The Fine Balance — Surveillance, Security, and the Right to Privacy

“But it is the civil society that can be subverted, suborned, divided and manipulated to hurt the interests of a nation.”¹

“It is neither desirable nor is it remotely likely that civil liberty will occupy as favoured a position in wartime as it does in peacetime.”²

In this article the author explores how in the current scenario, the competing claims of more invasive surveillance and need for privacy can be balanced keeping in view the requirements of the security agencies and the legal requirements of privacy of an individual.

Security compulsions

With a poor security neighbourhood, internal disturbances, and the need to secure the country it becomes mandatory for the Government to conduct surveillance — telephonic, electronic, digital, etc. It is the core work of any security agency to be forewarned, forearmed and to be one step ahead of terrorists or criminals or other foreign adversaries. The problem is compounded as the adversary(ies) today are both State and non-State actors and they often use grey zone tactics to foment trouble in an enemy country. The need to provide such ample arsenal and legal powers to the security agencies is undeniable. This requires surveillance and monitoring of personal data of people including its citizens.

There is a fair body of view that legal niceties applicable in peace times do not help in the gritty fight against terrorists, naxals, etc. A few years ago, the National Human Rights Commission held a seminar on “Are human rights a stumbling block in fighting evils like terrorism and Naxalism?”³ The essential issue discussed was the balance that ought to be struck in the enforcement of human rights and individual rights and to check any excesses. The Chairperson of the Commission had observed that the security forces need to observe a balance to ensure proportionate use of force during their operations.⁴ It is felt that at a time of crisis when the nation is faced with terrorism, the Enforcement Directorate, the police, and armed forces need to be given greater powers of surveillance and arrest. A former Defence Secretary wrote:

At any rate, making a political controversy over national security issues will not do the country any good. India may be a liberal democracy but the freedoms our constitutional guarantees are always subject to reasonable restrictions. In a democracy, there are checks and balances which can counter the misuse of powers by an agency of the Executive. Those who are squeamish about exercise of surveillance powers by national agencies may do well to remember that companies like Alphabet, Amazon and Facebook have access to immense personal data and the emerging power of this data and its impact on individual freedom and privacy are more likely to lead to an Orwellian syndrome than legitimate efforts by the Government to plug security loopholes.⁵

The delicate question that arises from this observation is how does the law ensure that the data collected in such process is not used for oblique purposes or is not subsequently misused by the Government of the day?

The concerns over privacy

The opponents of greater powers to the State argue that there is no guarantee that the Government (even in a liberal welfare State) will act in our welfare. Our data of very private nature can be misused by its officials — bureaucracy, police to blackmail people, arm-twist citizens and rein in or destroy the opposition. Nowadays one shares very personal data with the Government of India and the State Governments. We share the details of our pupils, fingerprints with the Government while procuring the Aadhaar card. Government issues us a driving licence where we share our address, ration cards, BPL cards, etc. We use applications such as Bharat Interface for Money (BHIM) and Aarogya Setu and other payment platforms. Our cards and our persons can be scanned at police pickets and at airports. While all these are used to render social services by the Government like Mahatma Gandhi National Rural Employment Guarantee Act (MGNREGA) and other welfare schemes, bank loans, ration cards, farmer loans, FASTag, etc. they are however intrusive. They can also be used to spy on a citizen. Misuse of such data can lead to the difference between life and death.

Previous experience

While evaluating the two positions mentioned above, it will be fruitful to glean through past history to estimate on how best the balance between the two positions can be made.

USA

During World War II and the subsequent to the Cold War era successive US Presidents gave the Federal Bureau of Investigation (FBI) permission to engage in wiretapping. The FBI tapped phones of celebrities, writers, dissidents, Supreme Court Justices, and professors. Among them were Albert Einstein, Ernest Hemingway, Charlie Chaplin, Marlon Brando, Muhammad Ali, John Steinbeck and numerous Presidents and members of the Congress.⁶ In the 1950s during the McCarthy era the FBI in the United States of America began a counterintelligence program to gather information about political groups viewed as national security threats. The FBI's tactics included secretly attempting to persuade employers to fire targeted individuals, anonymously informing spouses of affairs to break up marriages, and using the threat of Internal Revenue Service investigations to deter individuals from attending meetings and events. Initially the target was the communists. But this expanded to include members of civil rights movements and opponents of Vietnam War. These individuals included Martin Luther King Jr. The FBI had recordings of his extramarital affair threatening that if he failed to commit suicide by a certain date, the recordings would be released publicly. He was in reality assassinated.⁷

