IT parliamentary panel meets experts to discuss data security, privacy

The parliamentary standing committee for information technology held a three-hour-long meeting with WhatsApp, cybersecurity experts and representatives from the telecom and home ministries to seek their views on citizen's data security and privacy.

The committee, headed by Congress Member of Parliament Shashi Tharoor, was initially scheduled to hold the meeting on December 11. 
 

People familiar with the proceedings said independent cybersecurity experts from a private consulting firm, technology lawyers, government officials and WhatsApp representatives were asked questions about the Pegasus spyware and the larger issues surrounding surveillance, hacking and remedial measures.
 

In October, WhatsApp had sued the NSO Group, an Israeli firm that had developed and sold a software called Pegasus. This software misused the Facebook-owned messaging platform to spy on 1,400 people globally, of which 121 were Indians, according to WhatsApp. 
 

The NSO Group has always maintained that it sells its software only to governments, and that what what it said in both the Friday parliamentary committee meeting and the one held on November 20. At least three victims of the spyware breach were present at the meeting on Friday. 

The questions to the government representatives centred around the remedy available to a person who gets spied upon. In response, the government officials said the affected people can file a first information report (FIR) at their local police station. The committee members wanted to know if there was a larger policy or law that governs such cases. The victims were also questioned about why they did not lodge FIRs once they were informed.
 

“WhatsApp was asked about who found out about the breach first -- the company or Citizen Lab, and what is the status of the lawsuit it filed against NSO. They answered some of the questions while they have asked for more time to respond to some,” said a member of the committee, who did not wish to be named because the proceedings are confidential.
 

The government representatives, it is learnt, did not provide answers on whether the NSO Group was contacted by any government department and who played the decision to buy such software.
 

Citizen Lab is the independent Toronto-based research organisation that worked with WhatsApp and reached out to the victims to inform them of their rights.
 

One of the committee members in the meeting asked one of the victims if they were offered compensation for the breach of their data. The issue of the Indian setup and accountability of WhatsApp’s grievance officer was also raised. WhatsApp has a grievance officer who is based in the US. 

On Wednesday, Tharoor tweeted saying the Speaker had asked him to "postpone the meeting in view of a 3-line whip issued by BJP to its Rajya Sabha MPs, which would make it impossible for them to attend. I specifically asked the Speaker whether his request affected all committee meetings scheduled for today. He assured me it did. I am shocked to learn that the other committees held their meetings and ours was the only one not allowed to meet. Does the govt have something to hide?" 
 

It is learnt that the next meeting could be held in January, after which a report will be submitted. The government had earlier questioned WhatsApp about the breach. On November 20, the parliamentary panel had met secretaries of the ministries of electronics and IT, home affairs and department of atomic energy.

That meeting took on a political turn with members taking sides according to their political affiliations. The ruling alliance members were largely opposed to taking up the WhatsApp issue, but Opposition leaders were in favour of discussing it. 

A few days earlier, in the ongoing session of Parliament, Ravi Shankar Prasad, minister of IT and telecom, told the Rajya Sabha that the government had sent a notice to the NSO Group. However, he provided no further details.