How India surveils its citizens

After years of small-scale and targeted surveillance, the government is gearing up to mine big data from its citizens. At the core of its plan are intelligence agencies that operate with zero non-executive oversight.

Josy Joseph wasn't too surprised when he heard about the Pegasus revelations in July. The veteran journalist and author, who has covered military and national security agencies for three decades, had long known of their surreptitious ways of intelligence gathering. At times, he was at the receiving end himself.

In 2005, Joseph uncovered an elaborate operation on how national secrets were being smuggled out of a top-secret naval war room in New Delhi. His reports led to an overhaul of the security systems in military installations. But while he was working on the story, he noticed he was being trailed by naval intelligence vehicles.

"Those days, it used to be physical," says Joseph. "They'd stay outside your house and keep a note on movements." He had an ingenious way to get rid of the tail. "I'd come home to my daughter and wife at night and we'd switch off the lights. The agencies [personnel] would go away assuming we'd slept. Ultimately, they're government babus. Then I'd come down and take my car and meet my source at a paan shop."

If he was in the UK, Joseph could've complained to the Investigatory Powers Tribunal. This independent court is authorized to protect British citizens from unlawful intrusion by public bodies, including the state police and intelligence agencies. The rules in the UK also mandate that the people under surveillance are informed of it after its conclusion. But intelligence agencies in India are neither under any non-executive oversight, nor are they covered by the Right to Information (RTI) Act (except in cases of human rights violations and corruption). The surveillance is either off the books or records of such actions are destroyed in a few months/years.

He could still approach the police for violation of his privacy. But Joseph believes not much would've come of it. "I know reporters who've tried to do that. But you'd then be filing a case against the same people who would investigate." That is, state backed law enforcement bodies.

So while the use of the Israeli spyware didn't faze him, who it was deployed against did. A list, compiled by The Wire, includes 700 Indian journalists, lawyers, activists, businessmen and a battery of opposition politicians like Rahul Gandhi and Abhishek Banerjee.

"We're talking of weapons-grade private surveillance on journalists and social activists and the eerie parallel of cases slapped on them." This was most evident in the Elgar Parishad case. The phone numbers of eight people arrested for their supposed role in instigating the Bhima-Koregaon clashes of January 2018, and nearly a dozen of their close relatives, lawyers, friends and colleagues, figure in the Pegasus list.

All this was possible, says Joseph, because the Intelligence Bureau, the Central Bureau of Investigation and other state agencies lack judicial or parliamentary accountability. State surveillance is an accepted part of the political arena. Everyone knows they can command or be at the receiving end of such surveillance, depending on whether they are in the ruling party or the opposition. When in opposition, BJP leaders Atal Behari Vajpayee and L.K. Advani were vocal critics of Indira Gandhi's misuse of intelligence agencies against them. But when the two were sworn in as prime minister and home minister in the late 1990s, the National Democratic Alliance government didn't legislate to bring in more checks and balances to these institutions either.

The situation continues today. In 2013, the ministry of home affairs revealed that it receives nearly 9,000 requests for phone tapping every month. It has since then denied all RTI requests for similar information. The Narendra Modi government has become synonymous with lies, obfuscation and delays in matters of data. (We wrote about it here). But in spite of the lack of clarity on the exact numbers, many believe it likely that those under the state's watch have only increased. This theory is further substantiated by the Justice Srikrishna Committee, which said review authorities meet once in two months to review more than 15,000-18,000 surveillance orders.

Over the course of his reportage, Joseph found that India's "war on terror" had made its security institutions "more nationalistic and chauvinistic and, inevitably, more corrupt" in recent years. "The personnel have realized that blindly following orders of the executive of the day is the safest," he says. "Then you are not held accountable at all. That's been the career of Rakesh Asthana [Delhi police commissioner, believed to be a close ally of Prime Minister Modi] and Y.C. Modi [former chief of the National Investigation Agency who gave PM Modi a clean chit in a Gujarat riots case]."

All this, he adds, needs urgent reform and redressal. "Otherwise we should rename the Republic of India to Banana Republic of India."

Judge, jury and executioner

After the global exposé of its targets, the Israeli NSO group, developers of Pegasus, claimed that it sold the spyware only to "vetted governments".

Was the Indian government among them? NSO wouldn't say, nor would the government.

"No form of illegal surveillance is possible with the kind of checks and balances instituted by the government," Ashwini Vaishnaw, union minister of electronics and information technology, told Parliament on 19 July.

Here's the government's defence: There are 10 agencies authorized to carry out "legal" surveillance in India. These include IB, CBI, the Enforcement Directorate (ED), the Narcotics Control Bureau, the Central Board of Direct Taxes, the Directorate of Revenue Intelligence, the National Investigation Agency (NIA), the Research and Analysis Wing (R&AW), the Directorate of Signal Intelligence and the Delhi Police Commissioner. Interception is only allowed in case of national security, investigation of crimes or in cases of public emergency/safety. And there is a process.

All requests are routed through the home secretary of the central or state governments. In emergency cases, a top officer can authorize interception, although they are bound to inform the executive about it within 3 days. Those under surveillance rarely find out if they're being listened to or left alone. But there are periodic reviews within the ministry of home affairs to assess the need for interception, and if it needs to be continued.