Daniel J. Solove noted that by Executive Order 10, 550 CFR 200 (1954) the President Eisenhower gave an order to the FBI, Civil Service Commission, and other agencies to investigate an individual's character, morals, emotional stability, good judgment in order to determine if he might become a security threat.⁸

The US Army had been assigned the task of national police force. It invaded people's privacy, spied on them while they attended Church, infiltrated religious organisations, etc. The Army maintained microfilms manual files on membership of virtually every activist political group in the country. These reports contained detailed information on finances, sexual activities, personal beliefs, and associations of famous people, as well as anonymous Americans.⁹

In 1974 the US Senate decided to form a 11-member Committee headed by Senator Frank Church, to look into the way the various government agencies of the United States had been conducting their surveillance activities. The Committee had concluded that the Government had engaged in numerous abuses of surveillance, often targeting people solely because of their political beliefs. It noted that far too many people have been spied upon by too many government agencies. The Government had often undertaken the secret surveillance of citizens merely on the basis of their political beliefs, even when they posed no threat of violence or illegal acts on behalf of any hostile foreign power. Daniel J. Solove noted that every President in the United States of America right from Franklin Roosevelt to Richard Nixon, Democrat or Republican had improperly used government surveillance to obtain information about critics and political opponents.¹⁰

The above was not a preserve of the cold war era. The US Government under President Barack Obama spied on its own citizens as per news reports and an inquiry was ordered.¹¹

Experience in India

While there is no authentic government data available on the subject, from news reports it is learnt that the former Prime Minister Mr Chandra Shekhar had made the allegations that the V.P. Singh Government was involved in tapping the telephones of 27 politicians. He had even filed a complaint.¹²

It was alleged that the Prime Minister Mr Rajiv Gandhi’s administration had been tapping the phones of not just some of his own ministers, such as Arif Mohammed Khan and K.C. Pant, but also a large list of opposition figures, according to a report released by the Central Intelligence Bureau in 1991.¹³

As per news reports, in Tamil Nadu, the M.G. Ramachandran Government had ordered the tapping of the phones of more than a half-dozen Senior Cabinet members, including M. Karunanidhi and his son M.K. Stalin, Congress (I) leader and Tamil Nadu Congress Committee (TNCC) Chief K. Ramamurthy, former Union Minister Murasoli Maran and Jayalalithaa, whose phones were tapped even during the President’s rule.¹⁴

The Government of India has also marred its image due to various cases of misuse of government agencies to target its opposition. The recent controversy arising from the case of purchase of Pegasus software which was allegedly used by the Government to spy on its own citizens, oppositions, journalists, and its own officials has added to the concerns.¹⁵¹⁶¹⁷

From the above it is clear that even in democratic countries governed by rule of law, the Government is often placing its own citizens under surveillance and using the information illegally to threaten them. Today any democratic Government has immense power and technological capability to enforce law and promote security. This very capacity can also lead to devastating misuse of technology and violation of an individual's privacy.

Maintaining the balance

From the above the concerns of both the security agencies and citizens seem valid and grave. It begs the question, is there a middle path?

Often the debate between the security agencies and the Human Rights sphere are extreme and polemic. There are a number of security agencies in India for e.g. the Research and Analysis Wing (RAW), Intelligence Bureau of Investigation, Police and Crime Investigation Department (CID), Enforcement Directorate, National Technical Research Organisation (NTRO), Joint Cipher Bureau, Narcotics Control Bureau, Serious Fraud Investigation Office, Defence Intelligence Agency, etc. Often the security agency(ies) is/are depicted as a prying unrestrained leviathan which is out to control the citizens and the machinery of the State. Frequent and grave misuse of agencies has added to the strident tenor of this argument. Conversely the people advocating for human rights and privacy are seen as either ill-informed or unpragmatic, or obstructionist or as vested interests or all of the aforesaid. Much scope for consideration and action is unfortunately lost in this false binary and cross talk between the two extremes.

What lucidly appears as a common thread in both the popular discourses is that the nature of a liberal State and values needs to be protected. But the remedy has to be measured and administered with oversight to attempt a cure lest the medicine itself becomes the problem.

