No ‘free pass’ for ‘national security concerns’: How SC rejected Centre’s arguments on Pegasus

In its order in the Pegasus spyware case on Wednesday, the Supreme Court refused to accept the Union government’s arguments around national security. Instead, it ordered that a committee be formed to inquire into allegations that the military-grade spyware – which is sold only to governments – had been used for unauthorised surveillance of opposition leaders, activists and journalists.

The story about Pegasus being used by governments around the world to snoop on critics was broken in July by a consortium of international media organisations. Shortly after, 12 petitions were filed in the Supreme Court seeking an investigation into the matter and answers from the government. The court began hearing the matter on August 5.

A massive breach

The July media exposes had shown that India was a hotspot for the deployment of the Israeli spyware. which gives attackers near-complete control over a victim’s phone via a zero-click attack – meaning that no action is required on the part of the victim for her data to be exposed.

The Wire published the names of 161 Indians it could identify from the list of over 50,000 phone numbers around the world that might have been infected with Pegasus. These included many journalists, top political leaders, activists, lawyers, academics, bureaucrats and even Supreme Court officials. The human rights group, Amnesty International forensically examined 10 phones from India, “all of which showed signs of either an attempted hack or a successful compromise”.

Who had deployed the military-grade spyware? And what was done with this data?

No answers

In the Supreme Court, the Centre stonewalled all attempts to seek answers by citing national security. In August, it refused to file a detailed affidavit on the matter, with the Solicitor-General of India Tushar Mehta arguing that these matters concerned national security and so could not be disclosed in public.

In Wednesday’s order, the court took a harsh view of the fact that the Centre has repeatedly refused to file affidavits citing national security concerns. “It is a settled position of law that in matters pertaining to national security, the scope of judicial review is limited,” read the order. “However, this does not mean that the State gets a free pass every time the spectre of ‘national security’ is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning.”

But even as the court accepted that its use of judicial review was limited under the national security rubric, it rejected the Centre’s blanket refusal to provide any data on who had deployed Pegasus, arguing that it could only decline to provide information pertaining to the security of the state if it had specific immunity under a law.

The state must specifically plead this and also “prove and justify the same in court”, the bench said. “The mere invocation of national security by the state does not render the court a mute spectator.”

While the Centre had offered to appoint a committee to look into allegations of unauthorised spying, the court rejected that too. The committee must be appointed by the court since it would satisfy the principle of “justice must not only be done, but also be seen to be done”, the bench said.

Given that Pegasus is only sold to governments, several people have alleged that it is the government of India that has bought and deployed the spyware. This, of course, would make it untenable for the government to appoint the investigation committee itself.

Freedom of the press

The court noted that the scope of Pegasus to fully control a person’s smartphone “raised an Orwellian concern” given that this could allow hacker to “hear what you hear, see what you see and to know what you do”. In fact, Wednesday’s order began with a line from George Orwell’s book 1984: “If you want to keep a secret, you must also hide it from yourself.”

The court discussed the right to privacy and how it has to be balanced with national security. It argued that while the right to privacy is not absolute, any restrictions on it must pass “constitutional scrutiny”.

For this, the court reiterated the principles under which the right to privacy could be encroached as laid down in the Puttaswamy judgment, the nine-judge bench case that recognised the right to privacy as a fundamental right in 2017.

Firstly, there must be a law justifying encroachment of privacy. Secondly, there must be a legitimate state aim. That is, the law must be reasonable and guarantee against arbitrary state action as mandated by the right to equality clause of the Constitution. Thirdly, the law must be proportional. That is, the encroachment of the right to privacy cannot be disproportionate to the purpose fo the law.

Following this, the court said that surveillance and the threat of it “might result in self-­censorship” that would be “an assault on the vital public ­watchdog role of the press”. This also poses a threat to the protection of journalistic sources.

Keeping all this in mind, the court said that it is important to investigate this Pegasus allegations.

Technical committee

Given that the Centre had already been given several opportunities to provide information, the court held that asking it again would only end up “causing a further delay in proceedings”. The court argued that it had been forced into action by the intrasigence of the Centre. This had left it with “no option but to accept the prima facie case made out by the petitioners”.

“If the…[Centre] had made their stand clear it would have been a different situation, and the burden on us would have been different,” read the order.

As a consequence, the court appointed a three-member technical committee to investigate whether the Indian government deployed Pegasus, who it has been used to spy on and whether its use was lawful and justified, among other matters.

The committee is expected to suggest laws to prevent incidents of unauthorised surveillance. It will also advise the court on establishing an independent agency to investigate cybersecurity threats as well as suggest mechanisms to prevent the illegal use of spyware by state and Union governments. A mechanism for citizens to complain if they suspect they are being illegal surveilled will be established.

The three members of the committee are Naveen Kumar Chaudhary, dean of the National Forensic Sciences University, Gandhinagar; Prabaharan P, Professor at the Amrita Vishwa Vidyapeetham in Kerala; and Ashwin Anil Gumaste, Associate Professor at Indian Institute of Technology in Mumbai.

This committee will function under the oversight of former Supreme Court Judge RV Raveendran who will be assisted by two more people. These are Alok Joshi, former chief of the Research and Analysis Wing, India’s external intelligence agency and Sundeep Oberoi, a cybersecurity expert.

Also read:

Pegasus case: What you need to know about the Supreme Court’s inquiry into the illegal spyware

Across official denials and BJP responses, one phrase missing: ‘India did not use Pegasus spyware’

What are the ‘reasonable restrictions’ that can be put on the fundamental Right to Privacy?