SFLC.IN’s EXPLAINER ON THE SC PEGASUS ORDER DATED 27.10.2021

 

1. BACKGROUND

In a series of startling revelations by The Wire, the Pegasus spyware was found to have been used to target hundreds of cell phone devices in India. A copy of SFLC.in's detailed explainer on the Pegasus issue can be found here. In the backdrop of mounting evidence suggesting that the Pegasus spyware was used on Indian citizens, and the lack of clarity in the responses given by the Indian Government, coupled with the lack of judicial oversight or other safeguards against such invasive surveillance methods, SFLC.in and other petitioners were compelled to approach the Hon'ble Supreme Court, by way of filing a Writ Petition under Article 32 of the Constitution of India.

 

2. SFLC.IN’S PETITION

SFLC.in had approached the Hon'ble Supreme Court of India, by way of filing a Writ Petition/Public Interest Litigation bearing No. 909 of 2021 under Article 32 of the Constitution of India, seeking issuance of directions to the Respondents to ensure the protection of fundamental rights of the citizens of India, in the backdrop of the Pegasus controversy. A copy of the Writ Petition filed by SFLC.in, along with the Orders passed by the Hon’ble SC, can be found here.

The Writ Petition/PIL was filed by Mr. Degree Prasad Chauhan (Petitioner No. 1) and SFLC.in (Petitioner No. 2). Mr. Chauhan is a human rights defender, a journalist, a lawyer, and an activist. Mr. Chauhan’s mobile device was presumably infiltrated by the Pegasus spyware. Even though he was personally aggrieved, he had approached the Hon’ble Supreme court in public interest, and had not sought any relief for himself.

The Writ Petition talks about best practices in surveillance which are mentioned in a number of committee and law commission reports in different jurisdictions around the world. It also talks about the principles which are highlighted in United Nations documents, reports by UN Special Rapporteurs and other international legal documents. The Petition also gives a detailed factual narration of all the events which have a bearing on the issue of surveillance in India. Some of the grounds that the Petition relies upon include: Violation of the Right to freedom of Speech and Expression, violation of the right to trade and profession, violation of international law obligations, disregard for the rule of law and the democratic process by the Indian Government etc.

The reliefs prayed for in the Writ Petition are summarized below:

(i) direction to the Central Government and all the State Governments to not have any dealings with NSO and to discontinue its dealings with NSO;

(ii) direction to the respondents prohibiting outsourcing/sub-contracting any surveillance activity to the private sector and directing a discontinuation of such dealings;

(iii) direction to the Respondents to establish a judicial oversight mechanism for issuance of surveillance orders;

(iv) Issuance of guidelines on certain aspects such as judicial oversight, compliance with the principles of necessity and proportionality;

(v) Order a court monitored probe/investigation into the issue of surveillance by the Pegasus spyware in India;

(vi) disclosure of certain details by the Government of India on the Pegasus controversy;

(vii) declaration that Rule 419A of the Telegraph Rules is unconstitutional;

(viii) declaration that Section 69 of the IT Act, 2000 is unconstitutional; (ix) declaration that the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 20009 are unconstitutional.

Prayer (v) was reflected in the relief that was granted by the Hon’ble Supreme Court. Prayer (v) as mentioned in the Writ Petition is given below:

“Order an investigation/probe which is monitored by this Hon’ble court on the use of the Pegasus spyware for surveillance of Indian citizens, which is conducted by officers chosen by this Hon’ble Court who are independent of the Union of India”

 

3. COURT PROCEEDINGS

Following is a list of updates from the court hearings in this case:

17.08.2021

Senior Advocate Colin Gonsalves appeared on behalf of Mr. Chauhan and SFLC.in, on Tuesday (17.08.2021) and mentioned the matter before the Hon'ble Bench. The PIL was tagged with the batch of Petitions which had been filed on the Pegasus controversy.

 

06.09.2021

The Solicitor General submitted that there was some difficulty in relation to the filing of the affidavit by the government, and in light of that, he requested for more time to be granted to the government. The case was adjourned by the Hon'ble Bench.