Essential question

Thus, the option before us is not that a citizen can have either surveillance security or privacy, but the correct and essential question is that in an era that demands extensive surveillance, how can privacy be protected? The requirements can both be balanced by law to ensure “privacy” and “security ”. If the same is not done the very nature of the liberal State and freedoms we enjoy including the security enjoyed by us will unravel. The author is arguing that the tools and powers that we provide to the Government to ensure our safety need not be in contradiction with the right to privacy of the citizen.

Framework for balance

Often the intelligence or evidence is thin at best and leads have to be followed through with subterfuge. Such investigation or surveillance has to be followed discreetly and involve phone tapping, electronic surveillance, digital tracking, etc. The question is when such steps are required, what protections are available that the data is not misused to target political opponents, institutionally blackmail, and silence political opponents who are not breaking any law. Are there legal and institutional complaint mechanisms/systems available, robust, and uncompromised to ensure the same? Currently there is no such institutional mechanism available.

Inadequacy of the court system

The author argues that the judicial system in India alone is not the answer in such a case as it merely remedies the breach compartmentally and very belatedly. Privacy matters may end up in court only after an infraction is detected per chance. Many people will not even know that their Government has spied upon them and misused their private data. Further the judicial system takes a long time, and a person can challenge one infraction at a time. The same is also very costly. The Government may apart from overt coercive action can also spread mis/disinformation about a person in society. Fighting on so many fronts could break even the well-heeled. Further what remedies will the court offer? A mere declaration of the illegality of the government action? What if the information was leaked or misused to hurt someone? How will the court assess the damages? How will the remedy ensure that the Government in future shall remain in check? How will action ensue against the errant officials? It is my submission that the current prerogative writs and their mechanism leaves the citizen with no practical and immediate remedy and certainly nothing to ensure that the same does not happen in the first place. It is grossly inadequate and therefore unsuited to protect the privacy of a citizen. The impact of breach of privacy is instantaneous and the impact can be so grave that it may crush a citizen. For e.g., the Niira Radia tapes contained private and reputationally damaging conversations.¹⁸ The leaking of the tapes caused immense reputational damages to many large and otherwise reputed businesses and business persons even thought they had not broken any law.

Regulatory solution

What is required is regulatory oversight at the very initially stage that can look at the issue wholistically. The mining/surveillance of a citizen's private data requires a continuous oversight to ensure that surveillance is:

1. Conducted on existence of some actual reasonable material that is related to a crime and security and requires further probing or monitoring.

2. To the extent possible data collected should be randomised unless the security agency needs to collect something specific.

3. The specific record is stored in a foolproof manner and destroyed after a reasonable period of time or after the same is not required anymore. Strict punishments and damages must be provided for in case of any leak of the private data collected of citizens against the State and errant officials. Exemplary actions must ensue automatically without even the citizen's intervention.

4. There has to be a clear protocol on who will collect, handle, and destroy such data.

5. The internal mechanism of the agency must ensure compliance of the procedure.

6. A regulator must be appointed who shall oversee compliance by the government agencies and ensure that data has been used and destroyed as claimed. In case of any breach, the regulator may also decide the punishments. Complaints by citizens may also be filed before this regulator.

7. Similarly, since the matter pertains to fundamental right to privacy a Standing Committee of Parliament should have the oversight of the working of both the internal governmental mechanisms and the working of the regulator.

8. After a certain elapse of time, the data be made public unless it undermines security in some way.

This approach allows the executive to utilise powers with the widest amplitude but connected to the objective of solving crime or ensuring security and at the same time ensures clear oversight over the collection, storage, use and management of the data. Such a statutory regulator or oversight can be provided by a Board consisting of retired security officers, retired Judges, parliamentarians, etc. Based on inputs it can provide practice directions or advise the Government to ensure safety of data. They will review the government decisions and ensure that all relevant rules regarding collection, storage and protection of data are followed and ensure no citizen is violated. In case any misuse occurs, it should be detected quickly, and the remedial mechanism is initiated even without any complaint from the citizen. A mechanism for complaints to the body could also be provided for.

The Government should also proactively study the emerging threats to security, the emerging trends in technology and device mechanisms that can ensure that the privacy of citizens is protected and ensure the need for surveillance is also met. Both the bodies should exist at the Central and State level and should be liable to a Standing Committee of Parliament or the Legislative Assembly as the case may be.

It is reiterated that it would also help the case of transparency that with passage of time made the data regarding the government action is made public subject to those matter that continue to have security implications. Any effort along these lines will help security agencies work with clarity and freedom to manoeuvre but will check any misuse.