How India’s Emerging Surveillance Regime Threatens the Right to Anonymity Online

While the concept of anonymity seems increasingly challenging in today’s digital age, it remains an essential tool to protect the identities of those who risk persecution or retaliation for speaking out. In present day India, this includes human rights activists, whistleblowers and marginalized groups who rely on social media to connect with others and shed light on atrocities perpetuated by powerful actors. Members of the LGBTQ community need online anonymity to find supportive spaces in a country which still practices massive social bias against them. Anonymity was a key factor in the rapid spread of the #MeToo movement, as demonstrated by the popularity of Instagram accounts like Scene and Herd which sought to reveal sexual harassment in India’s art world. Anonymity is also what ensures that India’s vibrant culture of debate and dissent stays alive, by enabling the proliferation of pseudonymous accounts on Twitter who use the platform to provide bold political commentary. Taking away the protective shield of anonymity would expose these speakers to harassment, legal threats, and potentially even violence. The ruling government has demonstrated numerous times its dislike for criticism by suing journalists reporting on its failures or asking critical questions. It has even arrested peaceful protestors for ‘inciting violence’, going as far as to dox them on social media.

Unfortunately, online anonymity is facing serious threats. In India, surveillance by the State is legal only if certain substantive and procedural safeguards are met. Over the years, successive political regimes have established a vast electronic surveillance apparatus. What began with interception of personal mail and tapping of phone calls now encompasses a sprawling data collection network, much of which has been set up by telecom and social media companies. India’s regulatory framework provides broad powers to the executive which are not subject to judicial review. Sections 69 and 69B of the Information Technology (IT) Act, and the rules thereunder, give the government the power to authorize the interception, monitoring and decryption of any data and metadata taken from private social media intermediaries if it believes this is necessary or expedient in the interest of sovereignty, integrity, defense, security, foreign relations, public order or to prevent the incitement or commission of any cognizable offence.

On the basis of this legal provision, the Indian Government made 49,000 requests for user data from Facebook in 2019. This volume is second only to the United States. Companies which refuse to comply are liable for punishment with imprisonment and fines. In addition, surveillance systems like the Lawful Intercept and Monitoring System (LIMS) and Central Monitoring System (CMS) grant the government direct, centralized and real-time access to users’ personal internet communications including emails and social media, through mandatory provisions in the operating licenses of telecommunications and internet service providers. Network Traffic Analysis (NETRA), a tool developed by the Defence Research and Development Organisation (DRDO) can monitor and analyze data from social media platforms, emails and blogs. In December 2018, the Indian Ministry of Home Affairs gave ten agencies, including law enforcement agencies, blanket legal authority “to intercept, monitor or decrypt information generated, transmitted, received or stored in any computer”. This includes user identifying data from social media companies. The order bypassed the statutory requirements under the IT Act for prior authorization of surveillance requests by a “competent authority” at the level of the Union Home Secretary or the appropriate state government’s Home Secretary. In May this year, the government released a tender for a social media monitoring tool. While the tool is ostensibly targeted at identifying fake news and misinformation, it raises further concerns around mass surveillance and the threat to privacy, expression and anonymity online. It is pertinent to note that these surveillance systems have been introduced by executive order, and with no legislative backing.

Another threat looming on the horizon is the proposed draft Personal Data Protection Bill, 2019, which is currently undergoing review by a Joint Parliamentary Committee following several rounds of feedback from technology companies and civil society. While the Bill is an improvement in the sense that it provides a regulatory framework for corporations to protect and process personal data, and establishes a Data Protection Authority for this purpose, section 35 of the Bill allows the government to ignore these strict requirements whenever it is “necessary or expedient” in the “interests of the sovereignty and integrity of India, it’s national security, friendly relations with foreign states, and to ensure public order.” The broad ambit of these powers places few practical limits on the ability of the government to track millions of Indians at will.

While the government has a legitimate aim in seeking to control criminal activities online which are often perpetuated using tools to mask the identities of perpetrators, the use of blanket mass surveillance raises enormous challenges to democracy and human rights. The UN Special Rapporteur on Freedom of Expression has noted that anonymity is essential to protecting those willing to shed light on important yet uncomfortable truths. Anonymity enables people to fully exercise and enjoy the rights to freedom of expression and privacy as envisioned by the International Covenant on Civil and Political Rights. The value of safeguarding anonymity has also been recognized by the US Supreme Court and the Council of Europe. The UN Human Rights Commission has mandated that any limitations to the right to privacy online, including through state surveillance, must be applied strictly so that they do “not put in jeopardy the right itself”. The Indian government’s embrace of blanket mass surveillance fails the necessity and proportionality tests as laid down by international law. It is also inconsistent with the Indian Supreme Court’s ruling in Puttaswamy v. Union of India, a landmark judgement delivered in 2017 which declared the right to privacy as a fundamental right.

By viewing all its citizens with suspicion and subjecting them to blanket mass surveillance, India risks regressing into an authoritarian state, thus undoing decades of progress made on human rights since independence. In order to avoid that, it is essential that the State rework its regulatory framework to respect domestic and international standards of human rights law. Homegrown civil society initiatives like the Save Our Privacy collective provide a useful starting point in that direction.

Ayesha Khan is an international lawyer working at the intersection of technology, human rights and business responsibility. She can be found on Twitter here.