been one significant facet that has escaped scrutiny. India, the world’s largest democracy, is also among the biggest surveillance states. While a ‘rights-based’ approach led to the radically liberating Right to Information Act that held all levels of the government accountable, things have taken a turn for the worse in recent times. India has sharply moved towards norms that have ensured opacity of government, but maximalist demands of data from its citizens via CCTVs, Aadhaar, and more intrusive means. In March 2022, The Criminal Procedure (Identification) Act was introduced and allows police officers to collect biological samples and other identity markers from an arrested or convicted person.

Stripping citizens clean of their data and information in multiple ways—while at the same time refusing to declare how the government conducts itself or uses said citizen data that is ruthlessly mopped up—is a complete inversion of the accountability principle. Surveillance in India is complex, to such an extent that the data and information available to governments have made India’s democracy vulnerable. It is believed that East Germany’s dreaded Stasi had access to 1/3rd of the people via spies and physical surveillance. But with digital tools at work, surveillance possibilities are at another level altogether, albeit identifiable in three broad ways.

Not every citizen or institution is surveilled in the same manner, or for the same reasons. Therefore, categorising government surveillance into ‘Big Fish’, ‘Small Fish’, and ‘Dark Modes’ can help outline how each type of surveillance seriously damages democracy.

‘Big Fish’ Surveillance – the likes of Pegasus

The massive prevalence of Pegasus infections on Indian phones unearthed by a global investigation called ‘The Pegasus Project’ last year revealed how Israeli cyber weaponry (sold only to governments) was deployed on Indian phones. The use of such weaponry is not regulated by any existing law in India.

The Modi government has never denied that it used Pegasus. It has refused to investigate or give an affidavit in Court in the face of serious charges. A Supreme Court-appointed three-member committee is looking into concerns, which the top court itself has termed ‘Orwellian’ in its Order dated 27 October 2021.

There are several categories of people under surveillance, as unearthed by The Pegasus Project. It is important to try and assess how surveilling each of these ‘big fish’ classes of characters may have damaged democracy. An Election Commissioner’s phone is said to have been hacked during election time in 2019. Top heads of political parties and a top election strategist too were. A Supreme Court Judge plus eleven phones linked to a staffer who made allegations of sexual harassment against the then-Chief Justice are meant to have been hacked via Pegasus. The snoop list included Enforcement Directorate Officers and the former head of the Central Bureau of Investigation (CBI), each responsible for monitoring sensitive investigations, and a host of independent and senior journalists, academics, lawyers, members of civil society, doctors, and epidemiologists.

Category A) Political players

Opposition figures might have been the victim of state-sponsored hacking. This includes the principal political opponent of the BJP, former Congress party president Rahul Gandhi. At least two of Gandhi’s phones and those of five others in his social circle, who are not in public life, were on the snoop list. A leading Opposition election strategist, Prashant Kishore, was also on the Pegasus radar. In Karnataka, phones used by senior members of the Janata Dal(S)-Congress government and their aides were likely hacked ahead of the BJP’s toppling of the government there. In Assam, two important political figures who opposed the controversial Citizenship (Amendment) Act 2019 had their numbers on the list for potential use by the Israeli spyware just before the Amendment Act was passed in December 2019. This has the direct effect of destroying the level playing field, which is the basis of democracy. Each of the above instances gives the ruling party asymmetrical amounts of information.

Category B) Independent institutions

The story of the election commissioner on the snoop list, who at the time was on course to be the next Chief of the Election Commission of India, is an interesting one. He was the only one of the three on the commission who found certain statements by Prime Minister Narendra Modi during the 2019 general election campaign as violative of the model code of conduct. The journalist who reported on the commissioner’s objections and a member of the prominent election watchdog were also among those surveilled.

The one thing India could claim even as its rank dipped in global indices of democracy, was that it conducted ‘free and fair’ elections. But how free and fair could elections be if an election commissioner, a journalist reporting on the Election Commission of India, and an independent watchdog are under such invasive surveillance?

When a former Chief Justice was accused of sexual harassment by a staffer, he himself headed the panel that rubbished the claims. With the Pegasus list including 11 cell phone numbers of the family of the complainant staffer, not only does it raise questions about that case, but the jury is out on how ‘independent’ the judiciary was when this particular chief justice decided several crucial cases after the sexual harassment case was buried. Facing no consequences whatsoever, this former Chief Justice also went on to be nominated as an MP in the Rajya Sabha.

Similarly, the then-head of the Central Bureau of Investigation and his deputy found themselves on the Pegasus list shortly after the head was seen to be displaying independence. This begs the question of the independence of the investigative agency, given the possible pressure these individuals were under, especially considering that their family members were also on the list.

All this not only destroys the level playing field but leaves open the question about how much private information the State could amass on these persons, allowing them to blackmail, bully and target those heading so-called independent institutions whose job it is to preserve democracy; Supreme Court judges and Election Commissioners are likely to be rendered very vulnerable and pushed to compromise if the State has collected so much surveillance data on them.

Category C) Independent journalists, academics, NGOs and other civil society

Moroccan historian Maati Monjib was targeted using Pegasus. Gathering enough evidence about his private life for over a year, armed intelligence agents raided his home at 9 am one morning, “finding him and a female friend in his bedroom together. They stripped him naked and arrested him for ‘adultery’, which is a crime in Morocco. He spent 10 months in a Casablanca prison”. Or, consider the life of the Azerbaijani journalist Khadija Ismayilova, whose reputation was destroyed because of intimate photos that were procured via surveillance. Both these instances reflect the State’s ability to impact free journalism through surveilling the personal lives of journalists.  Independent journalists and civil society are vital nodes of democracy for grassroots advocacy. But if people like Gagandeep Kang and the heads of top NGOs are under surveillance, the misuse of the information obtained by surveillance harms them and hurts democracy too.

