India is shopping for a new spyware technology after it was revealed that government agencies misused Pegasus. Only if the people take to the streets can there be oversight of these agencies.
Illustration: The Wire
India is rapidly digitising. There are good things and bad, speed-bumps on the way and caveats to be mindful of. The weekly column Terminal focuses on all that is connected and is not – on digital issues, policy, ideas and themes dominating the conversation in India and the world.
Last week, the Financial Times disclosed that the Indian government is making fresh efforts to procure spyware that has a lower footprint than NSO Group’s Pegasus to continue its surveillance of dissenters, opposition leaders and human rights activists. The report claimed that the ability of human rights actors and tech companies to identify and notify users about nation-state surveillance activities has become a point of concern for Indian authorities. The defence department is expected to soon issue a tender and is willing to spend as high as Rs 1,000 crore on acquiring surveillance technologies.
The entities that are expected to lead the bidding process include Quadream, Intellexa and Cognyte. Of these three companies, Cognyte has already been engaging with several law enforcement officials. One such instance was at DIGIPOL 2023, a law enforcement-only conference, in which the National Cyber Security Coordinator, the director of DRDO and several others participated.
Cognyte has been known to abuse human rights and has been identified by Meta in their 2021 report as part of the “surveillance-for-hire” industry. Meta suspended 100 accounts on Facebook and Instagram belonging to Cognyte which were being used for surveillance of journalists and political opposition in various countries. Can such a company be allowed to operate as an agent of the Indian government for any activity against Indians?
Given Israel’s history of exporting these technologies, it is not surprising that many Israel-based companies are interested in promoting their surveillance tools to Indian security agencies. But what is of concern is the secrecy with which the Indian government agencies conduct surveillance and the lack of oversight of their operations. This is where the United States succeeded to a considerable extent and was able to exert oversight through the Senate Intelligence Committee. The US has imposed sanctions on the NSO Group for the use of Pegasus to target American citizens.
The US was able to contain intelligence agencies and covert surveillance by the government in the aftermath of the infamous Watergate scandal. This success may be harder in the Indian context. In the US, not just the courts but ordinary citizens also held Richard Nixon accountable for Watergate. The social movements which fought for civil rights from the 1950s to the 70s in the US ensured that the misuse of intelligence agencies under Nixon was controlled through oversight after his presidency, even if not during. There are no people on the street demanding similar oversight in India. The Indian press has also failed to make Indians understand the importance of the misuse of Pegasus spyware to target the opposition and civil society.
Even though Indians have a fundamental right to privacy, courts have not stepped up to protect them. If not everyone who was targeted with Pegasus, at least the people who have been arrested as part of the Elgar Parishad case deserve larger attention. It has been established that malware was used to plant incriminating files on their computers, yet the delays in our criminal justice system ensure that the matter is pending long enough, even though one accused person died in custody.
The system is unlikely to change anytime soon. And it has no incentive to unless people take to the streets about unauthorised surveillance. The new draft data protection Bill is will be a rubber stamp in the hands of government agencies, giving them wide powers for surveillance to protect national security. It will not demand accountability from them.
Like police reforms, surveillance reform is likely to remain a talking point. Even if a law does get passed to control the use of surveillance technologies by the police, it may be harder to get it implemented because the police routinely get away with human rights violations like custodial death and torture.
As long as there is a need for surveillance, the surveillance industry will survive – irrespective of what courts in India rule or Bills parliament passes. In the backdrop of Watergate in the US, it was not just the Frank Church committee that pushed for control of the spy agencies but normal people who pushed back and invested in technologies to evade them. The story of public key encryption and the proliferation of encryption was a direct pushback by the people against the surveillance setup in the US. It is time people in India increase their understanding of surveillance technologies and learn to evade at least some of them.
Srinivas Kodali is a researcher on digitisation and hacktivist.