Since 2019, Israeli software maker NSO Group Ltd. which owns the Pegasus technology is facing a lawsuit in the U.S. brought by technology giants Facebook Inc., Microsoft Corp. and Google. The suit was initiated by WhatsApp in 2019 on grounds that NSO used the messaging platform’s servers to send malware to approximately 1,400 mobile phones and devices.
Even as outcome of this litigation is pending, last week Pegasus was back in news after a consortium of global media organisations published investigative reports that more than 50,000 devices were targets of the spyware.
In France, journalists Lénaïg Bredoux and Edwy Plene have complained to the Paris public prosecutor that Morocco’s secret services violated their privacy by deploying Pegasus spyware on their phones. The French Ministry of Justice has tasked an arm of the country’s judicial police to investigate the matter.
In India, The Wire has so far reported names of 151 individuals—journalists, politicians, activists—whose phones were target of surveillance. The NSO group has claimed it sells the spyware to only “vetted governments”.
The controversy has prompted Rajya Sabha Member John Brittas and journalists N Ram and Sashi Kumar to knock on the most obvious door—the Supreme Court. The West Bengal government has appointed a two-member commission of inquiry, headed by former Supreme Court judge Justice Madan Lokur, to investigate allegations of illegal hacking, monitoring, surveillance, among others.
As per The Wire, Amnesty International’s Security Lab conducted an independent digital forensic analysis on 10 Indian phones—these showed signs of either an attempted or successful Pegasus hack. But so far, there’ve been no reports on police complaints by individuals whose devices were allegedly a target of this attack.
The government’s response has been unsurprising—that there haven’t been any illegal surveillance attempts.
So, how should these allegations be investigated? BloombergQuint posed that question to senior counsels.
There are two questions—who should conduct an enquiry and under what law?
A retired judge of proven credibility would be good to conduct an enquiry. But the judge will have no jurisdiction to question the central government on critical issues such as purchase of licences, the amount paid and the names of the persons targeted. Hence, only an enquiry under The Commissions of Inquiry Act, 1952, will yield results. Government will be bound to provide answers. Yet, even there they may get away by citing nation security.
If a phone is hacked or unauthorised voice recording done it’s an offence under the Information Technology Act and/or the Telegraph Act. In the Pegasus affair, there are allegations which fall within the scope of both or either sets of offences.
In my view, it is open to any aggrieved person to file a complaint with the police and seek legal redressal through courts if police do not register a FIR or investigate. Alternatively, the police can register the FIR on information in the public domain as the offences are cognisable and they can investigate.
At present, the identity of the offender is not known which can only be discovered through an investigation under the law. I understand a parliamentary panel is looking at the allegations.
Since a petition has been filed, the Supreme Court can examine the issue from the perspective of an alleged breach of right to privacy under Article 21 and allegations of offences.
The question on course of investigation in a case like this arises due to a legal vacuum— first, we as citizens don’t have a right on our data since there’s no data protection law. Second, there’s no statute to govern the intelligence agencies that are alleged to have carried out a surveillance of this nature. We’re perhaps the only constitutional democracy that exists in this vacuum- most others have either a parliamentary or senate oversight.
Pegasus is a result of both—lack of data protection law and intelligence agency reforms. It’s not the first time that surveillance of this nature has taken place—it has consistently been done even in the past. What’s unprecedented here is that this time you’ve been potentially able to infiltrate the physical device—copy data, extract emails, phone calls and text messages.
Now, who should a private citizen subject of this attack file a complaint with?
One option is a police or CBI investigation. Then there’s the Supreme Court which should look into the matter. Third option is a committee under the Commissions of Inquiry Act, 1952—what the West Bengal government has done. But such a commission won’t have any bearing on the central government. Also, this commission lacks legal teeth—the government can accept or reject their report.
Finally, there’s the parliamentary standing committee on IT which can call before itself experts from the field of technology and espionage, individuals whose devices were allegedly targeted, and government agencies. There’s value in such a report being published. Not all our problems will be solved by prosecution but a report like this will ascribe accountability.
There’s no territorial jurisdiction over the company that owns this technology. So, how are we to find that it sold spyware to the Indian government?
Possibly, the Supreme Court can appoint an independent committee. But can they carry out a fact-find exercise of any potential agreements between the government and the NSO? And will the government cooperate? I doubt that. I suspect, if a committee is set up by the apex court, it will meet the same fate as the SIT on black money—nothing will happen.
As for a police or CBI investigation, it’s all humbug. I’m not optimistic about this approach.
It’s unlikely that the government will set up a joint parliamentary committee. Joint committees are set up by a motion passed in one house of parliament and agreed to by the other. The opposition parties should continue to demand a JPC.
But practically speaking, even if a JPC is set up, they’d want to examine the devices which have been allegedly hacked. Will those individuals agree considering no FIRs have been filed by them as yet? The instrument is the basic evidence but these individuals may not want to subject their devices to forensic analysis citing right to privacy. The hope is some of them would cooperate.