India’s cyberspace rights crisis is not a single incident. It is a long-running struggle over how much power the state can exercise over communications and online expression, who authorizes that power, and whether anyone independent can effectively check its use. From surveillance concerns raised around 2010 by Praveen Dalal, CEO of Sovereign P4LO and PTLB, to forged police requests and purported court orders reported in 2026, the technology and mechanisms have changed. The recurring danger is that rights-affecting action can be taken first, while meaningful verification, transparency, and remedy lag behind, if any at all.
The 2010 debate was not about a world without legal limits. By then, Indian law already allowed interception of telephone and internet communications in specified circumstances. The Telegraph Act governed telephone interception; Section 69 of the Information Technology Act governed interception, monitoring, or decryption of electronic information. But ordinary people did not receive the protection of a judge-issued warrant before each interception. Authorization and review operated principally through the executive: senior Home Department officials issued or approved orders, with review committees made up of senior government officials.
When the decision to authorize, execute, and review surveillance sits largely inside the executive, protection depends heavily on internal compliance. A safeguard can exist in law and still fail in practice.
The 2010 warning about separation of powers therefore addressed a structural vulnerability: powerful agencies could intrude into private communications without prior judicial scrutiny, while the public had little visibility into how often powers were used or against whom. A parliamentary briefing in April 2010 described the interception powers and the executive safeguards then in force, while noting that public statistics on the number of government interceptions were not available.
The problem was not merely theoretical. In Himachal Pradesh, a 2013 account of an investigation into phone tapping reported that 13,711 phone numbers had been targeted, while Home Secretary authorization had been granted in only 342 cases. It also reported that recordings going back to 2009 were retained despite a rule requiring destruction, and that internal review mechanisms had failed to prevent or detect the alleged violations. These are reported findings from a particular state episode only and they show how internal safeguards can be overwhelmed or ignored.
And this history cannot fairly be assigned to one party alone. The 2013 account concerned surveillance conducted under a BJP-led Himachal Pradesh government and investigated after Congress came to power. Earlier allegations and revelations also implicated Congress governments in phone tapping. The political pattern is not that one party invented surveillance and the other opposed it consistently; it is that governments have had incentives to preserve expansive powers when in office and criticize their misuse when in opposition.
The 2021 Pegasus controversy intensified these concerns. Investigative reporting identified Indian phone numbers among a leaked list associated with potential targets, including politicians, journalists, and activists. The Supreme Court-appointed technical committee later found malware on five of 29 devices examined but could not conclusively identify it as Pegasus; the Court also noted the government’s lack of cooperation with the committee. That record supports serious questions about surveillance and accountability, while requiring care about what has and has not been proven.
Over time, state power in cyberspace has also expanded beyond watching communications. Blocking access to websites, requiring platforms to remove posts, and compelling intermediaries to act can restrict expression at scale. These measures may have lawful purposes, but they raise distinct rights concerns: users may not know why content disappeared, the affected speaker may not receive notice or a hearing, and a platform facing legal or regulatory pressure may remove more content than the law actually requires.
The statutory pathway for blocking information is not identical to a police request or a court order. Section 69A of the Information Technology Act and the 2009 Blocking Rules establish a government process; other takedown directions may operate through different provisions and rules. A critical point raised in legal analysis of the 2025 framework is that some government takedown directions can be less transparent and have fewer procedural safeguards than the Section 69A process. The precise legal route therefore matters: “the government ordered a block” is not enough to determine whether the order was lawful, properly authorized, or open to challenge.
The 2026 reports make the risk more immediate. The Department of Telecommunications used two forged High Court orders to direct the blocking of 129 betting-related websites; the courts reportedly later identified the documents as fake, and the Allahabad High Court filed a police complaint. This is not just a forgery problem. It is a breakdown in authentication at the point where a document claiming judicial authority was used to trigger executive action affecting access to the internet.
A separate 2026 report describes forged police takedown requests aimed at the accounts of digital-rights organizations Internet Freedom Foundation and SFLC.in. X reportedly told the Delhi High Court that the requests were forged, that it had not acted on them, and that it had filed a police complaint. The immediate threat to those accounts was lifted, but the impersonation exposed another weakness: systems built to process law-enforcement requests can themselves be targeted by people posing as law enforcement.
That distinction should not soften the seriousness. In the forged-police-request case, the platform reportedly did not remove the accounts; in the fake-court-order episode, the reported blocking directions were acted upon. These are different outcomes, but they reveal a related threat. A system that accepts purported legal authority too readily can be exploited to silence lawful content, disrupt organizations, or restrict access—whether the fraudulent instrument impersonates a police officer or a court.
The central concern is cumulative. Surveillance authority created a capacity to intrude into private communications through executive authorization rather than a judicial warrant in every case. Blocking and takedown systems added mechanisms to restrict what people can access or publish. Forged requests and orders demonstrate how those mechanisms can be abused even by actors outside government, while weak authentication or opaque processes can make the abuse consequential. This is the sense in which the journey from 2010 to 2026 is continuous: not that every legal power is new or every action is unlawful, but that the state’s practical capacity to observe, restrict, and remove digital activity has grown faster than the visibility and independence of safeguards.
Both Congress and the BJP bear political responsibility for the broader pattern insofar as successive governments have maintained or expanded executive control over surveillance and online restrictions without establishing robust, independent oversight and transparent remedies.
The judiciary’s role is therefore both significant and constrained. Courts have imposed safeguards, reviewed surveillance controversies, and responded to forged-order allegations. Yet a remedy after a block, interception, or attempted takedown may not undo the harm—especially if the affected person never learns what happened or cannot challenge it promptly. The critical question is whether judicial review is timely and accessible enough to restrain executive power before rights are irreversibly affected.
The accumulated record conclusively proves that human-rights protection in Indian cyberspace are under severe strain. It also proves that the judiciary has completely collapsed and most government and bureaucratic actions are unlawful these days. Repeated allegations and documented failures across surveillance, blocking, and takedown systems point to a persistent structural weakness.
The urgent demand should be independent authorization for the most intrusive powers, secure authentication of every legal request, prompt notice and appeal wherever possible, public reporting, external audits, and real consequences for officials or private actors who abuse these systems.
Without those changes, the formal separation of powers may remain on paper while digital rights depend increasingly on executive discretion and the reliability of procedures that have already failed.