In India, the Personal Data Protection (PDP) Bill 2018 is yet to be tabled in the Parliament. Till then the victims, lawyers, and other stakeholders have to fall back on the Information Technology Act, 2000 (IT Act) and their interpretation of privacy. The IT Act though not as exhaustive as the PDP Bill will cover the issue to a moderate extent. Justice KS Puttaswamy had already given a landmark judgement which holds that the right to privacy is protected as a fundamental constitutional right under Articles 14, 19 and 21 of the Constitution of India. Further the nine-judge bench also unanimously held that “the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution”.
The snooping incident
An Israel-based NSO Group Program and their software Pegasus used WhatsApp for digital surveillance on more than 1,400 people in about 20 countries including India. It is still not clear who had hired the services of NSO Group to snoop on these people. WhatsApp has subsequently filed a lawsuit in the federal courts in the US. The petition claimed that the Israeli cybersurveillance firm NSO Group used WhatsApp to target journalists and human-rights advocates. The victims were mainly from Mexico, Bahrain, the UAE and India. Now even the Indian politicians claim that they have been victims of the snooping incident.
These type of cybersurveillance companies are present in large numbers and they target their victims through the innocent-looking apps and mobiles. Cybersurveillance is a fairly unregulated market. This lawsuit may see a direction to end such type of surveillance present across the geography.
IT Act
Section 70B of the IT Act states that the government will set up an Indian Computer Emergency Response Team (Government Team). This Government Team will collect analysis and dissemination of information of cyber incidents, will forecast alerts of cyber security incidents, emergency measures for handling cyber security incidents and coordination of cyber incident response activities. The Government Team may also under the law, issue white papers, guidelines, relating to information security practices, procedures, prevention, response and reporting cyber incidents.
WhatsApp and Government Team
The Indian government accused WhatsApp for not disclosing to Indian authorities the details of the surveillance incident happened through WhatsApp. Countering Indian authorities, WhatsApp said it had in May 2019 notified Indian authorities about the security issue. The Indian authorities further claim that WhatsApp had not mentioned that Indian citizens had also been affected by such security breach. WhatsApp had not disclosed about Pegasus breaching the security of a few targeted Indians. Indian authorities were aware of Indian citizens also being the victims only after WhatsApp filed the lawsuit.
WhatsApp and IT Act
Section 70B of the IT Act states that the Government Team should be immediately informed of any security incident. WhatsApp though met the Government Team, failed to inform about the security breach on targeted Indian activists and human-right advocates.
The Modus Operandi
It was not easy to detect that the phones had been hacked. Whoever used NSO Group software to hack phones had to place a call to their targeted victim. Even if the target did not pick up the phone, NSO's software Pegasus would get embedded in the phone and will provide the access to the contents of the phone to the owner of Pegasus. One such missed call to a London-based lawyer had tipped off the lawyer and he was able to identify the digital surveillance software Pegasus in his phone.
WhatsApp had claimed that it had informed all the affected victims of the security incident. Further WhatsApp is seeking permanent injunction against NSO Group and Pegasus. The NSO Group had countered that Pegasus was used only by intelligence and law enforcement agencies in lawful anti-terrorism efforts and crime fighting. It was never used for vindictive or personal reasons. In fact, NSO Group further claimed that their software, Pegasus had helped save thousands of lives in the recent years.
NSO Group had also said that it limits the sale of this cybersurveillance software Pegasus to governments with poor human-rights records. However, it was quick to add that it had little records of how its tools were used once they are in the hands of governments. The NSO Group said that it comes to their knowledge that the software had been abused only when or if the information surfaces in the media. Otherwise NSO group had little knowledge on the usage pattern of the cybersurveillance software - Pegasus.
Whatever the result, this lawsuit will draw attention to cybersurveillance and privacy issues. There will be better moderation and control of such cybersurveillance software in the interest of innocent users. This will further result in detailed investigation into the case.
K Satish Kumar, is a keynote speaker, author, the Global Head of Legal and Chief Data Protection Officer of Ramco Systems. Among the many awards he has received, the coveted are ‘Top 50 Legal Leaders 2019’ by Legal IP Gorilla in Singapore, ‘GC PowerList India 2018’ by London-based Legal 500 and ‘Legal Counsel of the Year -2018’ by INBA. He is actively involved in many pro bono activities through Chennai Lawyers. The author can be reached at getksk@gmail.com. The views expressed are personal.
Check out our in-depth Market Coverage, Business News & get real-time Stock Market Updates on CNBC-TV18. Also, Watch our channels CNBC-TV18, CNBC Awaaz and CNBC Bajar Live on-the-go!
Odisha's new CM — who is Mohan Charan Majhi and what prompted the BJP to choose him
Jun 13, 2024 2:54 PM
Election 2024: 504 out of 543 newly-elected MPs are ‘crorepatis’ – Check 10 richest members in 18th Lok Sabha
Jun 12, 2024 9:55 PM
BJP to start nationwide organisational rejig, new party president to be elected soon
Jun 12, 2024 9:31 AM
New Lok Sabha Speaker to be elected in special 8-day session: Report
Jun 11, 2024 6:28 PM