Reports that many Indians have been targeted by the Pegasus spyware is disturbing, but not surprising. Installing spyware on a phone is illegal if it is carried out by a private entity but India has no data protection laws, and has an opaque and arbitrary mechanism for authorisation of surveillance. A list of persons allegedly targeted by Pegasus was released by a multi-organisational investigation involving news organisations, cybersecurity specialists and Amnesty International. In this context, the government has issued a statement of denial. But that raises even more disturbing questions, argues our lead editorial

)