From Investigation to Surveillance: How Far May the State Go Legally?

Abstract

Criminal investigation and mass surveillance now share a technological infrastructure – the same CCTV feeds, the same databases of metadata, the same algorithmic methods. This article examines the boundary where legitimate investigatory activity crosses into constitutionally impermissible surveillance. It charts the development of the Indian legal framework from PUCL v. Union of India (1997) to Justice K.S. Puttaswamy (2017) to the Bharatiya Nagarik Suraksha Sanhita, 2023. This article contends that the absence of any dedicated surveillance legislation with independent judicial oversight systematically undermines India’s constitutional protections under Articles 19 and 21.

The Line of Gone

The line between a criminal inquiry and governmental surveillance used to be reasonably straightforward to draw. The investigation was reactive. A crime happened, a complaint was filed, a specific suspect was identified, and investigators collected evidence focused on that individual and that incident. Surveillance, in contrast, was proactive, general and — in a constitutional democracy – presumptively suspicious: the state observing, without cause and without limit, for criminality that could yet happen.

That difference is no more. The very same CCTV cameras that record the scene of a crime for retrospective inquiry give the raw data for real-time facial recognition of demonstration participants. Telecom providers are also required to retain such call-data records in bulk at the behest of the government, which the investigating officials are seeking under Section 91 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS). The same cell-site location data used to place a suspect near the scene of a crime may be used to track the activities of everyone in an entire city over months. Investigation and surveillance are no longer distinct tasks, carried out by distinct agencies with distinct legal authorisations. They share an infrastructure and that infrastructure has become a constitutional challenge of the first order.

This paper looks at where Indian law now draws – or fails to draw – the boundary between the two, why that line matters for every individual whose digital footprint travels through a state database, and what a constitutionally appropriate framework would look like.

What Constitutes a Constitutional Investigation

Criminal investigation is constitutionally legitimate on three counts. First, particularity: investigative powers should be focused at known persons or distinct offences, not at populations or political groupings. Second, cause: employment of investigative powers must be initiated on articulable grounds for suspicion – the ‘reason to believe’ criteria that runs through the BNSS and the PMLA alike. Third, oversight. Intrusive investigative conduct should be subject to prior or proximate judicial authorisation, so that the state’s evaluation of its own informational needs is not self-validating.

The Bharatiya Nagarik Suraksha Sanhita, 2023, which superseded the Code of Criminal Procedure with effect from 1st July 2024, modernises several investigation methods. Section 105. Sending of summons and notices by electronic transmission. Section 176 authorises production of documents and technological devices. Section 176(3) now requires a forensic assessment of crime scenes for offences that are punishable with a sentence of seven years or more. These are genuine, rights-respecting investigative tools: they are triggered by a specific offence, need cause and are subject to court scrutiny where coercive authority is applied.

Surveillance works according to a different rationale. It is forward-looking, not backward-looking. It is generic rather than specific. And it generally bypasses the requirement of a cause by treating everyone within its technical reach as a possible topic of interest. In the historic decision of the nine-judge bench in Justice K.S. Puttaswamy (Retd.) & Anr., the Supreme Court observed: v. Union of India & Ors., (2017) 10 SCC 1, any restriction on the right to privacy has to meet a four-fold test, i.e., that it is authorised by law, that it seeks to achieve a legitimate objective, that it is proportionate to the aim sought to be achieved and that it carries with it procedural safeguards against abuse. Mass surveillance is by definition poorly suited to the third and fourth of these conditions.

The Indian Surveillance Architecture: Power Lacking Law

A. The Statutory Scheme

India’s surveillance powers are based on a patchwork of statutory provisions that were not established as a unified framework and were not suited for the digital era. Section 5(2) of the Indian Telegraph Act, 1885 allows interception of telecommunications on the basis of public emergency or public safety — imprecise requirements that were brought in straight from the colonial period. Section 69 of the Information Technology Act, 2000 provides for interception authority to “any computer resource” on grounds including “sovereignty or integrity of India, defence, security of the state, friendly relations with foreign states, public order or for preventing incitement to commission of any cognisable offence”. The grounds are so broad as to provide virtually no meaningful constraint.

The procedural safeguards introduced by the Supreme Court in PUCL v. Union of India, (1997) 1 SCC 301 – that interception orders were to be issued by the Home Secretary and reviewed by a Committee headed by the Cabinet Secretary – have been criticised by civil society and academic commentators as inadequate as they are entirely executive in character. There is no court officer who authorises the initial interception. At no time, before or during the surveillance period, is its legality reviewed by a court officer. The only oversight is within the executive branch. 

In Vinit Kumar v. Central Bureau of Investigation & Ors. 2020. The Bombay High Court (Bom. HC, 2019) had a chance to apply the Puttaswamy proportionality framework to a specific interception order and held that orders issued without showing a rational connection between the particular interception and the stated public-safety purpose failed the constitutional test. This was a notable post-Puttaswamy application of the four-fold proportionality test to surveillance, but it is, all the same, a lone decision of the High Court with little precedential effect.

B. Digital Investigative Powers and the BNSS

The BNSS 2023 has crucial but vague measures on digital investigation. Electronic devices and digital records are now specifically included in Section 94 (production of document or object) and Section 96 (search warrants). 185. Power of search and seizure of electronic evidence. These are powers of investigation – directed at particular cases, requiring approval by a Magistrate for search warrants, and subject to the criterion of relation to a particular offence. 