Vaishnaw is right: There are checks and balances. Only, as per those, the ruling party acts as the judge, jury and executioner for all surveillance. "If the body that issues the order, conducts the investigation and also conducts the review of its legality is all the same, you will not have any practical oversight or safeguards," says Apar Gupta, executive director of Internet Freedom Foundation, a Delhi-based non governmental organization that defends digital rights.

What complicates this further, Gupta adds, is the lack of legislation governing the activities of security agencies. "The intelligence agencies that conduct the surveillance are not established through a statute. If the RAW or NTRO [National Technical Research Organization] or IB are established under a statute, they will report to the Parliament. They'll be bound within the framework of the legislation. All budgetary allocations will be disclosed transparently rather than a general fund matter in the MHA." As on date, agencies like the IB, RAW and CBI are, in the eyes of law, illegal or unconstitutional. In 2013, the Gauhati High Court said as much about the CBI before the Supreme Court stayed the order.

There have been efforts to address this. In 2011, Congress member of Parliament Manish Tewari had moved a bill titled "The Intelligence Services (Powers and Regulation) Bill" to bring in judicial and parliamentary oversight for the IB, RAW and NTRO. The bill took a cue from the legislations already in place in countries like the US and the UK. It prompted some "serious deliberations in the highest echelons of the government", says Tewari, but eventually lapsed after his elevation as the I&B minister in 2012.

In the monsoon session of Parliament this year, Tewari revived the bill. It never came up for discussion. But after the Pegasus revelations, bringing accountability to the state security apparatus had become more urgent than ever, he said.

"The process of internal checks and balances is a chimera. Who knows if they work or they don't? Even after the Patriot Act was enacted in the US, they kept powers to authorize surveillance for the judiciary. There has to be a balance between individuals and state's imperatives on national security. And the balance has to lean towards the individual."

The net gets wider

Surveillance in India has a long history. A rare documentation can be found in Open Secrets, a tell all memoir by Maloy Krishna Dhar, former joint director of the IB.

Dhar served at the IB for 30 years until his retirement in 1995. He'd worked with several prime ministers, bureaucrats and top opposition leaders during this time. He is candid about the rampant surveillance, toppling of three state governments, arrests on false grounds and convivial relationships between political parties and big businesses that were on at the time. He should know-he'd facilitated a lot of this.

Some of the most revealing anecdotes are from the time Dhar was posted at the Subsidiary Intelligence Bureau. The unit functioned as the eyes and ears of the director of IB and then Prime Minister Indira Gandhi. Here, Dhar worked 18 hours a day. His tasks included studying the electoral prospects of Rajiv Gandhi, bribing MLAs and helping sabotage key elections. Several times, he was sent to bug the office and residence of Maneka Gandhi and her family, for Indira perceived them as a threat to Rajiv's electoral debut.

Dhar knew his work was unethical, if not illegal. Officially, the IB's mandate is to "collect intelligence on political, social and religious movements in the country on behalf of the state". It's meant to be done in the interest of national security. But "I was told that anyone considered an enemy of the prime minister should be treated as the enemy of the nation," Dhar writes.

At times, Dhar would force himself to overrule his conscience. On others, he would try to make his colleagues see reason. "My personal efforts to arouse a reasonable response from the opinion makers inevitably ended in prophetic replies like 'why waste your sleep' and 'you don't legislate to give better rights to your housemaid'," he writes. "That's what the status of the spy outfits is. They are better off below bedsheets and inside kitchen pots."

But gone are the days of wire-taps and concealed equipment. The recent technological innovations have made state surveillance far easier, and a lot more intrusive. Smartphones help agencies track down the location of a user; artificial intelligence, facial recognition and CCTV cameras can also be used to profile a user's activities and movements. The NTRO reportedly uses vehicles equipped with phone-tapping instruments to "randomly" tune into conversations of people in a "bid to track down terrorists". The Uttar Pradesh government is even planning to use drones in Lucknow to keep an eye on residents' rooftops.

India has been known to engage in targeted surveillance for the most part. But as a research paper by the German Institute for Global and Area Studies notes, the government is currently undertaking several initiatives that would help it cast the net wider.

First, there's the National Intelligence Grid, or NATGRID. This is a database fed by several government departments and ministries. It has the capacity to give intelligence and investigative agencies access to citizens' data, including details of bank accounts, telephone records, passports and vehicle registration.

Second, is the Network Traffic Analysis (NETRA). It would automatically intercept voice calls over the internet if they were red-flagged by keywords like "bomb" and "attack".

Third, is the Crime and Criminal Tracking Network Systems (CCTNS). This is a national network linking 14,000 police stations to allow for online tracking of crime and criminals.

Over the last two decades, a new predator has entered the battle for individual privacy. A host of apps, websites and social media platforms, from Facebook, Google, Zoom and WhatsApp, collect data on user habits and preferences. Some of these apps offer end-to-end encryption. This, says former Delhi police commissioner Neeraj Kumar, creates a blind spot for intelligence services.