Snooping over civil society, journalists, and academics gives the State inordinate power over these people. It gives them information to potentially harm, blackmail, threaten, pre-empt, and chill them into not speaking and working. All in all, systematic and such a widespread net of surveillance of the ‘big fish’ in any democracy, destroys institutional independence, which is the bedrock of Indian democracy.

The Surveillance of Millions of ‘Small Fish’

Delhi boasts of 2,75,000 CCTVs, the maximum number in any city in the world, beating London, Singapore and Paris. In Telangana, Amnesty International has already flagged the blatant misuse that facial technology use without an appropriate legal architecture could do to citizens’ rights. But CCTVs are only the beginning of ‘small fish’ surveillance in India.

It is a well-established fact by this time that Big Tech surveils and snoops on ordinary citizens, and gathers all kinds of data on its users. This includes their views, location, political and sexual orientation, and weaknesses and strengths. So individuals may devalue themselves and think nothing of someone knowing when they ordered a pizza, hailed a taxi, saw a lawyer, took a trip, or went for a morning walk. But the mass gathering of this data of the proverbial ‘small fish’ allows the data vultures to study, understand, slice and dice, and eventually manipulate and control those people through polarised and divided messaging. This has been seen in personalised political advertisements on social media like Facebook in Myanmar, all with the consequence of deeply damaging and dividing society.

As Professor Carissa Veliz points out, protecting the privacy of ‘small fish’ is critical, and not doing so allows data collectors to misuse the information. The disproportionate knowledge is then used to manipulate the giver of the data herself and ultimately distort democracy, as elucidated below.

Now, imagine if a government were to strike a deal with such companies- letting them make money and in exchange, providing access to this large data set to snoop on ordinary citizens. This allows the government to manipulate democracy at an unprecedented and unimaginable scale. For example, a recent exposé by The Reporters Collective revealed that during the 2019 elections, Facebook charged BJP a lower rate for running its campaign ads. This effectively allowed the BJP access to a wider voter base for lesser money, thereby impacting the fairness of elections.

In India, we are seeing the servitude of big tech at the behest of the ruling party, through a carrot and stick approach. Tough digital rules coupled with special concessions ensure that these companies toe the line. The Centre’s refusal to bat an eyelid on whistle-blowers like Sophie Zhang or Frances Haugen is unlike the reaction in Europe or even the US, leaving enough room to believe that India’s ruling party finds it rewarding in some way to be indifferent to transgressions in the Silicon Valley. 

Also Read: The Hidden Costs of Linking Aadhaar and Voter IDs

The Draft Data Protection Bill introduced by the Joint Parliamentary Committee empowers 10 government agencies to authorise to decrypt, monitor, and intercept data on any computer (subject to the approval of the home secretary).  If the service providers fail to offer intercept capabilities, they could face prison terms of up to seven years!

There is nothing sanguine about ‘small fish’ surveillance. It all adds up to damaging citizens’ privacy and enabling the gathering of massive amounts of data. The partnership of massive amounts of government-gathered data with Big Tech is a nightmare and has the potential to manipulate and control democracy.

‘Dark Mode’ Surveillance and Incarceration

The Bhima-Koregaon Case has been the biggest canary in the coalmine for India’s democracy in the past few years. Fifteen authors, lawyers, dissenters, and priests have served long jail sentences without the trial even properly taking off.  What do several of those incarcerated and their lawyers have in common? Charges of surveillance via Pegasus before their arrests.

Further still, consider the case of the Delhi-based activist, Rona Wilson. The Washington Post reported in February 2021, that an analysis by Arsenal, a US-based digital forensics firm, found that ten letters had been deposited on Wilson’s laptop, all of which remained unopened by him. One of these letters discussed an alleged plot to assassinate PM Modi. The latest report by Arsenal finds that 22 additional documents were also delivered to the computer by the same attacker. These exact documents — now totalling 32 — have been cited by law enforcement as evidence against a group of activists accused of working with a banned Maoist militant group that has allegedly engaged in an insurgency against the Indian state.

Rona Wilson was also on the Pegasus list. The matter of the planted evidence is still in court and Wilson is still in jail. There is no way of knowing yet who could have planted the documents because no investigation has been completed into the matter. But it is on the basis of these 32 or so documents that were planted on the computer, charges were levied on Wilson.

This is best termed ‘dark-mode’ surveillance, as so little is known about who has been planting evidence. Whoever did so, eventually helped the government put away activists for long years, behind bars. Activists, whose business it is to keep democracies alive by calling out any diminishing freedoms that they may spot.

Saving India From a Surveillance State

Much is said about the surveillance state and firewall that China has put in place or the excessive surveillance that the National Security Agency (NSA) has done of US citizens. But there is little understanding of how quickly the net is closing in on Indian citizens. In fact, the UK-based research firm Compritech has found that of 47 countries, India country ranks behind only Russia and China when it comes to surveilling citizens.  Unless citizens are able to quickly join the dots, the government initiated an elaborate and sophisticated system of surveillance and data-mopping will soon render the government in office a permanent one. Data is power, and grabbing too much of it, by putting the big and the small fish all under the gaze, with an occasional touch of the ‘dark-mode’ can only hasten the process of lights going out very quickly on Indian democracy.

Featured image of a surveillance camera by Hugh D’Andrade from Electronic Frontier Foundation.