 

13.09.2021

Senior Advocate Mr. Colin Gonsalves appeared before the Hon'ble bench comprising of Chief Justice of India NV Ramana, Justice Surya Kant and Justice Hima Kohli. He was appearing on behalf of Petitioner No. 1 (Degree Prasad Chouhan) and Petitioner No. 2 (SFLC.in). Relying on the material which was placed on record by the Petitioners, he argued that the Central Government and the States were indulging in widespread interception. He further submitted that if that is the case, we could not rely on the principal wrongdoer to form a committee and do an investigation.

He also quoted a statement given by the former Home Secretary G.K. Pillai, who had said that he was aware that Israeli tech firm NSO had been operating in India and that it had sold spying software in India. He further submitted that the Petitioners have placed on record various reports which indicate how other countries have dealt with this issue.

The Hon'ble bench said that it will pass an interim order within 2-3 days. It also gave liberty to the Solicitor General to mention the matter in the meanwhile, if there was any reconsideration on the government's part.

Mr. Gonsalves was assisted by lawyers from HRLN and SFLC.in. Along with Mr. Gonsalves, Mishi Choudhary, Prasanth Sugathan, Kushagra Sinha and Siddharth Seem appeared before the Hon'ble Court, on behalf of the Petitioners.

 

23.09.2021

The Hon'ble Chief Justice of India stated that the Supreme Court would be setting up a technical committee to look into the allegations surrounding the use of the Pegasus spyware. The CJI said this to Senior Advocate Chander Uday Singh (who is representing one of the Petitioners in the Pegasus matter before the SC), while Mr. Singh was mentioning another matter.

The CJI further told him that the Orders were deferred because some of the members who were being considered by the Hon'ble Court for the technical committee, had expressed personal difficulties in being a part of the said committee. The CJI also said that the Court would pass orders next week.

 

27.10.2021

The Hon’ble bench passed a detailed Order, giving directions for the constitution of a Technical Committee comprising of independent experts, to look into the allegations relating to the use of the Pegasus spyware.

 

4. SC ORDER

Following is a list of extracts from the Order passed by the Hon’ble SC on 27.10.2021:

1. How does the judgment define the Pegasus spyware?

“The Pegasus suite of spywares can allegedly be used to compromise the digital devices of an individual through zero click vulnerabilities, i.e., without requiring any action on the part of the target of the software. Once the software infiltrates an individual’s device, it allegedly has the capacity to access the entire stored data on the device, and has real time access to emails, texts, phone calls, as well as the camera and sound recording capabilities of the device. Once the device is infiltrated using Pegasus, the entire control over the device is allegedly handed over to the Pegasus user who can then remotely control all the functionalities of the device and switch different features on or off. The NSO Group purportedly sells this extremely powerful software only to certain undisclosed Governments and the end user of its products are “exclusively government intelligence and law enforcement agencies” as per its own website.” (Para 3)

 

2. Privacy and State Action

The Order elaborates upon the link between privacy and state action, in the following words:

“This Court in K.S. Puttaswamy (Privacy9J.) v. Union of India, (2017) 10 SCC 1, has recognized that the right to privacy is as sacrosanct as human existence and is inalienable to human dignity and autonomy. This Court held that:

A law which encroaches upon privacy will have to withstand the touchstone of permissible restrictions on fundamental rights. In the context of Article 21 an invasion of privacy must be justified on the basis of a law which stipulates a procedure which is fair, just and reasonable. The law must also be valid with reference to the encroachment on life and personal liberty under Article 21. An invasion of life or personal liberty must meet the threefold requirement of (i) legality, which postulates the existence of law; (ii) need, defined in terms of a legitimate State aim; an (iii) proportionality which ensures a rational nexus between the objects and the means adopted to achieve them.” (Para 32)

 

An essential aspect of the debate surrounding the controversy is the tug of war between the right to privacy and national security. The Order talks about this aspect in the following words:

“This tradeoff between the right to privacy of an individual and the security interests of the State, has been recognized world over with the renowned scholar Daniel Solove commenting on the same as follows:

