Follow real-time updates on Union Budget 2023Catch exclusive videos on Union Budget 2023 from CNBC-TV18
This lawsuit will draw attention to cybersurveillance and privacy issues. There will be better moderation and control of such cybersurveillance software in the interest of innocent users.
In India, the Personal Data Protection (PDP) Bill 2018 is yet to be tabled in the Parliament. Till then the victims, lawyers, and other stakeholders have to fall back on the Information Technology Act, 2000 (IT Act) and their interpretation of privacy. The IT Act though not as exhaustive as the PDP Bill will cover the issue to a moderate extent. Justice KS Puttaswamy had already given a landmark judgement which holds that the right to privacy is protected as a fundamental constitutional right under Articles 14, 19 and 21 of the Constitution of India. Further the nine-judge bench also unanimously held that “the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution”.
Recommended ArticlesView All
India’s external affairs minister lists 10 reasons the world should take note — Budget 2023
Feb 2, 2023 IST2 Min(s) Read
The A to Z of FM Sitharaman's Budget 2023 — alphabetically yours
Feb 1, 2023 IST6 Min(s) Read
Nirmala Sitharaman’s big capex push a welcome step, but funding could prove a challenge
Feb 1, 2023 IST3 Min(s) Read
Old vs new tax regime after Budget 2023 — Check which is better for you
Feb 1, 2023 IST4 Min(s) Read
The snooping incident
An Israel-based NSO Group Program and their software Pegasus used WhatsApp for digital surveillance on more than 1,400 people in about 20 countries including India. It is still not clear who had hired the services of NSO Group to snoop on these people. WhatsApp has subsequently filed a lawsuit in the federal courts in the US. The petition claimed that the Israeli cybersurveillance firm NSO Group used WhatsApp to target journalists and human-rights advocates. The victims were mainly from Mexico, Bahrain, the UAE and India. Now even the Indian politicians claim that they have been victims of the snooping incident.
These type of cybersurveillance companies are present in large numbers and they target their victims through the innocent-looking apps and mobiles. Cybersurveillance is a fairly unregulated market. This lawsuit may see a direction to end such type of surveillance present across the geography.
Section 70B of the IT Act states that the government will set up an Indian Computer Emergency Response Team (Government Team). This Government Team will collect analysis and dissemination of information of cyber incidents, will forecast alerts of cyber security incidents, emergency measures for handling cyber security incidents and coordination of cyber incident response activities. The Government Team may also under the law, issue white papers, guidelines, relating to information security practices, procedures, prevention, response and reporting cyber incidents.
WhatsApp and Government Team
The Indian government accused WhatsApp for not disclosing to Indian authorities the details of the surveillance incident happened through WhatsApp. Countering Indian authorities, WhatsApp said it had in May 2019 notified Indian authorities about the security issue. The Indian authorities further claim that WhatsApp had not mentioned that Indian citizens had also been affected by such security breach. WhatsApp had not disclosed about Pegasus breaching the security of a few targeted Indians. Indian authorities were aware of Indian citizens also being the victims only after WhatsApp filed the lawsuit.
WhatsApp and IT Act
Section 70B of the IT Act states that the Government Team should be immediately informed of any security incident. WhatsApp though met the Government Team, failed to inform about the security breach on targeted Indian activists and human-right advocates.
The Modus Operandi
It was not easy to detect that the phones had been hacked. Whoever used NSO Group software to hack phones had to place a call to their targeted victim. Even if the target did not pick up the phone, NSO's software Pegasus would get embedded in the phone and will provide the access to the contents of the phone to the owner of Pegasus. One such missed call to a London-based lawyer had tipped off the lawyer and he was able to identify the digital surveillance software Pegasus in his phone.
WhatsApp had claimed that it had informed all the affected victims of the security incident. Further WhatsApp is seeking permanent injunction against NSO Group and Pegasus. The NSO Group had countered that Pegasus was used only by intelligence and law enforcement agencies in lawful anti-terrorism efforts and crime fighting. It was never used for vindictive or personal reasons. In fact, NSO Group further claimed that their software, Pegasus had helped save thousands of lives in the recent years.
NSO Group had also said that it limits the sale of this cybersurveillance software Pegasus to governments with poor human-rights records. However, it was quick to add that it had little records of how its tools were used once they are in the hands of governments. The NSO Group said that it comes to their knowledge that the software had been abused only when or if the information surfaces in the media. Otherwise NSO group had little knowledge on the usage pattern of the cybersurveillance software - Pegasus.
Whatever the result, this lawsuit will draw attention to cybersurveillance and privacy issues. There will be better moderation and control of such cybersurveillance software in the interest of innocent users. This will further result in detailed investigation into the case.
K Satish Kumar, is a keynote speaker, author, the Global Head of Legal and Chief Data Protection Officer of Ramco Systems. Among the many awards he has received, the coveted are ‘Top 50 Legal Leaders 2019’ by Legal IP Gorilla in Singapore, ‘GC PowerList India 2018’ by London-based Legal 500 and ‘Legal Counsel of the Year -2018’ by INBA. He is actively involved in many pro bono activities through Chennai Lawyers. The author can be reached at email@example.com. The views expressed are personal.