Beyond Pegasus: The History of Government Surveillance in India

Government opacity and mass surveillance of citizens have led to a sharp decline in democratic institutions in India. While Pegasus targeted high-profile individuals, surveillance in India is conducted in various ways and affects different people differently. There are the “big fish,” the “small fish,” and the “dark mode” — each type of surveillance seriously undermines democracy in the country.

India, the world’s largest formal democracy, is also among the leading surveillance states. Although a rights-based approach once led to the decisive liberalization of the Right to Information Act and made all levels of government accountable, the situation has recently worsened. India has rapidly introduced regulations that have made the government more opaque and enabled the collection of maximum citizen data through CCTV, Aadhaar, and other invasive technologies. In March 2022, the Criminal Procedure (Identification) Act was enacted, allowing police to collect biological and other samples from arrested and convicted individuals.

The collection of information about citizens and the government’s refusal to disclose how it uses this data are in direct contradiction to the principle of accountability. Surveillance in India is so pervasive that it threatens the very foundation of Indian democracy. Digital tools have taken surveillance to an entirely new level, which can be divided into three categories.

Three Types of State Surveillance: “Big Fish,” “Small Fish,” and “Dark Mode”

People and institutions are monitored for different reasons and in different ways. Dividing state surveillance into three types — “big fish,” “small fish,” and “dark mode” — helps us better understand how democratic institutions are being eroded in the country.

Surveillance of the “Big Fish”: Pegasus

Last year’s global investigation, The Pegasus Project, revealed that Israeli cyberweapons (sold only to governments) were widely installed on Indian phones. Its use is not regulated by any Indian law.

The Modi government has never denied using Pegasus. It refused to investigate or testify under oath in court, even in the face of serious allegations. A Supreme Court-appointed three-member committee is currently examining issues that the Supreme Court itself, in its October 27, 2021 order, called “literally Orwellian.”

The investigation found several categories of people under surveillance, including the Election Commissioner (whose phone was hacked during the 2019 elections), political party leaders, and a leading election strategist. Supreme Court judges and their staff (and 11 related devices), including one who accused the then Chief Justice of sexual harassment, were also targeted. The list also included Enforcement Directorate officials, a former CBI chief, numerous independent and high-profile journalists, academics, lawyers, civil society representatives, doctors, and epidemiologists.

Category A: Political Players

State-sponsored hacking has targeted opposition figures, including the main political rival of the Bharatiya Janata Party (BJP) and former Congress president Rahul Gandhi. At least two of Gandhi’s phones and the phones of five people close to him appeared in the leaked Pegasus list. Leading opposition election strategist Prashant Kishor was also targeted. In Karnataka, phones used by senior Janata Dal party members and their aides were likely hacked before the BJP government was overthrown. In Assam, two key political figures who opposed the controversial 2019 Citizenship (Amendment) Act were listed for potential surveillance just before the act was passed. These cases give the ruling party an unfair advantage, undermining the level playing field essential to democracy.

Category B: Independent Institutions

The story of the Election Commissioner, who could have become the next head of the Election Commission of India, is also telling. He was the only one of three commission members to find some of Prime Minister Narendra Modi’s 2019 campaign statements in violation of the model code of conduct. The journalist who reported on the commissioner’s objections and a member of a prominent election monitoring organization were also surveilled.

Despite India’s declining rankings in global democracy indices, the country could still claim to have held “free and fair” elections. But how free and fair can they be if the Election Commissioner, a journalist covering the Election Commission, and an independent watchdog are all under invasive surveillance?

The former Chief Justice, accused of sexual harassment by a staff member, led the commission that dismissed all claims. The Pegasus list includes 11 phone numbers belonging to the staff member’s family, raising questions about the independence of the judiciary. The accused judge ruled on several important cases after the harassment case was closed and was later appointed to the Rajya Sabha (the upper house of India’s Parliament).

Similarly, the then CBI chief, his deputy, and their family members appeared in the Pegasus list soon after they attempted to act independently, raising concerns about the independence of investigative agencies.

All of this not only creates an uneven playing field but also leaves open the question of how much private information the state may have accumulated about these individuals, enabling blackmail, intimidation, and attacks on those leading so-called independent institutions whose job is to safeguard democracy. Supreme Court judges and election commissions are likely to become very vulnerable.

Category C: Independent Journalists, Academics, Human Rights Defenders, and Civil Society

Moroccan historian Maati Monjib was targeted by Pegasus. After monitoring his private life for over a year, armed intelligence agents raided his home at 9 a.m. and “caught him with his girlfriend in the bedroom. They stripped him naked and arrested him for ‘adultery,’ which is a crime in Morocco. He spent 10 months in Casablanca prison.”

