The State may intercept, monitor, or decrypt information it believes could harm India’s sovereignty or integrity. Yet when protective surveillance grows without strict guardrails, it risks sliding into an invasion of privacy. The core question is straightforward: can the State invoke “national security” to override privacy without meaningful oversight? If unfettered authority is given to agencies to conduct such surveillance without any requirement of permission or provision for a review of their actions, it would make these agencies tools in the hands of the incumbent Government.
Under Section 69 of the Information Technology Act, 2000 (“IT Act”), the Central and State Governments in India possess the legal power to direct any agency to intercept, monitor, or decrypt information transmitted, generated, received, or stored in any computer resource, wherever it is deemed “necessary or expedient”. The law identifies seven grounds for the exercise of this power: the sovereignty and integrity of India, defence, security of the State, friendly relations with foreign states, public order, preventing incitement to a cognisable offence, and investigation of any offence. On its face, the provision is broad. But this power must be exercised through clear procedures, consistently applied, and subject to review.
The Information Technology (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules, 2009 (“IT Rules 2009”) translate Section 69 of the IT Act into operational practice. Rule 4 of the IT Rules 2009 empowers the competent authority to authorize any Government agency to intercept, monitor, or decrypt information generated, transmitted, received, or stored in any computer resource, for purposes outlined under Section 69(1) of the IT Act. However, these powers are structured to prevent arbitrariness. Rule 22 of the IT Rules 2009 institutes a Review Committee that must meet at least once every two months to evaluate whether the interception, monitoring, or decryption orders issued under Rule 3 of the IT Rules 2009 comply with legal requirements, and has the power to set aside unlawful directions and order the destruction of the intercepted data.
Thus, this mechanism is a practical check that compels decision-makers to justify their acts in writing and to revisit those justifications regularly.
The IT Rules 2009 embed further procedural safeguards to ensure non-arbitrariness, forming a legality-necessity-proportionality triad. Rule 3 allows such measures only on written, reasoned orders of the competent authority or, in emergencies, an authorised senior official, with time-bound reporting and post-facto approvals; Rule 7 mandates that the direction must state reasons in writing and be quickly forwarded to the Review Committee; Rule 8 obliges the authority to consider whether the information can be obtained by any means other than interception, monitoring, or decryption before issuing an order; Rule 11 limits the duration of any such direction to a maximum of 60 days, extendable up to a total of 180 days, Rule 23 requires destruction of records of such actions after six months unless required for legal or operational purposes, and Rule 25 strictly controls disclosure of intercepted or decrypted data.
Collectively, these procedural requirements and oversight mechanisms are designed to ensure that the exercise of such powers is governed by law and subject to internal and external checks, thereby safeguarding citizens against arbitrary surveillance With this legal regime as background, the Ministry of Home Affairs’ S.O. 6227(E) dated 20 December 2018 (“Notification”) empowering ten agencies to intercept, monitor, or decrypt information generated, transmitted, received, or stored in any computer resource is clearly beyond what is permissible under Section 69 of the IT Act and Rule 4 of the IT Rules, 2009.
On the face of it, the Notification merely lists agencies and states that they are to act in accordance with the law. It does not by itself authorise any particular interception. However, when one closely analyses Section 69 of the IT Act, it clearly empowers the State to pass a specific order to put on surveillance a particular computer for reasons to be recorded. Conferring a general power on various investigating agencies, as envisioned in the Notification, is definitely beyond the scope of Section 69 of the IT Act or of the IT Rules 2009 framed thereunder.
Under Section 5(2) of the old Indian Telegraph Act, 1885, or under the current IT Act, the authorisation to grant the authority to intercept was always to be case-specific. Empowering the investigating agencies to straightaway intercept a computer completely denudes the checks and balances in the scheme wherein the investigating agency was required to approach the Executive with justification to put on surveillance a computer (including smartphones), and then a third agency, which was the service provider, such as Airtel, BSNL etc., permitted the surveillance upon such authorisation.
Taking advantage of the Notification, the investigating agencies have bought software like Pegasus vide which they can directly intercept any computer (including smartphones) without the oversight of the Executive and the service provider. The erstwhile scheme, prior to 2018, always involved three agencies: the investigating agency, which first determines the need for surveillance; the Executive, which assesses whether this need is justified; and the service provider, which provides access based on the Executive’s decision. All these resulted in sufficient trail of documentation which could be called for in any court of law to justify the surveillance.
