The reported surveillance of targeted individuals through Pegasus, a sophisticated spyware made by Israeli company NSO, raises several questions in so far as it relates to the Indian targets.
While one can only speculate whether the Pegasus surveillance was at the behest of the Indian government, the question is not whether the Indian government could conduct surveillance but rather whether the use by the Indian State of NSO, a foreign entity, to conduct surveillance of Indian citizens within India, using malware, would comply with the IT Act and its relevant rules.
State surveillance is accordingly subject to approval by senior designated bureaucrats, no less the rank of joint secretary or in emergency cases no less than an inspector general of police.