Eyes in the street

KIRAN KARNIK

PEGASUS no longer has wings and is dead in the media. One refers not to the winged horse from Greek mythology, but to the eponymous computer software. The latter created quite a storm and got extensive media coverage some weeks ago, before it was ousted by other “breaking news”. Yet, a debate on it needs to stay alive, as it raises many important issues. Pegasus is the surveillance software — or “spyware” — developed by Israeli cyber security firm NSO. According to reports, it was used by government agencies in India to tap into the phones of various individuals, presumably to safeguard national security or ensure law and order. Apart from specialized cyber security companies, non-formal hacker groups and state agencies in some countries are known to have the capability (often used) to penetrate the computer systems of other countries or even individual devices like cell phones.

Pegasus, one example of this, is said to not only be able to listen in on conversations and steal all the data stored in a cell phone (messages, contacts, videos, data, notes, etc.), but also to turn on the microphone or camera of the device. If this is not scary enough, note that the spyware gets automatically installed through a WhatsApp call made to your number — i.e., without your knowledge. Moreover, it apparently has auto-destruct capability, making it virtually impossible to prove that your phone was hacked.

These enormous capabilities have given rise to a serious outcry in many countries, especially when reports indicated that countries were using Pegasus to spy on the leaders of other nations; also that, in many cases, domestic human rights activists and dissenters were spied upon by their government. The company (NSO) defended itself by saying that it sold the spyware only to select governments. Even if this is truly so, governments will inevitably use it for their own ends — both domestically and in the global arena. Most recently, for example, there are media reports of a leader from the UAE (the ruler of Dubai) using it to spy on his ex-wife and her lawyers. Some reports indicate that in India it was used to spy on various activists. A case on this is now in the courts.

How ethical is such surveillance? The infringement of privacy is justified by governments on the grounds of security or public order. Many — probably a majority in most countries — see this as appropriate: overall good (protection against terrorism) must take precedence over individual concerns. It is seen as analogous to security measures and searches at airports (and now in many other places): a nuisance, but accepted as necessary. Another, or additional, rationale is “if you have nothing to hide, why should you worry?”

Similar concerns and views are expressed with regard to surveillance cameras in public places and face-recognition software. Two Indian cities (Delhi — at number one — and Chennai) are amongst the global top 10 in terms of density of cameras. Most of the others are, expectedly, in China; but London too figures in the list. One increasingly important role that these cameras play is face recognition. While this helps to identify terrorists and criminals, it takes away individual anonymity. Is this aspect important at all? If so, does the possible advantage of identifying rotten apples outweigh concerns about individual privacy? While it may serve to expose the rendezvous of one terrorist with another, it would also reveal secret trysts of lovers. Does this provide scope for misuse and blackmail?

The growing number of surveillance cameras is indicative of worries about terrorism, but more so about public order and safety. In this context, it is odd that some Delhi leaders took pride in its being number one, seeing it as an accolade. The very requirement for such high camera density is an indicator of poor safety and is, therefore, a negative comment on the city. As an analogy, one recalls from earlier years the huge number of household gensets in Kolkata, whereas most homes in Mumbai did not even store candles: both indicative of the state of power supply in the two premier metros.

Concerns about privacy have led to a lot of discussion about use of facial recognition software. San Francisco banned its use by police in 2019. An additional concern stems from the fact that surveillance capabilities (and the data collected) are also with private companies. Even those who believe that the government will do things only for the larger public good may have serious worries about surveillance when they realize that it may well be private companies that are involved. Combining data captured from your cell phone with that from surveillance cameras plus using facial recognition can reveal where you went — which shop, restaurant or office — when, and for how long; what you ate or purchased; whom you met or called; what messages you sent or received; which websites you visited, and a whole lot more. In addition, it can find out (from other phones) what your colleagues or friends are saying about you. In short, someone in some company may know more about you than you do.

This raises important issues of ethics. Should camera coverage be restricted? Should data from this be strictly limited to only some agencies, with constraints on its use? Should facial recognition software be used at all? If so, where, by whom, in what circumstances and with what limitations or safeguards? Should we push for global covenants constraining the use and sale of spyware? Technology itself is arguably neutral, but how it is used is not. Here, what is our ethical framework? As we inevitably move to a surveillance state and surveillance capitalism, these and other questions (including more difficult ones from genetic engineering) about ethics and technology deserve serious debate.

Kiran Karnik is an independent strategy and public policy analyst. His recent books include eVolution: Decoding India’s Disruptive Tech Story (2018) and Crooked Minds: Creating an Innovative Society (2016). His latest book, Decisive Decade, is on India in 2030.