"If law authorities want to intercept communication via Facebook or WhatsApp, it's next to impossible to decrypt," he says. The reason is, the encryption keys are in the country the apps are based in. "If Zoom was made in India, then Zoom is duty-bound to share encryption keys with the government of India. People deny it but I'm sure the encryption keys of Facebook or WhatsApp are with the CIA or FBI."

Several countries suspect the same. It's the reason why the UAE bans WhatsApp calls or China has developed Weibo or Baidu, homegrown alternatives for Twitter and Google. It's also the reason why the Indian government is promoting the use of homegrown apps like Koo, says Kumar. "So when the time comes where you feel you must penetrate a dark spot, apps like Koo will have to share data."

Encrypted apps aren't completely secure either. "Some spy apps can read WhatsApp texts using notifications," says Nikhil Mahadeshwar, director of the cyber security firm Skynet. "If you get a notification saying 'hi', a spyware can read it... There are also apps that give you access to the photos and videos on the phone, or to its front or back camera."

The Indian government is ramping up efforts to mine data from social media platforms. The German Institute for Global and Area Studies research paper notes that 40 government departments have access to a social media surveillance tool called Advanced Application for Social Media Analytics. This enables data collection from multiple social networks, sentiment analysis of the posts, tracking of users' location and alerting authorities.

The use of such technology can be crucial to pre empt and prevent criminal or terror activities. It's why many in law enforcement are skeptical of additional bureaucratic intervention or red tape.

"When you are chasing someone, you need permission in real time," says Kumar. "I have gone through that. Luckily, I was in CBI and the CBI had a lot of clout and we'd get permissions. But I remember once I wanted the ownership or subscriber details of a mobile phone in the UK, and the [British] officer who was close to me said he couldn't do it unless he got an order from the court. If you want to do law enforcement work and you make the process so tedious, your work will never be done."

But for all such perceived efficiency, ready surveillance has just as much potential for misuse. In the protests against the Citizenship Amendment Act in 2019, the Delhi police screened protestors through facial recognition technology. During the farmer protests last year, Twitter blocked 97% of accounts most of them critical of the government -on instructions from the Indian state. In 2019, the Facebook "Transparency Report" stated that India was second only to the US in requesting the company to provide users' data. Facebook had complied in 53% of cases.

In 2013, American whistleblower Edward Snowden revealed how the US government uses the PRISM tool to scoop up data from internet giants like Google, Outlook and Facebook. India doesn't have an equivalent for similar mass surveillance so far, says Yashovardhan Azad, former special director at the Intelligence Bureau. "It's difficult to get pin-point intelligence. The tendency is to collect as much meta-data. It's hard work."

Azad is among a handful of advocates for greater oversight and accountability of the national security apparatus. "I think IB is one of the best organizations," he says. "But in our society or nation, including in politics or journalism, 25% of staff is brilliant. It's on their shoulders that 75% others ride. But the latter are either not professional, indolent or just lack a spine. That's why you need an accountability mechanism."

What about the concerns that red tape would hamper investigations? Or revealing information to non executive actors would compromise national security?

"No one is talking of sharing information on operations or statecraft," says Azad. "We're talking of overall parameters under which democratic institutions can function. It's to make sure these organizations work to national objectives only. And I am of the view that MPs are just as patriotic and can handle security issues just as well, if not better."

Freedom under fire

Ahead of the 2014 parliamentary elections, two investigative web portals-Cobrapost and Gulail uploaded taped conversations featuring a senior police officer and then Gujarat home minister Amit Shah. The conversations revealed that the state government had been tapping phones and tracking movements of a 35-year-old woman for several months.

Such surveillance, if legal, had to go through the Ahmedabad commissioner of police. But the then commissioner of police, S.K. Saikia, said that he did not authorize any such surveillance. The conversations revealed that the surveillance was done on behalf of a "saheb". Most presumed it referred to Narendra Modi, then the chief minister of Gujarat.

Modi did not address the allegations. Instead, he continued the series of rallies he was undertaking as BJP's prime ministerial candidate. Meanwhile, his party colleagues obtained a letter from the girl's father, a businessman believed to be close to Modi, saying he had requested the surveillance. The reason: He feared for his daughter's safety. The BJP spokespersons said the father-daughter duo didn't want to pursue the matter and that it was the Congress's dirty tricks at play.

The case was never investigated. Today, the protagonists of the snooping case occupy the top constitutional posts in the country. In the seven years of their rule at the Centre, the BJP has also toppled nine state governments. The Pegasus list revealed that several of those under surveillance included members of India's judiciary and constitutional authorities. A few months ago, Freedom House, a global political and civil rights watchdog, downgraded India from "free" to a "partly free" country.

Dhar's Open Secrets continues to be a prescient account of what a surveillance state can do to democracy. At the time of its publication, he was clear that he didn't want to be seen as an upstanding man rebelling against a rotten establishment. He had participated in it-and he was good at it. Only, he knew it wasn't right, and that it shouldn't continue. He said as much at the book's launch: "The absence of accountability of the intelligence establishment in a democracy could turn it into a state worse than Idi Amin's Uganda."