The debate between privacy and security has been framed incorrectly, with the tradeoff between these values understood as an all or nothing proposition. But protecting privacy need not be fatal to security measures; it merely demands oversight and regulation. We can’t progress in the debate between privacy and security because the debate itself is flawed. The law suffers from related problems. It seeks to balance privacy and security, but systematic problems plague the way the balancing takes place…. Privacy often can be protected without undue cost to security. In instances when adequate compromises can’t be achieved, the tradeoff can be made in a manner that is fair to both sides. We can reach a better balance between privacy and security. We must. There is too much at stake to fail.” (Para 37)

 

 

3. Surveillance and Free Speech:

Illegal and unwarranted surveillance not only impacts the right to privacy but it also has a chilling effect and an adverse impact on free speech. This consequently also affects the rights of journalists, activists and freedom of press in general. The Order addresses this point in the following words:

“It is undeniable that surveillance and the knowledge that one is under the threat of being spied on can affect the way an individual decides to exercise his or her rights. Such a scenario might result in self-censorship. This is of particular concern when it relates to the freedom of the press, which is an important pillar of democracy.” (Para 39)

 

4. Material placed on record by the Petitioners:

The Order does take into consideration the reports published by reputed organizations and the news reports published by news organizations across the world. It also takes into consideration the course of action taken by foreign governments to address this issue. The portions of the Order which are relevant on this point are given below:

“That said, after we indicated our reservations to the Petitioners regarding the lack of material, various other petitions have been filed in Court, including by individuals who were purportedly victims of the alleged Pegasus spyware attack. These subsequently filed petitions, as well as additional documents filed by others, have brought on record certain materials that cannot be brushed aside, such as the reports of reputed organizations like Citizen Lab and affidavits of experts. Additionally, the sheer volume of cross referenced and cross verified reports from various reputable news organizations across the world along with the reactions of foreign governments and legal institutions also moved us to consider that this is a case where the jurisdiction of the Court may be exercised. Of course, the learned Solicitor General suggested that many of these reports are motivated and self serving. However, such an omnibus oral allegation is not sufficient to desist from interference.” (Para 44)

 

5. Government’s response in Court

One of the most widely discussed issues in this case was the inadequate response that was given by the Government during court hearings. The Hon’ble Court has taken a note of that fact. The relevant portions from the Order are extracted below:

“This Court gave ample opportunity to the Respondent Union of India to clarify its stand regarding the allegations raised, and to provide information to assist the Court regarding the various actions taken by it over the past two years, since the first disclosed alleged Pegasus spyware attack. We had made it clear to the learned Solicitor General on many occasions that we would not push the Respondent Union of India to provide any information that may affect the national security concerns of the country. However, despite the repeated assurances and opportunities given, ultimately the Respondent Union of India has placed on record what they call a “limited affidavit”, which does not shed any light on their stand or provide any clarity as to the facts of the matter at hand. If the Respondent Union of India had made their stand clear it would have been a different situation, and the burden on us would have been different.” (Para 45)

 

6. The issue of “National Security”

The Government had repeatedly claimed that in light of national security, it cannot given any information during court proceedings. The Order talks about the issue of national security in the following words:

“It is a settled position of law that in matters pertaining to national security, the scope of judicial review is limited. However, this does not mean that the State gets a free pass every time the spectre of “national security” is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning. Although this Court should be circumspect in encroaching upon the domain of national security, no omnibus prohibition can be called for against judicial review.” (Para 49)

...

“The Respondent Union of India must necessarily plead and prove the facts which indicate that the information sought must be kept secret as their divulgence would affect national security concerns. They must justify the stand that they take before a Court. The mere invocation of national security by the State does not render the Court a mute spectator.” (Para 50)

...

