Over the last two days, we have seen news reports of the WhatsApp accounts of human rights defenders, Dalit journalists, academics, and even politicians being targeted and subjected to “surveillance” through the use of Israeli software, Pegasus.
I use the term surveillance in air quotes, because the attack seems to have been in the nature of illegal hacking, rather than legally sanctioned surveillance.
The Indian Information Technology Act, 2000 distinguishes between acts of surveillance and hacking. Surveillance comprises of acts of interception, monitoring, or decryption and is permitted, and regulated, under Section 69 of the Act.
On the fulfilment of certain pre-conditions, the government (and only the government) can place certain individuals under targeted surveillance. Both under the Telegraph Act, 1882 and the IT Act, 2000, private actors are prohibited from conducting surveillance operations.
It is worthwhile to remember that the constitutionality of the present legal regime authorising surveillance has been challenged, and is pending before the Supreme Court.