A coalition of international advocacy and rights groups, including Access Now, International Commission of Jurists, Electronic Privacy Information Center, Electronic Frontier Foundation, PEN America, Center for Democracy and Technology, Civicus, Freedom House, Privacy International, Association for Progressive Communications, and Human Rights Watch, has called for a prompt and thorough investigation into the alleged use by Indian authorities of advanced spyware against activists and critics. The groups have also advocated for extensive reforms to establish judicial and parliamentary oversight of government surveillance activities, aligning with global privacy and civil liberties standards.
This call to action coincides with the fourth anniversary of the Puttaswamy v. Union of India ruling by the Indian Supreme Court, which affirmed privacy as a fundamental right under the Indian Constitution. Despite this ruling, there have been reports suggesting that the Indian government has utilized national security justifications to sidestep concerns over privacy breaches.
In July, The Wire, participating in the international Pegasus project, reported the presence of over 300 Indian phone numbers on a leaked list of 50,000. These numbers allegedly belong to a range of individuals, including human rights activists and opposition figures, suggesting potential surveillance activity in multiple countries, including India. NSO Group, the Israeli firm behind the Pegasus spyware, contends that its sales are restricted to authorized government bodies.
Amnesty International’s forensic analysis detected signs of Pegasus spyware on several devices, some of which are linked to Indian nationals. The spyware could potentially allow government agencies to extensively monitor the activities on an infected smartphone. NSO Group has disputed the allegations arising from the Pegasus project’s reports, and no retractions have been made by the investigative partners.
The Indian government has not confirmed the use of Pegasus and maintains that appropriate safeguards against unauthorized surveillance are in place. However, efforts to investigate the allegations have met with governmental delay.
These surveillance allegations emerge amidst reported governmental pressures on free speech and assembly, and the enforcement of the 2021 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, which are said to offer the government greater oversight over online content.
The groups emphasize that surveillance measures must be lawful, necessary, and proportionate, in line with international human rights standards and the Indian Supreme Court’s observations. The alleged use of Pegasus spyware is seen as a contravention of privacy rights, potentially affecting personal security and freedom of expression.
The Indian government’s response to Supreme Court petitions regarding Pegasus cites national security concerns and proposes a government-appointed expert committee review rather than an independent inquiry. The advocacy groups argue that an effective remedy for rights violations requires an independent body with full investigative powers.
India’s surveillance legal framework, primarily based on the 1885 Telegraph Act and the 2000 Information Technology Act, is said to lack adequate checks, independent oversight, and accountability. Surveillance orders, according to past Supreme Court decisions, should only be issued when essential and no alternatives exist, yet this principle appears inadequately enforced.
The proposed Personal Data Protection Bill, aiming to enhance state surveillance powers, has been critiqued for its broad exemptions for government agencies. The groups suggest that the bill should be revised to limit government discretion and incorporate case-by-case judicial authorization for data access and surveillance.
In light of the Supreme Court’s privacy ruling and the Pegasus disclosures, the advocacy groups assert that comprehensive surveillance reform is imperative in India, stressing the need for judicial oversight, remedial measures, and a data protection framework that upholds individual rights.
