Reports that many Indians have been targeted by the Pegasus spyware are disturbing but not surprising. Installing spyware on a phone is illegal if it is carried out by a private entity but India has no data protection laws, and has an opaque and arbitrary mechanism for authorising surveillance. A list of persons allegedly targeted by Pegasus was released by a multi-organisational investigation involving news organisations, cybersecurity specialists, and Amnesty International. The list includes over 1,000 Indians, including at least 40 journalists, several members of Parliament, including members of the ruling party, ministers and the Opposition, senior judges and civil