Q: What do you understand by spywares? Analyze the threats of such cyber-attacks pose to the national security of the country & the need for strengthening personal data laws to ensure the right to privacy of individuals in the light of recent Pegasus attack in India.

HINTS [DOWNLOAD AS PDF]

Spyware is loosely defined as malicious software designed to enter your computer device, gather data about you, and forward it to a third-party without your consent, in a way that harms the user. For example, by violating their privacy or endangering their device’s security.

Modus operandi/effects

• Through whatsapp call (picked/unpicked) >Planting easily without even clicks
• Can add/retrieve data Track social networks, calls and messages
• Can be deleted remotely without evidence to trace.

Threats posed by cyber-attack to national security.

1. Threat of espionage & tracking confidential data : Severe concern at times of war or border conflicts like with china and Pakistan
2. Monitoring and manipulation: Can cause failure of operations or programs and burden socio-economic progress.
3. Political threat: It has the capacity to attack the process of country like in previous US election.
4. Law and order problem: Can give rise to communal riots and surge of internal unrest to disrupt law and order. Eg: Muzaffarpur riots.
5. Balance of power harmed: Executive snooping on other organs such as judiciary harms the democratic credentials.
6. Institutional breakdown: Denial of services (DoS) attack can disrupt core sectors in a country. Eg: Ransome ware attack (wannacry).
7. Turning to surveillance state: It undermines values of democracy and may change democratic state to surveillance state.

Need to strengthen personal data law

1. Rising penetration of electronic gadgets and tools. Eg: Smart phone, devices connected to IoI or AI
2. Rising frequency of such attacks and changing nature of attacks with advance in technology. Eg: Diminos & mobikwik data breach.
3. Lack of laws clearly governing spyware attack urges need of data protection authority responsible for vigilance.
4. Government opacity in existing laws (IT act 2000 / telegraph act) giving unchecked power to government.
5. Lack of data privacy and freedom for entities to collect and use data for different purposes.
6. For defining powers of investigation agencies like NIA.
7. Constitutional and legal backup as in Puttuswamy case ruling right to privacy as crucial.

Data is new oil in 21st century and protection is very important. Need of the hour is to clearly defining boundaries of IT act and telegraph act with a legislation of data protection bill inline with European laws.