A government does not need to hack your phone or step inside your country to watch you anymore. It may not even need to notify you, or ever be held accountable.
Across the world, AI systems are being built that can track, sort, and analyse people at scale. It began as “smart city” tools, like facial recognition at traffic signals or CCTV analytics, and has grown into something far more expansive.
What Sam Altman described as “non-domestic surveillance” points to a growing legal and technological gap: states can use AI systems to monitor people who are not their citizens, often with far fewer safeguards than those applied at home. In practice, that means your public posts, networks, and behavioural patterns can be analysed from across borders, without crossing a single legal threshold you would recognise as surveillance.
For countries like India, where user data routinely flows through global platforms, this raises the question: if a foreign government builds a behavioural profile using publicly available data, does Indian law even recognise that as surveillance?
To understand where the legal boundaries lie—and where they don’t—Decode spoke to cybersecurity and cyber law expert Prashant Mali.
Mali, a practising advocate at the Bombay High Court in Mumbai, specialises in cybercrime, data protection, AI regulation, as well as trademark and copyright law. A published author, Mali has written eight books on cyber law, cybercrime, data protection, and the General Data Protection Regulation, the European Union’s comprehensive data protection framework.
Here are the edited excerpts from the interview.
From a legal perspective, what exactly does “non-domestic surveillance” mean?
Legally, non-domestic surveillance refers to the monitoring of foreigners or foreign entities outside a country’s borders, often without the same stringent warrant requirements that apply to a state’s own citizens. For instance, US laws like the Foreign Intelligence Surveillance Act (FISA) allow targeting of non-Americans abroad for intelligence purposes.
In the context of Sam Altman’s remarks, it points to governments surveilling non-citizens, something he suggested may be inevitable, even if undesirable. Compared to domestic surveillance, which is constrained by constitutional protections like the Fourth Amendment, non-domestic surveillance typically operates with fewer civil liberty safeguards. In simple terms, it is foreign intelligence gathering with relatively lower legal thresholds.
If AI-driven surveillance can operate silently across borders, is it possible that individuals or governments being surveilled may never even know it is happening?
Yes, and this is where AI significantly changes the equation. AI enhances the stealth of surveillance by enabling large-scale, invisible data analysis through tools like facial recognition, automated scraping, and pattern detection.
Unlike traditional surveillance methods, there may be no physical intrusion or obvious signal, no alerts, no traceable entry point. Systems can continuously monitor and analyse data across borders in real time. In many cases, detection becomes extremely difficult unless there is a leak, whistleblower disclosure, or a technical audit. This makes modern surveillance far more discreet, often leaving those affected completely unaware.
If a foreign government were to surveil an Indian citizen located in India, what legal recourse, if any, would be available under Indian law?
This is a complex and challenging situation. An affected individual could potentially approach the Supreme Court under Article 21, which guarantees the right to privacy, as seen in cases like the Pegasus controversy.
If the surveillance involves unauthorised access or hacking, provisions under Section 43(a) read with Section 66 of the Information Technology Act, 2000 may apply. However, enforcement remains difficult. Establishing proof is often the biggest hurdle, followed by jurisdictional challenges in holding a foreign entity accountable.
Remedies largely lie through judicial routes or complaints to relevant authorities, but success can be inconsistent. In some cases, diplomatic intervention may also come into play.
In intelligence law, foreigners often have fewer protections than citizens. Are there mechanisms under international law or diplomatic channels through which India could challenge or regulate such surveillance?
Protections for foreigners under international law are relatively limited. India could raise concerns through international platforms such as UN human rights bodies or invoke obligations under frameworks like the International Covenant on Civil and Political Rights (ICCPR).
Diplomatic tools, including Mutual Legal Assistance Treaties (MLATs) or bilateral agreements, may also be used to seek cooperation or set boundaries. However, enforcement is often weak and depends heavily on political will. In practice, these mechanisms rely more on diplomacy and negotiation than on binding enforcement, especially when dealing with powerful states.
Does AI change the scale of cross-border surveillance in ways that make digital sovereignty harder to enforce?
Absolutely, AI significantly amplifies both the scale and speed of surveillance. It enables automated data collection and analysis across jurisdictions, making it easier to monitor individuals at a global level. This creates challenges for digital sovereignty, as data flows do not adhere to national boundaries.
Even with efforts to localise data or build sovereign digital infrastructure, cross-border data movement continues to complicate enforcement. In effect, AI makes borders more porous in the digital sense, forcing countries to rethink how they define and protect sovereignty in an increasingly interconnected data ecosystem.
