The sovereign test

India is a constitutional democracy, where the courts have read the right to privacy in the right to life and liberty.

Will Cathcart, the global head of WhatsApp, wrote in The Washington Post on October 30, in the backdrop of the ongoing lawsuit by Facebook Inc against Israeli cyber security firm NSO, that “Governments and companies need to do more to protect vulnerable groups and individuals”. He was referring to spyware attacks, like the one that the messaging platform succumbed to from Pegasus, a malicious software developed by NSO. As first reported in this newspaper, WhatsApp has disclosed that a “not insignificant” number of Indian journalists, rights activists and lawyers were targeted using Pegasus. Cathcart is right — especially in placing the responsibility on both tech companies and governments. WhatsApp has often claimed that its end-to-end encryption makes it a safe and private way to communicate. That claim is now being contested. How it responds will signal whether its invocation of privacy as a first principle is more than a mere marketing ploy. The proceedings of the ongoing lawsuit will be closely watched, to track the culpabilities and complicities of the actors involved.

Earlier this year, NSO severed its contract with Saudi Arabia after accusations by a journalist that its software was used to hack his phone, which allowed Saudi agencies to track journalist Jamal Khashoggi, who was assassinated in Istanbul. The fact remains that in the digital age, companies will emerge and operate in the grey areas of the intersection between technology and security to make a profit. But inviolable as it is, national security must not be used as a shield by either governments or private players to justify the violation of fundamental rights.

Advertisement

India is a constitutional democracy, where the courts have read the right to privacy in the right to life and liberty. In the government’s first response after the Pegasus hack, Law and IT minister Ravi Shankar Prasad has said he has asked WhatsApp to explain the breach, while the home ministry has said it will take strict action against those violating the law. Earlier, the Indian government, and parliamentary committees, have summoned executives from Facebook and Twitter, and Indians continue to be the largest user base for WhatsApp. India also enjoys close ties with Israel. The government must leverage this to hold NSO to account. And it must deliver on its promise to punish anyone — whosoever they may be — found guilty of unlawfully violating the privacy of Indian citizens. The current government has made it clear that it holds on to its sovereign right over the data of its citizens. But the idea of data sovereignty must include a citizen’s right to her privacy. How the government deals with the aftermath of the WhatsApp hack will demonstrate its commitment to that principle, as well as to the rights enshrined in the Constitution.