Introduction :- 

Telephonic surveillance is sanctioned under the Section 5 of the Telegraph Act 1885 (and its rules). It allows disclosure of Call Data Records (CDRs) which includes numbers involved, duration, time & date of call. Electronic surveillance is authorized under the Section 69 of Information Technology Act 2000 (and its rules).Section 69 of the IT Act directs any person or organisation to assist law enforcement agencies to decrypt information, deemed to be in interest of sovereignty/integrity of India, security of the State, friendly relations with foreign countries or public order. The procedural requirements were laid down by the Supreme Court in PUCL v Union of India [1997]: Surveillance requests must be authorized by an authority at least at the level of a Joint Secretary. The safeguard was inserted in Telegraph Act in 2007 under Rule 419(A). Unlawful Activities Prevention Act 1967 allows the information intercepted under Telegraph Act to be used as evidence. CrPC sections 91 and 92 lay out how courts, police & district magistrates can summon any document or “thing” from any person, postal or telegraph authority for investigations, inquiries and trials.

The agencies given such authoritative access are: Intelligence Bureau (IB), Narcotics Control Bureau (NCB), Enforcement Directorate (ED), Central Board of Direct Taxes (CBDT), Directorate of Revenue Intelligence (DRI), Central Bureau of Investigation (CBI), National Investigation Agency (NIA), Cabinet Secretariat (R&AW), Directorate of Signal Intelligence (for service areas of Jammu & Kashmir, North-East and Assam only) and Commissioner of Police, Delhi.

According to it, the subscriber/service provider/ person in charge of the computer resource will be bound to extend all facilities and technical assistance to the agencies and failing to do will invite 7-year imprisonment and fine.

The order derives its basis from Section 69 of the IT Act and its 2009 rules, which gives power to intercept, monitor, and decrypt “any information” generated, transmitted, received, or stored in “any” computer resource to the central and state governments, or “any of its authorized officers”.

Possible avenues of surveillance in India :

• Central Monitoring System is a centralized telephone interception provisioning system. Under CMS, all the data intercepted by Telecom Service Providers (TSPs) is collected & stored in central & regional databases. Law enforcement agencies can get access to intercepted communication on near real time basis.
• National Intelligence Grid linking multiple Govt databases (such as banks, airlines, SEBI, railways and telecommunication operators) to aggregate citizen information.
•  NeTrA (Network Traffic Analysis) is a dragnet electronic surveillance system that monitors internet traffic using dynamic filters based on keywords.

Government’s stand :

• The order is based on the principle that the right to privacy is not absolute. Surveillance is essential to ensure national security and pre-empt terrorist threats and thus, constitutes a ‘reasonable restriction’ under Article 19(2) of the Constitution.
• It is in the very nature of surveillance that it must take place outside the public eye.
• The above order only nominates the agencies, which on a case-to-case basis and subject to oversight, will obtain orders from designated judicial authorities to intercept. It doesn’t intend to provide any blanket powers.

Challenges :

• Lack of oversight: Decisions about surveillance are taken by the executive branch (including the review process), with no parliamentary or judicial supervision either ex-ante or ex-post, of surveillance measures. Although mandated by the SC, the actual notification itself does not clearly require the Union Home Secretary to pre-approve such surveillance orders.
• Vague grounds of application: Under Section 69 of the IT Act, the grounds of surveillance have been simply lifted from Article 19(2) of the Constitution, and pasted into the law. They include very wide phrases such as “friendly relations with foreign States” or “sovereignty and integrity of India”. The Act doesn’t provide does not provide the procedure or the object for such an exercise or the quantum of period for which a person’s private data could be intercepted.
• Opaque regime: No information available about the bases on which surveillance decisions are taken, and how the legal standards are applied. E.g. According to a 2014 RTI request, 250 surveillance requests are approved every day on an average.
•  Potential of misuse: State control of public lives and surveillance excesses as evident in the past cases of privacy breach and snooping. Individual officers responsible for executing automated process may use private information for personal gain in absence of safeguards.
• Against Privacy: In its Puttaswamy judgment [2017], SC asserted that the government must carefully balance individual privacy and the legitimate concerns of the state, even if national security was at stake. Any invasion of privacy must satisfy tests on 3 parameters - need (legitimate state aim), proportionality (least restrictive method to achieve state’s goals) and legality (postulated by the law) – to ensure that fair, just and reasonable procedure is followed without any selective targeting and profiling. A blanket power to wide range of government agencies to access an individual’s encrypted material is a clear violation of the judgement. Moreover, an individual can never know that she is being surveilled means that challenging it before a court is a near-impossibility.
• Procedural Challenges: Platforms such as WhatsApp have end to end encryption, which are very difficult to break. Also, Internet communication can be sent using proxy servers with mail encryption which makes it
  untraceable. Most of the companies don’t have servers in India (in absence of any data localization laws). Law Enforcement Agencies request data through mutual legal assistance agreements, which takes long time to process.
• No data privacy legislation: No national privacy legislation is in place which assigns the liability in case of data-theft and can make parties – Government or private - pay damages when they injure the individual by losing their personal data.

Way Forward :

• Parliamentary Oversight: It must be acknowledged that a system of government surveillance may have a chilling effect upon the right to freedom of expression and privacy. Thus, a privacy commission can be appointed to help regulate and oversee surveillance activities, with regular briefings to Parliament.
• Judicial Oversight: In Aadhaar case, SC held that allowing disclosure of information in the interest of national security to be in the hands of a joint secretary only is unconstitutional. Indian Privacy Code, 2018, is a model Bill that stipulates that all communications surveillance and data access orders require approval by serving high court judges designated to special surveillance review tribunals.
•  Mandatorily specify a probable cause for potential threat: Any such sweeping power is liable to be misused if the grounds of application remain broad and vaguely worded. Any evidence obtained through unconstitutional surveillance must be statutorily stipulated to be inadmissible in court.
• Privacy Law: To achieve the balance between national security and individual privacy, a privacy law on the lines of recommendations of BN Shrikrishna Committee would be a good starting point. Any system of data collection should factor in privacy risks and include procedures and systems to protect citizen information
• Although the target cannot know of the proposed surveillance, there must exist a lawyer to present the case on behalf of the target of surveillance so that objective decision is made.
• Additionally, there is a need for discussion and explanation of legal measures on surveillance before actual implementation, to build a better trust with civic society.

Extra Read :- 

PRISM surveillance program in the US

• In 2013, ex-NSA contractor and whistleblower Edward Snowden revealed the industrial-level surveillance of private communications undertaken by the American government, officially known as the PRISM project.
• One feature of the American surveillance program was “telephony metadata collection“, where all the details of phone conversations (numbers involved, duration, time of call etc.) minus the actual content of the call were intercepted and stored in a database maintained by the National Security Agency.
• NSA surveillance was challenged on statutory and constitutional grounds in American Civil Liberties Union vs. James Clapper [2013].
• The appeals court found that out of more than 50 instances where terrorist attacks had been prevented, not even a single successful pre-emption was based on material collected from the NSA’s surveillance regime. It asserted that collection of ‘staggering amount of metadata’ doesn’t satisfy the reasonability clause of Section 215 of the Patriot Act and has a chilling effect on an individual’s expression.