Will the Pegasus orders by the Supreme Court set the procedures right for Privacy?

On July 18 after The Wire and several other international publications published reports about the mobile numbers which were “potential targets” of the spyware service given by NSO company to various governments, including India. 40 Indian journalists, political leaders like Rahul Gandhi, election strategist Prashant Kishore, former ECI member Ashok Lavassa etc are reported to be on the list of potential targets, as per The Wire. Several petitions have thereafter filed a petition under Article 32 of the Constitution before the Supreme Court seeking an independent probe into the matter.

A petition was filed by several people including Advocate ML Sharma, journalists N Ram and Sashi Kumar, CPI(M) Rajya Sabha MP John Brittas, five pegasus targets (Paranjoy Guha Thakurta, SNM Abdi, Prem Shankar Jha, Rupesh Kumar Singh and Ipsa Shataksi), social activist Jagdeep Chhokkar, Narendra Kumar Mishra and the Editors Guild of India.

The Apex court was initially hesitant to take up the matter as it was primarily based on newspaper reports only. Later when some of the other impacted countries took cognisance of the matter, some impacted persons indicated that they have forensic reports of their devices indicating the presence of Pegasus and poor response by the government, the Supreme Court decided to intervene.

In response, the central government raised the issue of National Security, to which The Supreme Court categorically said they are not interested in any national security matter but here it is an issue of Fundamental Rights. The government then submitted a “Limited Affidavit”, a new term coined to state half the matter and quiet on another half.

On September 13, a bench comprising CJI NV Ramana, Justice Surya Kant and Justice Hima Kohli had reserved interim order in the Pegasus case, after the Central Government expressed its unwillingness to file an affidavit stating whether it has used the Pegasus spyware or not.

on 27th October 2021, the Supreme Court passed the order to constitute a Committee under its own jurisdiction. The Orders of the Supreme court started with the 1984 quote from George Orwell, “ If you want to keep a secret, you must also hide it from yourself.” The Apex court clarified that it intends to maintain judicial distance from political thicket but will not relent from passing orders to protect fundamental rights.

The court was expecting that the government will shed light on the meta aspect without touching the content if the content is impacting national security. The government took no steps whatsoever to be open about it nor denied categorically that allegations are false, practically binding the hands of the court to precipitate into an action. The proposed expert committee by the government was not approved because it would be perceived as bias, or in the court’s words, “this does not mean that the State gets a free pass every time the spectre of “national security” is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning……. that ‘justice must not only be done but also be seen to be done.”

The Supreme Court thus constituted a committee. The structure of the Committee is as follows:

The committee will “enquire, investigate and determine”

1. Whether the Pegasus suite of spyware was used on phones or other devices of the citizens of India to access stored data, eavesdrop on conversations, intercept information and/or for any other purposes not explicitly stated herein;

2. The details of the victims and/or persons affected by such a spyware attack;

3. What steps/actions have been taken by the Respondent-Union of India after reports were published in the year 2019 about hacking of WhatsApp accounts of Indian citizens, using the Pegasus suite of spyware;

4. Whether any Pegasus suite of spyware was acquired by the Respondent Union of India, or any State Government, or any central or state agency for use against the citizens of India;

5. If any governmental agency has used the Pegasus suite of spyware on the citizens of this country, under what law, rule, guideline, protocol or lawful procedure was such deployment made;

6. If any domestic entity/person has used the spyware on the citizens of this country, then is such a use authorised;

7. Any other matter or aspect which may be connected, ancillary or incidental to the above terms of reference, which the Committee may deem fit and proper to investigate.

The Committee is required to make recommendations:

1. Regarding enactment or amendment to existing law and procedures surrounding surveillance and for securing the improved right to privacy.

2. Regarding enhancing and improving the cyber security of the nation and its assets.

3. To ensure prevention of invasion of citizens’ right to privacy, otherwise than in accordance with the law, by State and/or non-State entities through such spyware.

4. Regarding the establishment of a mechanism for citizens to raise grievances on suspicion of illegal surveillance of their devices.

