How Aadhaar is Changing the Rules of Surveillance in India

Imagine someone, a stranger, knew where you were at all times. Who you were talking to, how long you spoke. What you normally buy, how much you have in the bank. Whether you receive financial assistance, your medical history. What time you go to sleep, what time you wake up. This can be easily deduced from obtaining your call history, internet traffic and bank details. By linking your mobile number and bank account to Aadhaar, it is possible to know roughly where you are, which ATMs you usually use, where you usually spend, how much you usually withdraw, who you talk to, as well as how often you talk to them. By submitting Aadhaar details to your Internet Service Provider (ISP) you provide information to the UIDAI pertaining to what you browse, how often you browse, when you sleep and when you wake. In this way, by obtaining your Aadhaar details, a stranger can have access to everything you do.

At first, the privacy concerns were regarding the biometric identification. This was merely a ruse; the valuable information is the metadata provided by linking each and every aspect of a citizen’s modern existence to Aadhaar. Metadata, or big data, consists of all the seemingly minor details of one’s life being seen as a whole. For example, paying for medical bills and vehicle repairs can be inferred as someone got into a traffic accident. Yet individually medical bills and vehicle repairs need not mean that an accident took place. In this manner, Aadhaar provides a platform for aggregating information and thus creating metadata.

According to Black’s Law Dictionary surveillance is defined as “observation and collection of data to provide evidence for a purpose.” Surveillance in India is governed by several laws such as;

1. Indian Telegraph Act, 1885

2. Indian Telegraph Rules, 1951

3. Information Technology Act, 2000

4. Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009

5. Information Technology (Procedure and Safeguards for Monitoring and Collecting Traffic Data or Information) Rules, 2009

6. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

7. Information Technology (Intermediaries Guidelines) Rules, 2011

8. Information Technology (Guidelines for Cyber Cafe) Rules, 2011

9. Code of Criminal Procedure, 1973

The Indian Telegraph Act and Indian Telegraph Rules provided that only in the event of a ‘public emergency’ or in the interest of ‘public safety’ can the government – both Union and state – intercept or ‘detain’ such communications. Since the terms ‘public emergency’ and ‘public safety’ were not defined in the Act or the Rules, in PUCL vs. The union of India the Supreme Court of India defined the terms as “the prevalence of a sudden condition or state of affairs affecting the people at large calling for immediate action”, and “the state or condition of freedom from danger or risk for the people at large”.

While the Indian Telegraph Act and Rules made it mandatory for the Union or State Governments to record the reason for which a phone line should be tapped, in the Information Technology Act, and the subsequent Rules framed, such a condition was removed and the process simplified meaning that a police officer upon receiving a complaint can demand that communications be handed over. The condition that there should be evidence that an offence has been committed or is about to be committed was removed, as the provisions of the IT Act concerning such surveillance are governed by the procedure under the Criminal Procedure Code. These laws make it clear that in India, surveillance is done for the purpose of criminal investigation.

Theoretically, surveillance is a form of social control. Jeremy Bentham became infamous for the ‘Penitentiary Panopticon’, wherein the jailers or the warden would occupy the middle of the structure in such a way that they would be able to at all times observe the inmates. Punishments for infractions were carried out to inform the prisoners that they were constantly being watched. However, in his subsequent panopticon variants such as an old people’s home, ‘pauper house’, and even for the government, the level of surveillance was toned down though controlling behaviour was still the purpose.

Foucault expanded on the penitentiary panopticon by exposing how it is applied in various aspects of a citizen’s modern existence, such as the architecture in schools which allow for people to observe what happens inside a classroom from the outside without being noticed. The point being that the fear of being watched is a greater tool for controlling behaviour than actively being watched. This carries over into the process of giving and passing exams, through which individual worth becomes quantified within a standardised system. The change to be noted in Foucault's version of surveillance is the idea of the ‘control society’ wherein citizens are constantly being watched by their peers and others around in order to ensure everybody conforms to the ‘norm’. This, therefore, erodes the individual to be a part of a whole rather than a multifaceted personality.

Later Deleuze looked at surveillance from the perspective of corporations wherein different aspects of the market are constantly monitored. Individuals are thus looked at as both labourers as well as consumers. Both of which need to be controlled to ensure the corporations can continue to operate. The shift from the State carrying out surveillance to corporations carrying out surveillance can be linked to technology progressing at the pace it has in the past three decades.

Zuboff has been expanding what is termed as ‘surveillance capitalism’ in which the commodity is the metadata and the purpose for which it is collected is to influence individual behaviour in terms of consumption. Facebook and Google run their business on the basis of surveillance capitalism wherein targeted advertising can take place. For example, a person can look up on the Google search engine for a car, the next time the person logs on, there will be advertisements to sell for the same car, if not offers to buy the car.

These theories on the face of it appear benign considering how our personal details have been stored on various servers, often with us volunteering the information. In this regard, Aadhaar being for the purpose of ‘targeted delivery’ of services and for ensuring ‘good governance’, as well as ‘security’ and to counter ‘tax evasion’ does not appear to be as bad. The refrain ‘if you have done nothing wrong what do you have to hide?’ is often used when dealing with Aadhaar as well as various other tools of surveillance used by other governments across the world. However, Aadhaar changes the rules regarding surveillance in India. As mentioned earlier, surveillance in India is done to uncover criminal wrongdoing. However, the laws regarding surveillance make it clear that surveillance is done only in the specific circumstance that a person or group of persons have committed or are likely to commit an offence. AADHAAR how Aadhaar aggregating data places each and every citizen – not to mention the foreign nationals who may also have obtained an Aadhaar identity – is automatically placed under de facto surveillance.