In response to the finding by a global collaborative investigative project that Israeli spyware Pegasus was used to target at least 300 individuals in India, the government has claimed that all interception in India takes place lawfully. 

Communication surveillance in India: 

Communication surveillance in India takes place primarily under two laws — the Telegraph Act, 1885 and the Information Technology Act, 2000. 

• While the Telegraph Act deals with interception of calls, the IT Act was enacted to deal with surveillance of all electronic communication, following the Supreme Court’s intervention in 1996.
• A comprehensive data protection law to address the gaps in existing frameworks for surveillance is yet to enacted.

The Telegraph Act, 1885:

The Telegraph Act has gone through numerous amendments in order to accommodate new communication technologies. 

• This is evident from the current definition of ‘telegraph’ under Telegraph Act.
• It defines ‘telegraph’ as: “any appliance, instrument, material or apparatus used or capable of use for transmission or reception of signs, signals, writing, images and sounds or intelligence of any nature by wire, visual or other electro-magnetic emissions, Radio waves or Hertzian waves, galvanic, electric or magnetic means.
• Under this law, the government can intercept calls only in certain situations — the interests of the sovereignty and integrity of India, the security of the state, friendly relations with foreign states or public order, or for preventing incitement to the commission of an offence. 
• These are the same restrictions imposed on free speech under Article 19(2) of the Constitution.
• Significantly, these restrictions can be imposed only when there is a condition precedent — the occurrence of any public emergency, or in the interest of public safety.

IT Act, 2000:

The Information Technology Act, 2000 (also known as ITA-2000, or the IT Act) was notified on 17 October 2000.

• It is the primary law in India dealing with cybercrime and electronic commerce.
• Section 69 of the Information Technology Act and the Information Technology (Procedure for Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 were enacted to further the legal framework for electronic surveillance. 
• Under the IT Act, all electronic transmission of data can be intercepted. 
• So, for a Pegasus-like spyware to be used lawfully, the government would have to invoke both the IT Act and the Telegraph Act.

Conditions:

• Apart from the restrictions provided in Section 5(2) of the Telegraph Act and Article 19(2) of the Constitution, Section 69 the IT Act adds another aspect that makes it broader — interception, monitoring and decryption of digital information “for the investigation of an offence”.

• it dispenses with the condition precedent set under the Telegraph Act that requires “the occurrence of public emergency of the interest of public safety” which widens the ambit of powers under the law.

Identifying the gaps:

In 2012, the Planning Commission and the Group of Experts on Privacy Issues headed by former Delhi High Court Chief Justice A P Shah were tasked with identifying the gaps in laws affecting privacy.

• On surveillance, the committee pointed out divergence in laws on permitted grounds, “type of interception”, “granularity of information that can be intercepted”, the degree of assistance from service providers, and the “destruction and retention” of intercepted material.
• Although the grounds of selecting a person for surveillance and extent of information gathering has to be recorded in writing, the wide reach of these laws has not been tested in court against the cornerstone of fundamental rights.

Source: MEITY / Indian Express