India's Digital Surveillance Architecture: A Map for the Uninitiated

India has quietly built one of the most extensive digital surveillance architectures in any democracy. No single law authorises it. No single agency controls it. It runs on executive fiat, post-26/11 urgency, and a 1.4-billion-person identity database that was supposed to be "just verification."

The Architecture

India's surveillance stack is a layered system. Each tool covers a different attack surface, and together they form a 360-degree profile.

System	What it does	Legal basis
NATGRID	Links 20+ databases for real-time intelligence queries — travel, banking, telecom, Aadhaar, social media	Executive order, no statute
Central Monitoring System (CMS)	Real-time interception of calls, texts, and internet traffic	Section 69, IT Act
Facial Recognition & Ikshana	Live crowd scanning via FRT vans at protests and public spaces	None confirmed
Aadhaar & Identity Infrastructure	1.1 billion+ biometric records, increasingly linked to other systems	Aadhaar Act (limited scope)
Internet Shutdowns	Cutting connectivity to control information flow during protests	Telegraph Act, Telecom Suspension Rules
Pegasus & Spyware	NSO Group's Pegasus used against Indian journalists, activists, politicians	Supreme Court investigation (sealed report)

CMS listens to what a suspect says, while NATGRID tracks where they go and what they own — together forming a 360-degree profile.

The Legal Framework

India's surveillance regime rests on a patchwork of laws, none of which alone authorises the full stack.

Puttaswamy judgment (2017) — Declared privacy a fundamental right and set a three-part test: legality, legitimate aim, proportionality.
DPDP Act 2023 — India's data protection law, with sweeping government exemptions for "security" and "public order".
Section 69, IT Act — The government's catch-all interception power.
Section 5(2), Indian Telegraph Act, 1885 — The colonial-era interception law.

The gap: India has a right-to-privacy judgment and a data protection law, but no comprehensive surveillance reform legislation. No judicial oversight for interception. No statutory basis for NATGRID, FRT, or many other systems.

The three-part test, applied to the architecture:

Test	Fails for
Legality	NATGRID (no statute), FRT (no enabling law), CMS interception (Section 69 too broad)
Legitimate aim	NATGRID's expansion into routine financial/civil cases, FRT matching against "habitual offender" databases
Proportionality	Mass facial recognition (scanning every face to find a few), NATGRID's 119-crore-person NPR integration, CMS interception without individualised suspicion

The Resistance

Organisation	Work
Internet Freedom Foundation (IFF)	Strategic litigation, RTI campaigns, Project Panoptic (tracking FRT deployments), challenging shutdowns in court
Garudex	The counter-surveillance project — a platform for documenting surveillance sightings in India, unfollowme-inspired
Project Panoptic	IFF's tracking of government facial recognition deployments across India using RTIs, public reports, and legal notices

"Pack up mf we are gonna fuck this shit up" — the moment Garudex was born.

The Thread

This interest didn't start in 2026. It traces back to Snowden and Assange. The YouTube search history shows a clear arc:

2021: Snowden/WikiLeaks/Anonymous explainers — theory
2022: Pegasus spyware coverage, Edward Snowden on NSO Group
2023: "Understanding NSO Pegasus Spyware" (email newsletter), "Watch the Watchmen #2: The Centralised Monitoring System (CMS)" (YouTube)
2026: "natgrid mass surveillance india", "state of mass surveillance india", "citizen four" (×4 watches), the Garudex build, the CJP protest surveillance documentation

The ideological interest became a practice — from watching Citizenfour to building the tool that Citizenfour's subjects needed.

Key Takeaways

No single law authorises the whole system — it's a stack of executive orders, colonial-era laws, and regulatory gaps.
The three-part test is consistently failed — legality, legitimate aim, and proportionality all break down across the architecture.
Aadhaar is the connective tissue — not a surveillance tool itself, but the identity infrastructure that makes every other surveillance tool more powerful.
Shutdowns are surveillance-adjacent — they don't just block communication; they push people onto channels that are easier to tap (SMS, calls → CMS).
The resistance exists — IFF's litigation, Garudex's documentation, Project Panoptic's tracking — but the legal and institutional gaps remain vast.

Co-authored with my second brain, Obsidian.