Violation of rights of Indian citizens allegedly by governments at the centre and various states on privacy in terms of communication facilities is nothing new and such violations by international tech companies is a serious issue. Such violations become all the more serious in nature since India is a constitutional democracy where the highest court has read the right to privacy in the right to life and liberty for every citizen of the country. The latest disclosures in some US newspapers that in the backdrop of lawsuit by Facebook Inc against an Israeli cyber security firm NSO that ‘governments and companies need to do more to protect vulnerable groups and individuals’ has become a big scandal in itself. The Facebook reference to spyware attacks like the one that the messaging platform succumbed to from Pegasus, a malicious software developed by NSO needs to be taken seriously by the Indian government. The reports in various newspapers indicate, WhatsApp has disclosed that a ‘not insignificant’ number of Indian journalists, rights activists and lawyers were targeted using Pegasus. The Facebook is right particularly in placing the responsibility on both the tech companies and governments in ensuring the privacy of the citizens. This is significantly important when WhatsApp has claimed that its end to end encryption makes its platform a safe and private way to communicate. This claim is being now contested. How the tech company responds will signal whether its invocation of privacy as a first principle is more than a mere marketing ploy. The proceedings of the ongoing lawsuit will be closely watched, to track the culpabilities and complicities of the actors involved. Only earlier this year, NSO severed its contract with Saudi Arabia after accusations by a journalist that its software was used to hack his phone, which allowed Saudi agencies to track journalist Jamal Khashoggi, who was assassinated in Istanbul. The fact remains that in the digital age, companies will emerge and operate in the grey areas of the intersection between technology and security to make a profit. But inviolable as it is, national security must not be used as a shield by either governments or private players to justify the violation of fundamental rights. In the government’s first response after the Pegasus hack, Law and IT minister Ravi Shankar Prasad has said he has asked WhatsApp to explain the breach, while the home ministry has said it will take strict action against those violating the law. Earlier, the Indian government and parliamentary committees have summoned executives from Facebook and Twitter, and Indians continue to be the largest user base for WhatsApp. In the backdrop of this development it is important to note that India also enjoys close ties with Israel. The government must leverage this to hold NSO to account. And it must deliver on its promise to punish anyone, whosoever they may be, found guilty of unlawfully violating the privacy of Indian citizens. The idea of data sovereignty must include a citizen’s right to privacy. Till date, NSO has refused to name its clients and has long maintained it sells its software exclusively to governments. The system requires an estimated 4 weeks of testing on local networks, suggesting the company would need ready and prolonged access to local mobile and internet networks to work properly. This suggests two troubling scenarios. Firstly, the Indian government is the culprit behind the snooping in India. Some reports reveal that the software, which lets a trained operator hijack the microphone, camera and GPS tracker of a targeted phone, read all messages, and snoop on all calls, had been deployed to snoop on activists, lawyers and public intellectuals involved in the Bhima-Koregaon case. Secondly, equally troubling scenario is that a group of Indian lawyers, activists and intellectuals were spied on by a foreign government, with the knowledge and sanction of Israel’s defence ministry, and with ready and prolonged access to Indian mobile networks. How the NDA-government deals with the aftermath of the WhatsApp hack will demonstrate its commitment to that principle, as well as to the rights enshrined in the Constitution.