5. Regarding the setting up of a well equipped independent premier agency to investigate cyber security vulnerabilities, for threat assessment relating to cyberattacks and to investigate instances of cyberattacks in the country.

6. Regarding any ad-hoc arrangement that may be made by this Court as an interim measure for the protection of citizen’s rights, pending filling up of lacunae by the Parliament.

7. On any other ancillary matter that the Committee may deem fit and proper.

The Supreme Court will review the status after 8 weeks.

Writer’s Comment:

It appears that the government has not established any procedure for surveillance systems such as Pegasus. In normal cases, any surveillance is mounted through using Rules under the Telegraph Act, 1885 or under Section 69 of the Information Technology Act, 2000. In both cases, the intelligence agency or the concerned law enforcement agency is required to approach the third parties such as Telecom Service Providers (TSP) or Internet Service Provider (ISP) to get the relevant information.

On 20th December 2018, the Ministry of Home Affairs issued a statutory order in accordance with Rule 4 of the IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009. This order authorised ten central bodies or agencies to monitor, intercept and decrypt any information generated, received, transmitted, or stored in any computer. Following are the agencies notified in the respective order:

· Intelligence Bureau;

· Narcotics Control Bureau;

· Enforcement Directorate;

· Central Board of Direct Taxes;

· Directorate of Revenue intelligence;

· Central Bureau of Investigation;

· National Investigation Agency;

· Cabinet Secretariat(RAW);

· Directorate of Signal Intelligence (for service areas of Jammu and Kashmir, North East and Assam only);

· Commissioner of Police, Delhi.

All the cases of interception, monitoring and decryption are required to be approved by the competent authority, i.e. Union Home Secretary in this case. In an emergency, such an order can be given by the concerned Joint Secretary, which needs to be concurred by the Home Secretary. As per the rules, these powers are also given to the competent authority in the State Governments. Rule 22 of the IT (Procedure and Safeguard for Interception, Monitoring, and Decryption of Information) Rules state that a review committee headed by Cabinet Secretary must meet at least once every two months to review all such cases of interception, monitoring and decryption. In the case of the State Government, a committee headed by the concerned Chief Secretary shall conduct the review process. Other members of the supervisory committee are also the bureaucrats. There is no further checks and balances beyond this. The report of the supervisory committee is marked Secret and no one can access it.

However, in the case of products like Pegasus, there is no third party involved. Pegasus owning agency can deploy it without anyone else getting involved. Therefore no permission of the Home Secretary is considered as required. Hence no report is required to be made to Supervisory Committee. Even if some reports is given, there is no technical or otherwise means with the controlling authority or supervisory committee to check its use or abuse. It appears that the government has not evolved any procedure to create any supervision on the surveillance activities of these agencies. Like there is no permission required by the user agency in case of use of Electronic Warfare systems.

In the humble view of the author, the Supreme court has entered into the domain of the Executive which is unrelated to the case in hand, because the ambit of cyber security is far wider than what is the expectation of the Pegasus case. The recommendations demanded from the committee on the following aspects is well beyond the focus issue of breach of privacy by the state:

• Regarding enhancing and improving the cyber security of the nation and its assets.

• Regarding the setting up of a well equipped independent premier agency to investigate cyber security vulnerabilities, for threat assessment relating to cyberattacks and to investigate instances of cyberattacks in the country.

Overall a fair judgement and it appears that the members of the Supervisory board and Technical Committee are fair, professionals and competent to do the assigned task.

_______________________End_________________________________________________

Comment by Nabankur Sen via WhatsApp : "Read your article thoroughly this morning. In my opinion, it is dangerous and inappropriate for the Supreme Court to totally ignore / avoid the issue of National Security in the terms of reference for the committee. Surveillance is “must” for any Govt to check terrorists’ actions and seditious activities of citizens. There is a need to deep dive in the matter keeping both the Govt and Public in mind. Only people doing negative activities are concerned about surveillance. There must be quantification done by first identifying the “impacted group” in surveillance and solutions searched thereafter."