Pegasus Probe: Why a Transparent Mechanism is Imperative

The Supreme Court’s order in the Pegasus case setting up an independent committee to probe the allegations of illegal snooping in the petitions must adopt a transparent procedure, in order to inspire public trust, writes PARAS NATH SINGH.

THE Supreme Court’s decision constituting a committee headed by former Supreme Court judge Justice R.V. Raveendran to examine whether Israeli software Pegasus was used to target citizens is indeed significant for it, inter alia recognizes that the right to privacy and freedom of speech are alleged to have been impacted by such targeting of the citizen and that it could potentially have a chilling effect on the exercise of such right.

On the face of it, the order would appear to be paving the way to get to the truth behind the targeting of activists, journalists, politicians, judges and government officials using the Israeli spyware. However, the order failed to address the one pivotal issue: did the Government or any of its agencies buy the spyware from the NSO group? We know that the Israeli Government vets the NSO Group’s sales. And it is also on record that the NSO Group sells its product exclusively to government intelligence and law enforcement agencies to fight crime and terror.

The answer to this question could only be a ‘Yes’ or ‘No’. Given the reluctance of the government, what were the options before the court?

Also read: Pegasus interim order: a victory for Indian democracy

Stand of the Indian government

The Central Government through the Additional Secretary in the Ministry of Electronics and Information Technology had filed a “limited affidavit” denying the allegations made in the petitions, saying that they were based on conjectures and surmises, or on unsubstantiated media reports, or incomplete or uncorroborated material and could, therefore, not be the basis for invoking the writ jurisdiction of the court. The affidavit did not shed any light on whether the Central Government had purchased the Pegasus software at all.

The court granted ample opportunity to the Solicitor General Tushar Mehta to file a detailed affidavit in the matter, but he chose not to do so. During the hearing, Mehta submitted that whether the government used a particular software for authorized interception could not be the subject matter of a court debate. Mehta urged the court to appreciate the harm it could cause to ‘national security’ if the government was to disclose whether a particular software was used or not.

The court, while appointing the committee, said “the State couldn’t get a free pass every time, by virtue of its mere mentioning of national security”. Logically, it would follow that the court would direct by a binding order the State to provide this information. At that stage, the State could have claimed privilege under Section 123 of the Indian Evidence Act, stating that it was not in the public interest to provide unpublished information. A similar situation arose in the Rafale case where the court took the view that the papers were not “unpublished” since the Hindu had already put them in the public domain. Thus, there was no question of the applicability of section 123.

Senior advocate Shyam Divan, appearing for one of the petitioners, asked that the Cabinet Secretary be directed to file an affidavit to answer these questions.

Also read: An explainer on the Pegasus Spyware

It may be noted that as per the Supreme Court’s decision in PUCL vs. Union of India (1997), a review committee is headed by a Cabinet Secretary at the Central level who reviews the orders passed by the Home Secretary authorizing phone interception in terms of Section 5(2) of the Telegraph Act.

The court did not adopt this procedure. If such an affidavit was filed, not only would the government have had to justify its claim of “national security” before the Supreme Court but the claim would have been subject to judicial review by the court, and the court could well have held that there was no threat to national security.

Indeed during the arguments, counsel for the parties whose phones were, in fact, targeted stated that national security would be threatened by the targeting of their phones, and security would be best protected by an inquiry into the question of who purchased the spyware and against whom it was used.

Though the Central Government did not expressly hide behind section 123 of the Indian Evidence Act, it did so impliedly during the hearing. The court has so far avoided deciding whether the disclosure of the fact that the government acquired Pegasus spyware would affect the “national security”. This issue can only be decided by way of judicial review, and not by the committee constituted by the court.

If the court was so pessimistic about receiving any information from the Cabinet Secretary on the facts surrounding Pegasus, what is the surety that the Indian Government will be extending its full cooperation to the court-appointed committee or that it will share any information on Pegasus with the committee?

Though the Supreme Court has authorized the committee to take statements of any person in connection with the inquiry and call for the records of any authority or individual, it has not examined the merit of the claim of the central government for withholding the information on the purchase of the spyware. The Centre may even deny the information citing section 123 of the Evidence Act as this issue has remained undecided by the court.

The Supreme Court could and should have compelled the Central Government to state on affidavit whether it had purchased the spyware, and if the Centre was to refuse this information, the court ought to have decided the validity of such denial.