Now, the investigating agencies directly possessing software to intercept phone calls of anybody and everybody using a smartphone expose the citizens of this country to invasion of their privacy without any safeguards whatsoever. The Government of the day, under the current regime, can intercept the phones of important functionaries, including members of the media, political opponents, and senior members of the judiciary, which is clearly not empowered by the statutory scheme discussed above. It is for this reason only that the State, in answer to a Public Interest Litigation filed in the Supreme Court challenging the Government’s purchase of the Pegasus software, which could directly intercept a mobile phone, merely stated that the purchase is in accordance with law, without specifying which law permits them to do surveillance of an individual’s smartphone without authorisation.
In PUCL v. Union of India (1997) 1 SCC 301, the Supreme Court established detailed procedural safeguards under Section 5(2) of the Indian Telegraph Act, 1885, for telephone interception. The Court held that interception orders could only be issued by the Home Secretary or an equivalent authority and must be properly documented with written reasons. It further mandated the formation of Review Committees to examine these orders within two months, and if any violation was found, the order would be set aside and the intercepted material destroyed. While the Court did not require search warrants or prior judicial scrutiny for interception, it emphasised the necessity of robust procedural safeguards through documentation and systematic review to prevent misuse and protect individual privacy rights.
Rule 419-A of the Indian Telegraph Rules, 1951, codified these Supreme Court guidelines, reinforcing the principle that no organ of the Government should wield unchecked power, and each action should be open to review.
The same logic applies a fortiori to digital surveillance, which is more pervasive, more persistent, and more capable of revealing intimate details than traditional wiretaps ever were. However, the 2018 Notification undermines these principles by permitting surveillance without prior review or justification, interpreted as a wide and arbitrary extension of State power. As a result, citizens increasingly find their privacy reduced to a mere theoretical concept.
Every individual is potentially under constant surveillance, with little recourse or transparency about why and how they might be targeted. Such sweeping surveillance not only erodes civil liberties but also instils a sense of fear and vulnerability, lowering the dignity of citizens to mere subjects of bureaucratic scrutiny, available to be toyed with at any given moment.
The absence of checks may embolden agencies to act beyond the scope of legality.
The right to privacy is a fundamental component of Article 21 of the Constitution of India, which protects life and personal liberty. In the landmark case KS Puttaswamy (supra), the Supreme Court unanimously held that privacy is a guaranteed fundamental right, subject only to reasonable restrictions. The judgment established a three-part test to justify any State intrusion on privacy: the existence of a valid law sanctioning the intervention, a legitimate State purpose in the public interest, and proportionality of the means employed to the end sought.
The Court emphasised that while privacy is not absolute, any State action must be reasonable, narrowly tailored, and not excessive, reinforcing protections against arbitrary intrusions. This ruling has set a clear constitutional benchmark to evaluate privacy violations and requires the State to demonstrate necessity and exhaust less intrusive means before interference.
The civil liberties costs of normalised surveillance as envisioned by this Notification are not abstract. Pervasive monitoring has a chilling effect on free speech.
Opposition leaders may fear their communications will be mined for leverage; journalists may hesitate to pursue sensitive stories; whistle-blowers may choose silence to protect families; even ordinary citizens may self-censor. The most detrimental effect of this arbitrary action is the grave threat to the independence of the judiciary. If judicial officers are brought under surveillance, then there is a risk of undue influence in judicial decisions and a compromise of the separation of powers.
A democracy does not require overt censorship to become timid. It needs only ambient surveillance that makes people unsure of the private space in which they can think, dissent, and organise.
It seems that we have embarked on a regressive path, where we start with a just, fair, and accountable system of checks and balances and somehow end up at a manifestly arbitrary, unfair, and uncontrolled system of pure whims and fancies, which would gradually lead us into being an Orwellian State, if such laws are not criticised.
Some changes are crucial to protect the right to privacy of an individual, including restoring checks and balances, instituting clear procedural safeguards and regular reviews, ensuring clear justification and transparency in interception orders, and strengthening judicial oversight with proper redress mechanisms. The Notification under Section 69 of the IT Act and Rule 4 of the IT Rules, 2009 must be urgently withdrawn in order to uphold privacy as a core right protected under Article 21 of the Constitution of India.
The writer is a Senior Advocate at Supreme Court of India, President of the Supreme Court Bar Association and Former ASG, Government of India