Another example: Azerbaijani journalist Khadija Ismayilova’s reputation was destroyed by intimate photos obtained through surveillance. Both cases show how the state can influence free journalism by invading journalists’ private lives. Independent journalism and civil society are vital nodes of democracy, connecting with the people. But when people like Gagandip King and heads of leading NGOs are under surveillance, the misuse of information harms them and democracy as a whole.

Surveillance of civil society, journalists, and academics gives the state excessive power over them. The information obtained can be used to harm, blackmail, threaten, or silence them. Systematic and widespread surveillance of the “big fish” destroys institutional independence in any democracy, including India’s.

Surveillance of Millions of “Small Fish”

Delhi boasts 275,000 CCTV cameras — more than any other city in the world, including London, Singapore, and Paris. Amnesty International has already reported on the use of facial recognition technology without proper legal frameworks in Telangana. But CCTV is just the beginning of “small fish” surveillance in India.

It is now common knowledge that Big Tech tracks ordinary citizens and collects all kinds of user data: opinions, political and sexual orientation, location, strengths, and weaknesses. People may underestimate the situation and not realize that someone knows when they ordered pizza, called a cab, met with a lawyer, traveled, or went for a morning walk. But mass data collection on the “small fish” allows “data vultures” to study, understand, segment, and ultimately manipulate people with polarizing and hateful messages. For example, personalized political ads on social media like Facebook in Myanmar led to deep societal divisions.

As Professor Carissa Véliz notes, protecting the privacy of the “small fish” is crucial; otherwise, data collectors can abuse the information, manipulate, and ultimately distort democratic values.

Imagine the government making deals with such companies, allowing them to profit in exchange for access to this vast data set. The authorities gain the ability to manipulate on unprecedented and unimaginable scales. For example, the Reporters’ Collective recently wrote that during the 2019 elections, Facebook charged the BJP less for campaign ads, effectively giving the BJP access to a wider voter base for less money and influencing the election outcome.

In India, we see the ruling party controlling Big Tech with both a carrot and a stick. Strict digital rules combined with special arrangements ensure these companies toe the line. The lack of government response to whistleblowers like Sophie Zhang or Frances Haugen, unlike in Europe or even the U.S., suggests that India’s ruling party finds Silicon Valley’s violations useful in some ways.

The Draft Data Protection Bill, presented by a Joint Parliamentary Committee, gives 10 government agencies the right to decrypt, monitor, and intercept data on any computer (with approval from the Home Minister). If service providers do not offer interception options, they could face up to seven years in prison!

There is nothing optimistic about “small fish” surveillance. All of this combined undermines citizens’ privacy and enables the collection of massive amounts of data. Datasets jointly collected by business and government have terrifying potential to manipulate democratic institutions.

Surveillance in “Dark Mode”

The Bhima Koregaon case has become the largest of its kind in recent years. Fifteen writers, lawyers, dissidents, and priests have served long prison terms without proper trial. What do several prisoners and their lawyers have in common? Surveillance via Pegasus before their arrest.

Another well-known case is that of Delhi activist Rona Wilson. In February 2021, The Washington Post reported that American digital forensics firm Arsenal found ten emails on Wilson’s laptop that she had never opened. One of these discussed an alleged plot to assassinate Prime Minister Modi. Arsenal’s latest report says 22 additional documents were also delivered to the computer by the same attacker. These 32 documents are now cited by law enforcement as evidence that a group of activists accused of collaborating with a banned Maoist militant group allegedly participated in a rebellion against the Indian state.

Rona Wilson was also on the Pegasus list. The case of planted evidence is still in court, and Wilson remains in prison. There is no way to know who planted the documents, as the investigation is not complete. But it is precisely on the basis of these 32 documents found on her computer that Wilson was charged.

This is best described as “dark mode” surveillance, as little is known about who planted the evidence. Whoever did it ultimately helped the government imprison activists for years — people whose job is to support democracy and draw attention to rights violations.

India Is Becoming a Surveillance State

Much is said about surveillance and the firewall in China or the NSA in the U.S., but few realize how quickly the net is closing in on Indian citizens.

British research firm Comparitech found that out of 47 countries, India ranks behind only Russia and China in terms of surveillance.

While citizens remain unaware, the authorities have launched a complex and sophisticated system of surveillance and data collection that could soon make the current government permanent. Data is power, and the capture of both big and small fish, with periodic use of dark mode, only accelerates the destruction of Indian democracy.