In S.P. Gupta v. Union of India (1981), the Supreme Court held that where a claim for immunity against disclosure of a document is made under section 123, the court may in an appropriate case inspect the document to satisfy itself whether its disclosure would, in the particular case before it, be injurious to public interest and the claim for immunity must therefore be upheld.

This authority was relied upon by the Supreme Court in 2019 in the Rafale case, in which the court held:

“That apart, as held in S.P. Gupta vs. Union of India a claim of immunity against disclosure under Section 123 of the Indian   Evidence   Act has to be essentially adjudged on the touchstone of public interest and to satisfy itself that public interest is not put to jeopardy by requiring disclosure the Court may even inspect the document in question though the said power has to be sparingly exercised.    Such   an   exercise, however, would   not   be necessary in the present case as the document(s) being in the public domain and within the reach and knowledge of the entire citizenry, a practical and common-sense approach would lead to the obvious conclusion that it would be a meaningless and an exercise in utter futility for the Court to refrain from reading and considering the said document or from shutting out its evidentiary worth and value…”

Also read: Is it the Last Flight for Pegasus? [Part-I]

Mandate of the Committee

One of the terms of reference of the court-appointed committee is to ascertain whether any Pegasus suite of spyware was acquired by the Government of India, or any state government, or any central or state agency for use against the citizens of India.

The government, which refused to share this information with the highest court of the country, cannot now be expected to share this crucial piece of information with the committee. The committee is not one with powers under the Commissions of Enquiry Act and with the powers of a civil court. Arguably, the court can authorize the committee to issue “search and seizure” orders enabling the committee to access any documents it chooses to access.

The most obvious records to be checked would be the records of orders of the Secretary of the relevant department authorizing an interception under Rule 419A of the Indian Telegraph Rules, 1951, the only law which authorizes the interception of devices for stated reasons and check if any of the names of the persons whose phones have been targeted or are in the list of proposed targets appear there.

We now have a list of names of people who are proposed to be targeted by Pegasus. We also have confirmation from the Citizens Lab and Amnesty International of some targeted phones. It would be worthwhile to check if these names appear in the documentation under Rule 419A. The other source, no doubt, would be NSO Group and the State of Israel, but they may not be subject to the jurisdiction of the committee or may even refuse to answer questions anyway.

How far and effectively the committee will be able to make headway is not clear, but an opportunity to hold the government to account by the Supreme Court has been lost.

Also read: Digital evidence in the shadow of Pegasus

Will Committee adopt transparency?

The Supreme Court has given the committee liberty to devise its own procedure to effectively implement and answer the terms of reference set by it. It is authorized by the court to hold such enquiry as it may deem fit, and as indicated above, it can take the statement of any person in connection with the enquiry and call for the records of any authority or individual.

Senior advocate Indira Jaising took to Twitter to demand that the committee devise a transparent procedure and allow open hearings of its proceedings. She said the committee should invite the public to submit to it any information regarding the use of remotely-planted malware to frame citizens and snoop on them.

There is merit in what Jaising has said. First, such an exercise will build public confidence in the committee.   Second, such an exercise will also help in answering one of the terms for reference, that is, the details of victims and/or persons affected by such a spyware attack.

It may be recalled that in 2019, the global messaging giant WhatsApp Inc. identified vulnerability in its software that enabled Pegasus spyware to infiltrate the devices of WhatsApp’s users. The Supreme Court has also directed the committee to enquire into what investigation if any was made pursuant to this disclosure in 2019. The disclosure followed a lawsuit filed in a US federal court in San Francisco in which WhatsApp alleged that the Israeli NSO Group targeted some 1,400 WhatsApp users with Pegasus.

Also read: Is it the last flight for Pegasus? [Part–II]

As far back as 2019, lawyers defending the human rights activists arrested in the controversial Bhima Koregaon (BK) case had confirmed that Pegasus targeted their phones. It has also come on record that at least eight of the BK accused were on the list of potential targets.

Not everybody who had been targeted by Pegasus was before the court, and thus it would be in the fitness of things that the committee devise an open and transparent mechanism to go ahead and issue a public advertisement with the mandate, notwithstanding, the hurdles it may face as indicated above.

(Paras Nath Singh is a Delhi-based lawyer. The views expressed are personal.)

The article was originally published in The Leaflet.