Supreme Court Appointed Technical Committee Reaches Out To Victims Of Pegasus For Information

Key takeaways

• In July 2021, a consortium of 17 journalistic organizations including one Indian organization, released in public the results of an investigative effort indicating the use of the Pegasus spyware on several individuals around the world including 300 Indians.
• The spyware essentially turns the device into a pocket spy device.
• Multiple petitions filed in the Supreme Court claimed that NSO Group sells its software only to the government and their agenciesand the Indian government has abused its power by snooping on its citizens under the cover of national security.
• The Supreme Court constituted a three-member technical committee to investigate the matter.
• Technical Committee now seeks information from Pegasus Victims.

Introduction

&lsquoPegasus Spyware Scandal' refers to alleged snooping by the government of India on its netizens. The Pegasus snooping scandal came to light on 18th July 2021 after a global consortium of media outlets and investigative journalists reported that the phones of Indian politicians, journalists, activists, and businessmen were among the 50,000 potentially targeted by Pegasus, Israeli company NSO Group&rsquos phone hacking software. The Spyware can switch on a target&rsquos phone camera and microphone and access data on the device, thus turning the phone into a pocket spy device.

A bunch of petitions was filed in the Supreme Court to which the Union ministry of electronics and information technology filed a 3-page affidavit that neither confirmed nor denied if the government had any role in the surveillance through Pegasus Spyware.

The Supreme Court after ascertaining the situation set up an expert panel to investigate the snooping scandal, asserting that the government can&rsquot always get a &ldquofree pass" by raising the spectre of &ldquonational security". The court also raised its concern on the &ldquopotential chilling effect" of the spyware on the right to privacy and freedom of speech. The three-member technical committee will be supervised by retired Supreme Court judge R.V. Raveendran.

What is Pegasus Spyware

A report was released in 2018 by a laboratory called &lsquoCitizen Lab&rsquo based out of the University of Toronto, Canada. The report detailed a suite of spyware called &lsquoPegasus&rsquo that was being produced and sold by NSO Group, an Israel-based Cyber Intelligence Organization. The report highlighted that citizens from at least 45 countries have been affected by spyware.

In 2019, Facebook (now Meta) owned WhatsApp Inc. suspected some vulnerabilities or &lsquoloophole&rsquo in its software that allowed Pegasus spyware to infiltrate the devices of WhatsApp's users. Later in November 2019, the Minister of Law and Electronics and Information Technology through a statement made in the Parliament acknowledged the infiltration of devices of Indian users by the spyware.

In July 2021, a consortium of 17 journalistic organizations including one Indian organization, released in public the results of an investigative effort indicating the use of the Pegasus spyware on several individuals around the world including 300 Indians of the 50000 investigated numbers, many of whom were high-level political figures, senior journalists, doctors, and even some Court staff. At the time a bunch of Writ Petitions was filed and nearly 10 Indians' devices were forensically analysed to confirm the presence of the Pegasus spyware.

How does Pegasus work

Pegasus works through a system of &lsquozero-click vulnerabilities&rsquo which means it doesn&rsquot need any active action on the side of the user to facilitate spyware&rsquos infiltration. It could infiltrate the digital device even with a simple WhatsApp call. Once the spyware has infiltrated the device, it can record audio, video, access mails in real-time, access stored data, etc. The spyware essentially turns the device into a pocket spy device. The device can then be controlled remotely.

Manohar Lal Sharma V. Union of India

The Supreme Court clubbed together a bunch of writ petitions alleging a &lsquocyber-attack&rsquo on its citizens through Pegasus Software. Some of the Writ Petitioners alleged to be direct victims of the Pegasus attack, while others were Public Interest Litigants. The petitions claimed that NSO Group claims to sell its software only to the government and their agencies, the Indian government has abused its power by snooping on its citizens under the cover of national security.

Responding to the petitions, Tushar Mehta, the Solicitor General of India filed a &lsquolimited affidavit denying all allegations made against the Respondents i.e. Union of India. The Solicitor General contended that the petitions were based on unsubstantial media reports and the Hon'ble Minister of Railways, Communications and Electronics & Information Technology of India has already clarified its stance on the floor of Parliament.

Unsatisfied, by the stance taken by the Union of India, the Court directed the respondents to file conclusively reply to the petitions. However, the Solicitor General argued that revealing essential facts in public will have a disastrous effect on the National Security of India. The Solicitor General submitted that such information cannot be made a matter of public debate as the same could be used by terror groups to hamper national security. However, the Solicitor General recommended the formation of an expert committee by the government to investigate the matter. Rejecting the suggestion, Kapil Sibal, learned counsel for the petitioners argued that the Union of India must not be allowed to investigate the matter and the same should be probed by an independent committee formed by the Court.

Rejecting the proposal of the Union of India to avoid bias in the investigation, the Supreme Court constituted a three-member technical committee whose functioning will be overseen by Justice R.V. Raveendran, former Judge, Supreme Court of India.

Technical Committee

1. Members of the committee

Dr. Naveen Kumar Chaudhary, Professor (Cyber Security and Digital Forensics) and Dean, National Forensic Sciences University, Gandhinagar, Gujarat
Dr. Prabaharan P., Professor (School of Engineering), Amrita Vishwa Vidyapeetham, Amritapuri, Kerala. He has two decades of experience in computer science and security areas.
Dr. Ashwin Anil Gumaste, Institute Chair Associate Professor (Computer Science and Engineering), Indian Institute of Technology, Bombay, Maharashtra.

2. Primary objectives of the committee

To enquire, investigate and determine

Whether the Pegasus suite of spyware was used on phones or other devices of the citizens of India?
Details of the victims affected by such spyware.
Steps taken by the Union of India after reports were published in the year 2019 about the hacking of WhatsApp accounts of Indian citizens using Pegasus.
Whether any Pegasus suite of spyware was acquired by the Union of India, any state, or agency.
Under what provisions of law if any governmental agency has deployed Pegasus on the netizens?

Technical Committee seeks information from Pegasus Victims

The Technical Committee on 2nd January 2022 issued a public notice that all the persons who suspect that their phones might have been targeted by the Pegasus spyware can write to the technical committee by 7th January 2022. Those persons must also furnish the reasons as to why they believe their digital devices have been infected by the spyware. At its discretion the committee could order a forensic investigation of the digital device, stated the notice.

Conclusion

The Supreme Court in its order emphasized that in a civil democratic society, people expect a reasonable standard of privacy. It&rsquos not a concern just for journalists or senior leaders, it affects everyone and everyone is ought to be shielded from any possible breach of privacy.

The Supreme Court in the case of K.S. v. Union of India (2017) recognized that the right to privacy is as sacrosanct as human existence and is inalienable to human dignity and autonomy. The right emerges from Article 21 that deals with the right to life and personal liberty.

Censorship or snooping of media can have a disastrous impact on the functioning of democracy as specified in the case of Indian Express Newspapers (Bombay) Private Limited v. Union of India. Democracy functions on checks and balances. Breach of privacy could lead to absolute power and that in turn could lead to the coercion of not only constitutional institutions but also private individuals.

Recently, in the case of Anuradha Bhasin v. Union of India (2020), the Supreme Court highlighted the importance of freedom of the press and the role of the court in a modern democracy. The Court is duty-bound to intervene in any matter detrimental to the rights of the citizens.

The matter has been listed for hearing after 8 weeks from the appointment of the technical committee on 27th October 2020. The judgment will have long-term policy implications and possible amendments or new additions to the rights of the citizen's w.r.t privacy.