Should Citizens Bear the Burden of Proving Unauthorised Government Surveillance?

What Does Government Accountability Mean?

Newsreel Asia Insight #283
July 16, 2024

In response to mercenary spyware threat notifications—likely from Pegasus spyware, with the government as a probable suspect—received by opposition politicians, activists and journalists from Apple, the government reportedly plans to require the victims to prove any breaches themselves and through a government agency.

The Ministry of Electronics and Information Technology believes that the onus is on the citizens to prove any breach, as reported by moneycontrol.com on July 15. The media outlet added that the ministry wants the victims to prove any breaches by submitting their devices for inspection by the government’s Computer Emergency Response Team (CERT-In).

This marks a deviation from its previous approach of actively seeking clarifications from Apple. By initially seeking clarifications from Apple, the government was taking a more proactive stance, potentially to defend itself or clarify the situation. This could be seen as an attempt to at least manage the crisis and respond to public concerns.

In contrast, by now shifting the responsibility to the citizens to prove any breaches themselves, the government appears to be adopting a more passive approach. It appears to be a move away from direct involvement in investigating the claims, potentially aiming to minimise its role in the controversy or reduce the administrative burden of such investigations.

In March 2023, the British newspaper Financial Times reported, citing an anonymous source, that the Indian government was seeking to acquire spyware less conspicuous than Pegasus and was willing to spend up to $120 million to obtain it.

In August 2022, the Supreme Court observed that the technical committee it appointed to investigate whether Indian law enforcement authorities had procured and used Pegasus found malware in five of the 29 devices examined. The bench also noted that the Union government did not cooperate with the expert committee, as reported by The Wire at the time.

The targets of the spyware include the Congress party’s Rahul Gandhi, journalist Siddharth Vardarajan and Catholic priest and activist Stan Swamy.

Pegasus is a spyware developed by the NSO Group, an Israeli technology and cyber-arms firm. It can be covertly installed on mobile phones and other devices running most versions of Android and iOS. Pegasus has the capability to read text messages, track calls, collect passwords, track locations, access the target device’s microphone and camera and gather information from apps. Classified as cyber-arms by the Israeli government, Pegasus is available for purchase only by national governments, and only with the authorisation of the Israeli government.

Governments have a duty to protect national security, which may sometimes necessitate surveillance measures. However, these measures must be undertaken following due legal process to safeguard individuals’ rights to privacy. And when undue government intrusion is suspected, victims should not be required to prove government surveillance for several reasons.

There is an inherent power imbalance between individual citizens and the State. The State possesses more resources and capabilities, making it difficult for individuals to gather evidence against it. If citizens are afraid that their actions to prove surveillance might lead to retaliation or further privacy invasions, they might choose not to challenge or disclose the surveillance.

A fundamental principle of democratic governance is that the government should be transparent and accountable to its citizens. By shifting the onus to citizens, the government might reduce its accountability, potentially hiding abuses or misuses of surveillance technologies.

Internationally, there are norms and legal frameworks, like those outlined in the United Nations’ privacy guidelines, which suggest that states have the responsibility to ensure that any interference with privacy is lawful, necessary and proportionate. Requiring individuals to prove surveillance might contravene these principles.

Considering these factors, the government should bear the burden of proving the legality and necessity of its surveillance activities, rather than placing the onus on citizens to prove that they have been unlawfully surveilled.