In July this year, a global coalition of media organisations revealed that a mobile phone spyware — Pegasus — was being used in a number of countries to surveil journalists, activists, dissidents, and political leaders. Manufactured by an Israeli cyber-arms firm called the NSO Group, Pegasus is a highly invasive malware that once installed on an individual’s phone, can collect and transmit data, track activities such as browsing history, and control functionalities such as the phone camera. The NSO Group claims that its only clients are vetted governments. The Pegasus revelations thus indicated the possibility of serious governmental abuse.
Yet another episode
The revelations further showed that around 50,000 mobile phone numbers had been potentially infected by the spyware. Many of these numbers were Indian, and belonged to journalists, activists, and politicians. This was not the first time that such a thing had come to light. India featured on a list of Pegasus-using countries as early as in 2018. In 2019, it was found that a number of activists including some of the accused in the infamous Bhima Koregaon case had been potentially spied upon, and their mobile phones compromised. Later the same year, WhatsApp notified the Indian government of a Pegasus-related security breach, with as many as 121 Indian citizens being targeted. The July 2021 revelations, thus, were not new, but only the most recent and most extensive accounts of military-grade surveillance being carried out upon Indians.
A track of stonewalling
In the aftermath of the Pegasus revelations, certain countries such as France and Morocco ordered immediate investigations. In India, however, the story has been one of continuous official stonewalling. In October 2019, Right to Information requests about whether the Indian government had purchased the Pegasus software were met with a “no information available” response. Parliamentarians put questions to the Government in the Lok Sabha and Rajya Sabha, where, once again, no response on the purchase or use of Pegasus was forthcoming. The Government continued to maintain this stance in response to various Parliamentary questions put to it through 2020 and 2021, and even after the 2021 revelations, including the effective quashing of a Parliamentary Committee inquiry into the issue, with ruling party politicians disabling it from functioning by denying it a quorum.
This history clearly indicates that attempts in Parliament to hold the executive accountable for possible abuse of governmental surveillance powers has been entirely frustrated for more than two years. Under our constitutional scheme, however, there is a third wing of state that exists precisely to address situations where executive abuse and violations of fundamental rights are not being checked by the available mechanisms: the court. Consequently, at the end of July, multiple petitions were filed before the Supreme Court of India, alleging breaches of fundamental rights, and of India’s legislative framework dealing with lawful interception of communications.
However, it has now been almost two-and-a-half months since the petitions came to court, without meaningful action. Between August 5 and September 13, 2021, the Court held six hearings on the case.
The issues are simple
The issues before the Court were simple: did the Government of India authorise the use of Pegasus upon the individuals whose names had appeared in the list? If it did, was there any justification for the use of such intrusive surveillance upon individuals who, admittedly, were not accused of any wrongdoing? And if it did not, was it not a breach of the Government’s constitutional obligations to protect its citizens from the use of military-grade surveillance by rogue actors? It is important to note that the petitions were not some fishing expedition asking the Government to reveal details about its general interceptions techniques: rather, they were brought to court by individuals who had themselves been affected by Pegasus, and were focused upon accountability: in essence, does the Indian Constitution allow for rampant and unchecked surveillance upon individuals — surveillance that goes far beyond simple interception of communication, and effectively hijacks and individual’s mobile phone — with complete impunity?
Nonetheless, throughout the hearings, the Government continued upon its track of evasion: it repeatedly refused to file an affidavit setting out its stance in writing, until nudged by the Court to do so. The final affidavit that it did file was nothing more than a recapitulation of its evasive stance in Parliament. Furthermore, it continued to resist answering the core questions put to it, on the basis that doing so would undermine “national security”. This has, however, been a recent, unfortunate trend: whenever the question of widespread and serious rights violations arises, the Government recites the words “national security” like a mantra, not simply to avoid providing answers, but to hint that even asking the question is somehow illegitimate. In this way, “national security” becomes a cloak for impunity.
On the court’s conduct
Nowhere was this more evident during the course of the Pegasus hearings. If a person whose mobile phone has been hijacked by a military-grade spyware that is only sold to governments, and if the Constitution means anything at all, it means that that person has the right to know why this has been done to him, and at whose behest. And — with the inability of Parliament to hold the executive to account — the only place where the individual can seek answers is the court. This has nothing to do with “national security”, and everything to do with whether we are a country governed by the rule of law — where the rule of law applies to both individuals and to the state — or whether we are living under a regime of executive impunity.
Unfortunately, however, a record of the hearings so far indicates that the Court has allowed the Government to get away with much of its evasion. Despite the passage of two and a half months, the Court is yet to pass any consequential orders including, for example, orders directing the Government to provide the information that it has refused to provide Parliament and to citizens. Furthermore, the Court’s conduct has not been limited to inaction. When the State of West Bengal set up a committee to investigate Pegasus, the Court entertained a plea against it — despite having no ground to do so — and by orally expressing its disapproval (without any clear grounds to do so), effectively compelled the State government to halt the investigation. At no point was any legal justification provided for why the Court decided to hear such an irregular plea, or why the State of West Bengal was required to stop investigating breaches of fundamental rights.
Need for direction
On the last date of hearing, September 13, the Court indicated that it would establish a Committee to look into the matter. However, this puts the cart before the horse: it is unclear why the Court has not yet drawn an adverse inference against the Government for its repeated refusal to answer straightforward questions about potentially abusive surveillance; the setting up of a Committee would make sense after such a finding had been returned. Moreover, the substantial amount of time that has passed since the last order is worrying. In India, we have a long experience of “death by Committee”: issues that require urgent attention linger for many months in a Committee, and once public memory has dulled, are given a quiet burial. It is vital that this should not happen in the present case. Thus, a direction by the Court to the Government to answer whether it has been spying on citizens not accused of any offence — a direct yes/no question — and, if the answer is yes, to require it to explain why or face legal consequences — would be a good start.
Gautam Bhatia is a Delhi-based lawyer
