Pegasus Spyware: Supreme Court Orders Independent Probe into Surveillance Allegations (27 October 2021)

Introduction

Date of the Judgment: 27 October 2021

Citation: (2021) INSC 734

Judges: N.V. Ramana, CJI, Surya Kant J, Hima Kohli J.

Can the government use sophisticated spyware to monitor its citizens? The Supreme Court of India recently addressed this critical question in a batch of writ petitions concerning the alleged use of the Pegasus spyware. This case delves into the heart of privacy rights, freedom of speech, and the limits of state surveillance in a digital age. The Supreme Court, acknowledging the gravity of the allegations and the lack of a clear response from the government, has appointed an independent expert committee to investigate the matter.

Case Background

The case originated from reports in September 2018 by Citizen Lab, a laboratory based out of the University of Toronto, Canada, detailing the capabilities of a spyware suite called Pegasus, produced by the Israeli firm NSO Group. This spyware allegedly allows for the complete compromise of digital devices without any action required by the target. It can access stored data, emails, texts, phone calls, and even control the device’s camera and sound recording capabilities. The NSO Group reportedly sells this software exclusively to government intelligence and law enforcement agencies.

In May 2019, WhatsApp identified a vulnerability that allowed Pegasus to infiltrate user devices. This was followed by disclosures that some Indian citizens were also affected, which was acknowledged by the then Minister of Law and Electronics and Information Technology in Parliament on 20 November 2019. Further reports in June 2020 by Citizen Lab and Amnesty International indicated that nine individuals in India were targeted by this spyware.

In July 2021, a consortium of journalistic organizations released findings from an investigation based on a leaked list of 50,000 phone numbers allegedly under surveillance by NSO Group clients. This list included approximately 300 Indian numbers belonging to journalists, doctors, politicians, and even court staff. Some of these devices were forensically analyzed, confirming the presence of Pegasus spyware.

Timeline

Course of Proceedings

Initially, the Supreme Court noted that the petitions were largely based on newspaper reports. However, subsequent petitions filed by alleged victims and additional documents, including reports from Citizen Lab and expert affidavits, brought forth material that could not be ignored. The Court issued notice to the Union of India, seeking clarification on the allegations and actions taken since the first reports of the Pegasus spyware attack in 2019.

The Union of India filed a “limited affidavit” denying the allegations and stating that the matter had been clarified in Parliament. They proposed to constitute an expert committee to examine the issue. The Supreme Court found this response insufficient, particularly given the serious nature of the allegations and the potential violation of fundamental rights. The Court noted that despite repeated opportunities, the government failed to provide detailed information or clarify its position, citing national security concerns.

Legal Framework

The Supreme Court emphasized that the right to privacy is a fundamental right protected under Article 21 of the Constitution of India, which guarantees the right to life and personal liberty. This right is not absolute but is subject to reasonable restrictions. Any encroachment on privacy must be justified by law, serve a legitimate state aim, and be proportional to the objective. The Court referred to its earlier judgment in K.S. Puttaswamy (Privacy-9J.) v. Union of India, (2017) 10 SCC 1, which recognized privacy as a constitutionally protected right.

The Court also highlighted the importance of freedom of the press, recognizing that surveillance and the threat of being spied upon can lead to self-censorship and undermine the press’s role as a public watchdog. The Court noted that protection of journalistic sources is essential for press freedom.

Arguments

The Petitioners, including journalists, activists, and public interest litigants, argued that the alleged use of Pegasus spyware constituted a grave violation of their fundamental rights to privacy and freedom of speech. They contended that the government’s inaction and lack of transparency raised serious concerns about potential abuse of surveillance powers. They highlighted that the NSO Group sells its software only to vetted governments, suggesting that either a foreign government or agencies of the Union of India were using the spyware without following due process. The Petitioners sought an independent investigation into the allegations, preferably under the supervision of retired judges of the Supreme Court.