“the Petitioners have placed on record certain material that prima facie merits consideration by this Court. There has been no specific denial of any of the facts averred by the Petitioners by the Respondent Union of India. There has only been an omnibus and vague denial in the “limited affidavit” filed by the Respondent Union of India, which cannot be sufficient. In such circumstances, we have no option but to accept the prima facie case made out by the Petitioners to examine the allegations made.” (Para 51)

 

7. “Compelling Circumstances”

The Order lists the reasons which led the Hon’ble Court to pass the Order. The relevant portions from the Order are stated below:

The compelling circumstances that have weighed with us to pass such an order are as follows:

i. Right to privacy and freedom of speech are alleged to be impacted, which needs to be examined.

ii. The entire citizenry is affected by such allegations due to the potential chilling effect.

iii. No clear stand taken by the Respondent Union of India regarding actions taken by it.

iv. Seriousness accorded to the allegations by foreign countries and involvement of foreign parties.

v. Possibility that some foreign authority, agency or private entity is involved in placing citizens of this country under surveillance.

vi. Allegations that the Union or State Governments are party to the rights’ deprivations of the citizens.

vii. Limitation under writ jurisdiction to delve into factual aspects. For instance, even the question of usage of the technology on citizens, which is the jurisdictional fact, is disputed and requires further factual examination.

(Para 56)

8. On the Government appointing a committee to investigate the issue

During the course of the hearings in this case, the Government had proposed that as a possible solution, it would appoint a committee of independent experts to investigate the issue. That proposal was rejected by the Hon’ble court and the reasons for the same are mentioned in the Order in the following words:

“It is for reason (vi) [Allegations that the Union or State Governments are party to the rights’ deprivations of the citizens] above that we decline the Respondent Union of India’s plea to allow them to appoint an Expert Committee for the purposes of investigating the allegations, as such a course of action would violate the settled judicial principle against bias, i.e., that ‘justice must not only be done, but also be seen to be done’. (Para 57)

On this point, reference may be drawn to Para 23 of the Order which mentions that Mr. Colin Gonsalves, senior counsel, submitted that:

“in light of the allegations raised against the Respondent Union of India in the present matter, it would not be appropriate to allow the Respondent Union of India to form a Committee to investigate the present allegations.”

 

9. Constitution of a Technical Committee

The Hon’ble Court has constituted a committee comprising of independent experts. The details in respect of the committee are given below:

With the above observations, we constitute a Technical Committee comprising of three members, including those who are experts in cyber security, digital forensics, networks and hardware, whose functioning will be overseen by Justice R.V. Raveendran, former Judge, Supreme Court of India. The learned overseeing Judge will be assisted in this task by:

i. Mr. Alok Joshi, former IPS officer (1976 batch) who has immense and diverse investigative experience and technical knowledge. He has worked as the Joint Director, Intelligence Bureau, the Secretary(R), Research and Analysis Wing and Chairman, National Technical Research Organisation.

ii. Dr. Sundeep Oberoi, Chairman, ISO/IEC JTC1 SC7 (International Organisation of Standardisation/ International ElectroTechnical Commission/Joint

Technical Committee), a subcommittee which develops and facilitates standards within the field of

software products and systems. Dr. Oberoi is also a part of the Advisory Board of Cyber Security Education and Research Centre at Indraprastha Institute of Information Technology, Delhi. He is globally recognized as a cyber security expert. (Para 59)

 

MEMBERS OF THE COMMITTEE

The three members Technical Committee [hereinafter referred to as the “Committee”] shall comprise of:

i. Dr. Naveen Kumar Chaudhary, Professor (Cyber Security and Digital Forensics) and Dean, National Forensic Sciences University, Gandhinagar, Gujarat. Dr. Chaudhary has over two decades of experience as an academician, cyber security enabler and cyber security expert. He specializes in cyber security policy, network vulnerability assessment and penetration testing.

ii. Dr. Prabaharan P., Professor (School of Engineering), Amrita Vishwa Vidyapeetham, Amritapuri, Kerala. He has two decades of experience in computer science and security areas. His areas of interest are malware detection, critical infrastructural security, complex binary analysis, AI and machine learning. He has many publications in reputed journals.

