Pegasus spyware attack: Apex Court appoints Expert Committee; says mere invocation of national security by State does not render Court a mute spectator

Read Judgment: Manohar Lal Sharma vs. Union of India & Ors

Pankaj Bajpai

New Delhi, October 29, 2021: While highlighting that privacy rights may be traced to the ‘right to life’ enshrined under Article 21 of the Constitution, the Supreme Court has said that although the scope of judicial review is limited in matters pertaining to national security, however, that does not handover the State a free pass every time the spectre of “national security” is raised. 

“National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning. Although this Court should be circumspect in encroaching upon the domain of national security, no omnibus prohibition can be called for against judicial review”, added the Court. 

While stating that mere invocation of national security by the State does not render the Court a mute spectator, a Larger Bench of Chief Justice N.V. Ramana, Justice Surya Kant and Justice Hima Kohli observed that the right to privacy is directly infringed when there is surveillance or spying done on an individual, either by the State or by any external agency.

In a democratic country governed by the rule of law, indiscriminate spying on individuals cannot be allowed except with sufficient statutory safeguards, by following the procedure established by law under the Constitution, added the Bench. 

Going by the background of the case, a laboratory based out of the University of Toronto, Canada, released a report in September 2018 detailing the software capabilities of a “spyware suite” called Pegasus that was being produced by an Israeli Technology firm – NSO Group. As per the report, the Pegasus suite of spywares allegedly has the capacity to access the entire stored data on the device, and has real time access to emails, texts, phone calls, as well as the camera and sound recording capabilities of the device. 

Once the device is infiltrated using Pegasus, the entire control over the device is allegedly handed over to the Pegasus user who can then remotely control all the functionalities of the device and switch different features on or off, said the report. 

The NSO Group purportedly sells this extremely powerful software only to certain undisclosed Governments and the end user of its products is “exclusively government intelligence and law enforcement agencies” as per its own website.

Later, in May 2019, WhatsApp Inc. identified a vulnerability in its software that enabled Pegasus spyware to infiltrate the devices of WhatsApp’s users. This news was followed by a disclosure that the devices of certain Indians were also affected, which fact was acknowledged by the then Minister of Law and Electronics and Information Technology in a statement made in the Parliament on November 20, 2019.

The series of events showed that on July 18, 2021, a consortium of nearly 17 journalistic organizations from around the world, including one Indian organization, released the results of a long investigative effort indicating the alleged use of the Pegasus software on several private individuals. 

Answering to these allegations, Union of India (respondent), through the Minister of Railways, Communications and Electronics and Information Technology, took the stand in Parliament that the reports published had no factual basis. Further, the Minister stated that the Indian statutory and legal regime relating to surveillance and interception of communication is extremely rigorous, and no illegal surveillance could take place.

This led to filing of various PILs raising the issue of inaction on the part of the respondent to seriously consider the allegations relating to the purported cyber-attack on citizens of this country. Therefore, to ensure credibility of the process, most of the petitioners are seeking an independent investigation into the allegations. 

After considering the report and the allegations, the Larger Bench accepted that surveillance and the knowledge that one is under the threat of being spied on, can affect the way an individual decides to exercise his or her rights, and such a scenario might result in self-censorship.

“In today’s world, information gathered by intelligence agencies through surveillance is essential for the fight against violence and terror. To access this information, a need may arise to interfere with the right to privacy of an individual, provided it is carried out only when it is absolutely necessary for protecting national security/interest and is proportional. The considerations for usage of such alleged technology, ought to be evidence based”, observed the Bench. 

The Top Court said that having regard to the importance of the protection of journalistic sources for press freedom in a democratic society and the potential chilling effect that snooping techniques may have, the grave allegations of infringement of the rights of the citizens of the country assumes great significance. 

The Apex Court said that ample opportunity was given to the respondent to clarify its stand regarding the allegations raised, and to provide information to assist the Court regarding the various actions taken by it over the past two years, since the first disclosed alleged Pegasus spyware attack. 

However, the respondent had placed on record what they call a “limited affidavit”, which did not shed any light on their stand or provide any clarity as to the facts of the matter at hand, and therefore, such a course of action taken by the respondent especially in proceedings of the present nature which touches upon the fundamental rights of the citizens of the country, cannot be accepted, added the Court. 

Accordingly, the Larger Bench listed the matter after eight weeks and passed an order appointing an Expert Committee of three members who are experts in cyber security, digital forensics, networks and hardware, and whose functioning will be overseen by Justice R.V. Raveendran, former Judge, Supreme Court of India. 

The Bench also refused the respondent’s plea to allow them to appoint an Expert Committee for the purposes of investigating the allegations, as such a course of action would violate the settled judicial principle against bias.