The Union of India, represented by the Solicitor General, denied all allegations, stating that they were based on conjectures and unsubstantiated media reports. They argued that the reports had no factual basis and that India has a robust legal and statutory regime for surveillance and interception, ensuring no illegal surveillance could take place. The government expressed willingness to constitute an expert committee to examine the issue but maintained that disclosure of certain facts might affect national security.

The Petitioners argued that the Union of India should not act in a manner that would prevent the Court from rendering justice and should not withhold information from the Court in a matter concerning the alleged violation of fundamental rights of citizens. They also pointed out that the government had acknowledged reports of hacking in Parliament in 2019 but had not indicated what actions were taken subsequently.

Some Petitioners, claiming to be direct victims of the Pegasus attack, submitted that the spyware not only allowed for surveillance but also enabled the implantation of false documents and evidence on a device. They argued that the State had a responsibility to protect the interests and fundamental rights of its citizens, particularly when there was a risk of a foreign entity being involved in such attacks.

Issues Framed by the Supreme Court

The Supreme Court framed the following issues for consideration:

1. Whether the Pegasus suite of spyware was used on phones or other devices of the citizens of India to access stored data, eavesdrop on conversations, intercept information, and/or for any other purposes not explicitly stated herein?
2. The details of the victims and/or persons affected by such a spyware attack.
3. What steps/actions have been taken by the Respondent-Union of India after reports were published in the year 2019 about hacking of WhatsApp accounts of Indian citizens, using the Pegasus suite of spyware.
4. Whether any Pegasus suite of spyware was acquired by the Respondent-Union of India, or any State Government, or any central or state agency for use against the citizens of India?
5. If any governmental agency has used the Pegasus suite of spyware on the citizens of this country, under what law, rule, guideline, protocol or lawful procedure was such deployment made?
6. If any domestic entity/person has used the spyware on the citizens of this country, then is such a use authorized?
7. Any other matter or aspect which may be connected, ancillary or incidental to the above terms of reference, which the Committee may deem fit and proper to investigate.

Treatment of the Issue by the Court

The following table demonstrates as to how the Court decided the issues

Authorities

The Supreme Court considered the following authorities:

Judgment

The Supreme Court, after considering the submissions of both sides and the circumstances of the case, decided to appoint an independent expert committee to investigate the allegations. The Court emphasized that the right to privacy is a fundamental right and that the State cannot act in a manner that hinders the Court from rendering complete justice. The Court rejected the Union of India’s plea to allow it to appoint an expert committee, stating that such a course of action would violate the principle against bias.

How each authority was viewed by the Court?

✓ Kesavananda Bharati v. State of Kerala, AIR 1973 SC 1461: The Court reiterated the principle of judicial restraint and the need for judges to remain apolitical.

✓ Semayne’s case, 77 ER 194 (KB): The Court used this case to trace the historical origins of privacy rights.

✓ Samuel Warren and Louis Brandeis, ‘The Right to Privacy’: The Court used this article to highlight the need to protect individuals from technological advancements that threaten privacy.

✓ K.S. Puttaswamy (Privacy-9J.) v. Union of India, (2017) 10 SCC 1: The Court heavily relied on this case to emphasize that privacy is a constitutionally protected right under Article 21.

✓ Ellen Alderman and Caroline Kennedy, THE RIGHT TO PRIV ACY: The Court used this book to highlight the threats to informational privacy.

✓ Daniel J. Solove, NOTHING TO HIDE: THE FALSE TRADEOFF BETWEEN PRIVACY AND SECURITY: The Court quoted this book to emphasize the need to balance privacy and security.

✓ Indian Express Newspapers (Bombay) Private Limited v. Union of India, (1985) 1 SCC 641: The Court used this case to highlight the importance of freedom of the press.

✓ Anuradha Bhasin v. Union of India, (2020) 3 SCC 637: The Court referred to this case to emphasize that responsible governments are required to respect the freedom of the press.

✓ Rohit Pandey v. Union of India, (2005) 13 SCC 702: The Court used this case to caution against filing petitions based solely on newspaper reports.