iii. Dr. Ashwin Anil Gumaste, Institute Chair Associate Professor (Computer Science and Engineering), Indian Institute of Technology, Bombay, Maharashtra. He has been granted 20 US patents and has published over 150 papers and authored 3 books in his field. He has received several National awards including the Vikram Sarabhai Research Award (2012) and Shanti Swarup Bhatnagar Prize for Science and Technology (2018). He has also held the position of Visiting Scientist at the Massachusetts Institute of Technology, USA. (Para 60)

 

TERMS OF REFERENCE OF THE COMMITTEE

“The terms of reference of the Committee are as follows:

A. To enquire, investigate and determine:

i. Whether the Pegasus suite of spyware was used on phones or other devices of the citizens of India to access stored data, eavesdrop on conversations, intercept information and/or for any other purposes not explicitly stated herein?

ii. The details of the victims and/or persons affected by such a spyware attack.

iii. What steps/actions have been taken by the Respondent Union of India after reports were published

in the year 2019 about hacking of WhatsApp accounts of Indian citizens, using the Pegasus suite of spyware.

iv. Whether any Pegasus suite of spyware was acquired by the Respondent Union of India, or any State Government, or any central or state agency for use against the citizens of India?

v. If any governmental agency has used the Pegasus suite of spyware on the citizens of this country, under what law, rule, guideline, protocol or lawful procedure was such deployment made?

vi. If any domestic entity/person has used the spyware on the citizens of this country, then is such a use authorised?

vii. Any other matter or aspect which may be connected, ancillary or incidental to the above terms of reference, which the Committee may deem fit and proper to

investigate.

 

To make recommendations:

i. Regarding enactment or amendment to existing law and procedures surrounding surveillance and for securing improved right to privacy.

ii. Regarding enhancing and improving the cyber security of the nation and its assets.

iii. To ensure prevention of invasion of citizens’ right to privacy, otherwise than in accordance with law, by State and/or non State entities through such spywares.

iv. Regarding the establishment of a mechanism for citizens to raise grievances on suspicion of illegal

surveillance of their devices.

v. Regarding the setting up of a well-equipped independent premier agency to investigate cyber

security vulnerabilities, for threat assessment relating to cyberattacks and to investigate instances of

cyberattacks in the country.

vi. Regarding any adhoc arrangement that may be made by this Court as an interim measure for the protection of citizen’s rights, pending filling up of lacunae by the Parliament.

vii. On any other ancillary matter that the Committee may deem fit and proper.

(Para 61)

 

Procedure of the Committee

The Procedure of the Committee shall be as follows:

(1) The Committee constituted by this Order is authorised to:

(a) devise its own procedure to effectively implement and answer the Terms of Reference;

(b) hold such enquiry or investigation as it deems fit;and

(c) take statements of any person in connection with the enquiry and call for the records of any authority or individual.”

(Para 62)

 

5. Conclusion

This is a momentous victory for the cause of privacy and human rights in India. The Order passed by the Hon’ble Supreme Court has segregated and addressed almost all the relevant arguments which were raised by the Petitioners. The issues with the stand taken by the Government before the Hon’ble Court (vague and omnibus denial by the Government in its “limited affidavit”), have also found a mention in the Order. The most crucial prayer about the formation of an independent committee, has been granted. The Committee is to be headed by Justice RV Raveendran (Former judge of the Supreme court) and the three members of the Technical Committee are all experts in the field, who have also received a substantial amount of recognition for their work. While the issue about lack of an oversight mechanism or the prayer for disclosure of information has not been addressed, the former has been addressed indirectly, as the Committee has been given the mandate to make recommendations regarding enactment or amendment to existing law and procedures surrounding surveillance and for securing improved right to privacy. Furthermore, the Committee can also make recommendations to ensure the prevention of invasion of the right to privacy of citizens, otherwise than in accordance with law, by State and/or non-State entities through such spywares; and for the establishment of a much needed mechanism for citizens to raise grievances on suspicion of illegal surveillance of their devices.

The Order is a step in the right direction for ensuring that our democracy is not held a prisoner to the abuse of power by the Government. Much remains to be seen on how the case progresses after the Committee submits its report before the Hon’ble Supreme Court and how the final judgment shapes the actions and omissions of the government, in the future.