But the BNSS does not contain real-time surveillance, bulk data retention or the application of artificial intelligence to predict and monitor. These deficiencies are not technological oversights – they are symptomatic of the lack of any formal framework in Indian law that recognises, regulates or constrains the state’s potential for mass digital monitoring. This results in surveillance activity much in excess of what would be required by any particular criminal investigation, conducted under statutory provisions that were never intended to sanction it.

C. Evidence of Practice: Pegasus, NATGRID

The exposure of Pegasus spyware in 2021 laid bare the chasm between the constitutional standards laid down by Puttaswamy and the ground reality of state surveillance in India. Through investigative journalism by an international consortium, it was revealed that mobile devices of journalists, politicians, activists, lawyers and constitutional functionaries in India were targeted with military-grade surveillance software. The Supreme Court’s technical committee established to investigate the allegations found that it was “unable to establish that any of the devices were infected with Pegasus”, but noted that the government had refused to cooperate with the investigation, which the Court’s own report described as an impediment to inquiry.

Operational since 2013, the National Intelligence Grid (NATGRID) combines data from 21 federal agencies including income tax, immigration, banking and telecom records to generate detailed profiles of individuals for security purposes. No particular statute authorises NATGRID. There is no method of judicial oversight for its functioning. No data subject can know if they have been profiled, access the data kept about them, or contest the data’s veracity – rights Puttaswamy clearly anticipated as dimensions of the right to informational privacy.

The Investigation-Surveillance Spectrum: Critical Legal Tests:

1. Legitimate investigation: Specific suspect or offence; reason to believe; judicial permission for coercive steps; evidence aimed at accused conduct. 

2. Constitutional surveillance (Puttaswamy test): Lawful; legitimate objective; reasonable; procedural safeguards include independent review. 

3. Unconstitutional surveillance: Targeting of the general public; without articulable cause; without court permission; without meaningful scrutiny; detention beyond specified investigative need.

4. The present Indian reality: Pre-digital, hazy statutory basis, judicial control absent at the permission stage and no specialised surveillance legislation.

Where The Line Of The Constitution Should Be

Puttaswamy’s response, which the Indian Parliament has yet to convert into statute, is that the constitutional boundary between investigation and surveillance runs at the point of detail and proportionality. It is constitutionally permissible to conduct investigations against certain suspects for specified offences, authorised by magistrates with a recorded cause and for the minimum period necessary to collect relevant evidence. General, anticipatory monitoring of populations, done without cause and without judicial review, is not, regardless of the statutory instrument that would theoretically permit it.

This gives rise to several concrete regulations. First, mass interception of telecommunications and bulk retention of metadata, where metadata is held for possible future use in investigations that have not yet begun, cannot meet the proportionality criteria. This is precisely the finding of the European Court of Human Rights in Big Brother Watch and Others v. United Kingdom (GC), (2021) when it determined that the UK’s bulk interception scheme did not have adequate end-to-end safeguards in place. The equivalent practices in India under Section 69 of the IT Act are subject to lower safeguards than the framework which the ECtHR found deficient.

Secondly, the use of face recognition technology in public settings for general purpose identification, as opposed to focused post-hoc identification, when considering a specific, serious investigation, cannot be justified under the Puttaswamy test. This argument is echoed in binding legislation in the Real Time Biometric Identification restriction in Article 5 of the EU’s AI Act 2024. It’s not like anything else in India.

Third, for predictive policing systems, profiling individuals as crime risks based on prior records, location, and sociodemographic characteristics, where there is no specific cause for suspicion of a current offence, offends the particularity requirement that supports a legitimate investigation and the proportionality requirement under Puttaswamy. At their heart they are monitoring systems disguised in the rhetoric of law enforcement.

What is Required for a Sufficient Legal Framework

The most glaring shortcoming of constitutional governance in the digital era in India is the absence of specialised legislation on surveillance. Such legislation would need to include at least the following: the conditions under which any form of real time surveillance may be authorised; the requirement for prior judicial (rather than executive) authorisation for all targeted surveillance; strict time limits on the retention of data obtained by surveillance; an independent oversight body with the power to review authorisations and to receive individual complaints; and notification to individuals that they have been the subject of surveillance, at a time when notification is compatible with the continuing investigation.

The Digital Personal Data Protection Act, 2023 is a step in the right direction for the private-sector data economy, but it explicitly exempts the processing of personal data ‘in the interest of sovereignty and integrity of India, security of the State, and maintenance of public order’ — the same nebulous grounds under which surveillance is currently conducted. That is, the exemptions remove the most constitutionally suspect surveillance from the Act entirely.

Summary

The question of how far criminal inquiry can go before it becomes surveillance is not an intellectual abstraction. It is the question that decides if Indians who attend political gatherings, consult attorneys, talk to journalists or just pass through public spaces have any meaningful sphere of privacy against the state’s growing power to see, record and evaluate their behaviour.

Puttaswamy makes the constitutional response clear: the right to privacy is fundamental, and any encroachment upon it must be authorised, necessary, proportionate, and subject to independent scrutiny. The legislative response, however, is virtually nonexistent. Until Parliament enacts comprehensive surveillance legislation that translates the Puttaswamy framework into specific, enforceable procedural rights, Indian citizens will continue to live in a constitutional democracy whose newest instrument of state power—its digital surveillance infrastructure operates beyond the constitutional law that was meant to contain it.