✓ Ram Jethmalani v. Union of India, (2011) 8 SCC 1: The Court relied on this case to emphasize the State’s duty to reveal all facts and information to the Court.

✓ Extra-Judicial Execution Victim Families Association v. Union of India, (2013) 2 SCC 493 and G.S. Mani v. Union of India, order dated 12.12.2019 in W.P. (Crl.) No. 348 of 2019: The Court cited these cases to support its decision to appoint an expert committee.

What weighed in the mind of the Court?

The Supreme Court’s decision to appoint an independent expert committee was driven by a combination of factors, reflecting the gravity of the allegations and the need to uphold constitutional values. The Court emphasized the importance of the right to privacy and freedom of speech, recognizing that these rights are fundamental to a democratic society. The lack of a clear response from the government, coupled with the serious nature of the allegations, weighed heavily in the Court’s decision. The Court was also influenced by the reports from reputable international organizations and the reactions of foreign governments, indicating the seriousness of the issue.

Fact:Law Ratio

The Court’s reasoning was a blend of factual considerations and legal principles. While the factual aspects of the case, such as the reports of spyware use and the lack of government response, played a significant role, the legal principles surrounding fundamental rights, privacy, and freedom of speech were equally important in shaping the Court’s decision.

Logical Reasoning:

The Court considered the alternative of allowing the government to form a committee but rejected it to maintain impartiality and credibility. The final decision was to appoint an independent expert committee, overseen by a retired Supreme Court judge, to ensure a thorough and unbiased investigation.

The Supreme Court, in its judgment, quoted the following from the source judgment:

“If you want to keep a secret, you must also hide it from yourself.”

“Privacy is a constitutionally protected right which emerges primarily from the guarantee of life and personal liberty in Article 21 of the Constitution.”

“In the task of upholding of fundamental rights, the State cannot be an adversary.”

Key Takeaways

• ✓ The right to privacy is a fundamental right that cannot be easily infringed upon by the state.
• ✓ State surveillance must be justified by law, serve a legitimate state aim, and be proportional to the objective.
• ✓ The government must be transparent and accountable when dealing with allegations of surveillance.
• ✓ The judiciary has a crucial role in protecting fundamental rights and ensuring that the state does not act arbitrarily.
• ✓ Independent investigations are necessary when there are serious allegations of state overreach.
• ✓ The chilling effect on the freedom of speech due to surveillance is a grave concern.
• ✓ The Court has the power to appoint expert committees to investigate complex issues.

Directions

The Supreme Court directed the following:

• ✓ An independent expert committee, comprising of three members, including those who are experts in cyber security, digital forensics, networks and hardware, was constituted.
• ✓ Justice R.V. Raveendran, former Judge, Supreme Court of India, will oversee the functioning of the Committee.
• ✓ The Union of India and all State Governments, as well as agencies/authorities under them, are directed to extend full facilities to the Committee.
• ✓ The Committee is requested to prepare the report after a thorough inquiry and place it before the Court, expeditiously.

Specific Amendments Analysis

There was no specific amendment discussed in the judgment.

Development of Law

The ratio decidendi of this case is that the right to privacy is a fundamental right and the State cannot act in a manner that hinders the Court from rendering complete justice. The Court emphasized that the State must be transparent and accountable when dealing with allegations of surveillance and that independent investigations are necessary when there are serious allegations of state overreach. This case reinforces the principle that the mere invocation of national security does not render the Court a mute spectator.

Conclusion

The Supreme Court’s decision to appoint an independent expert committee in the Pegasus spyware case underscores the judiciary’s role in protecting fundamental rights and ensuring government accountability. The judgment highlights the importance of privacy and freedom of speech in the digital age and sets a precedent for how the state must act when faced with allegations of surveillance. By ordering a thorough investigation, the Supreme Court has taken a significant step towards ensuring that the truth about the Pegasus allegations is revealed and that the rights of citizens are protected.