by Murray Hunter, Alt.Advisory.

 

Introduction

Last month, the Supreme Court of India ordered an independent inquiry into whether the state used Pegasus spyware to spy on its citizens. The judgment, handed down on 27 October 2021, comes after mounting evidence that the surveillance software has been used to target journalists, activists, and politicians in that country, and around the world.

The Pegasus ruling offers guidance on how democratic institutions, and the people who rely on them, can hold governments and surveillance entrepreneurs more accountable. It may pave the way for similar litigation in other jurisdictions.

Domestically, the judgment adds to the growing jurisprudence on the right to privacy in India (which was only confirmed as a right protected by India’s constitution in a Supreme Court ruling in 2017) and the limits of the state using ‘national security’ as a blanket defence against judicial review.

Internationally, it adds to a growing body of jurisprudence limiting surveillance abuses. In February, South Africa’s Constitutional Court struck down sections of the country’s surveillance law in the amaBhungane matter, demanding greater transparency and safeguards for state interception of communications. In May, the Grand Chamber of the European Court of Human Rights declared that the UK’s mass surveillance programmes violate privacy and freedom of expression.

The background

Pegasus is a brand of ‘weapons-grade’ spyware, capable of remotely installing itself on someone’s mobile phone in order to covertly read messages, record calls, and harvest data from the device. Spyware like Pegasus hijacks the very technology that is meant to connect and empower us, and turns it against the user. It’s the very essence of the unchecked surveillance powers that have made digital privacy such a central question for contemporary democracy. The NSO Group, the Israeli firm that developed Pegasus, has said it only sells the spyware to governments, for the purposes of combatting terrorism and serious crime. But there is a growing body of evidence that the software is used nefariously by governments to spy on their critics and suppress dissenting voices.

Earlier this year, an international consortium of news organisations revealed that a leaked database of thousands of suspected Pegasus targets included prominent journalists, human rights defenders, and elected officials across the world – including scores of journalists, politicians, activists and legal practitioners in India. This is not the first finding of its kind: a separate investigation by Citizen Lab and Amnesty International concluded that several Indian journalists and political figures were targeted in a Pegasus exploitation of WhatsApp in 2019.

These revelations prompted a multiplicity of petitions to India’s Supreme Court, from various journalists, politicians, and public-interest groups ­– including several people who have been named as possible targets of the Pegasus software. Broadly, the petitioners wanted an independent inquiry into whether the government had any role in the purchase or use of the spyware against Indian citizens. And broadly, the Supreme Court agreed, with a few features in its ruling that are worth noting.

Surveillance as an infringement of privacy

The ruling expanded on the Court’s previous landmark judgment in Puttaswamy, which confirmed privacy as a constitutionally protected right in India, and which “recognized that the right to privacy is as sacrosanct as human existence and is inalienable to human dignity and autonomy.”

The Court affirmed that privacy “is not the singular concern of journalists or social activists. Every citizen of India ought to be protected against violations of privacy. It is this expectation which enables us to exercise our choices, liberties, and freedom.”

Yet, in considering the facts in this case, the Court also noted that threats to privacy can also have a chilling effect – and like South Africa’s Constitutional Court and the Grand Chamber of the European Court of Human Rights, the Indian Supreme Court noted that unchecked surveillance is a particular threat to media freedom:

“It is undeniable that surveillance and the knowledge that one is under the threat of being spied on can affect the way an individual decides to exercise his or her rights. Such a scenario might result in self-censorship. … Such chilling effect on the freedom of speech is an assault on the vital public watchdog role of the press, which may undermine the ability of the press to provide accurate and reliable information.”

Rebutting national security defences

The Pegasus judgment also serves to set some limits on the extent to which the state can use ‘national security’ as a blanket defence against scrutiny by its citizens or the courts. The Court’s frustration at the state’s reluctance to go on record in the Pegusus matter is clear ­– despite offering the state ample opportunities to respond to the petitioners’ allegations, and repeated reassurance that there would be no need to disclose anything that would comprise national security, the Court found the state had offered only “an omnibus and vague denial”, and its submission “d[id] not shed any light on their stand or provide any clarity as to the facts of the matter at hand.”

The Court also affirmed that, while there is limited scope for judicial review of national security matters, “this does not mean that the State gets a free pass every time the spectre of ‘national security’ is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning.”

The Expert Committee

The Court ordered the establishment of an independent panel, chaired by a former Supreme Court judge, to investigate whether Pegasus software was used to spy on Indian citizens, who was targeted, and whether any Indian government agencies were involved. The panel will also make policy recommendations for law reform on the use of surveillance, the creation of oversight and complaints procedures, and any steps needed to protect the unlawful invasion of citizens’ privacy.

Notably, the Court rejected a proposal by the state’s Solicitor General for the government to be allowed to establish such an inquiry, on the basis that government agencies are alleged to be implicated in the matter ­– and that “justice must not only be done, but also be seen to be done.”

The way forward

Whether this independent panel can get to the bottom of the abuse of spyware in India remains to be seen. But the Supreme Court’s Pegasus judgment is notable in the global context of increasing surveillance abuses. First, it serves to shore up key principles on privacy and democratic oversight of state-security matters in the world’s biggest democracy. Second, the Court’s order is aimed at fact-gathering, which has often proved to be a vital step in litigation and campaigning on surveillance issues.

South Africa’s Constitutional Court judgment in amaBhungane was only possible because the applicants spent years gathering evidence which indicated that the state had spied on an investigative journalist – using court records, freedom-of-information requests, and the findings of media investigations and civil society research. The ruling in Europe on the UK’s mass surveillance programmes was only possible because of disclosures by the whistleblower Edward Snowden, and torturous effort to push through complaints and investigations through arcane oversight bodies.

In the Pegasus judgment, India’s Supreme Court has essentially found that governments cannot simply be taken at their word on surveillance matters, and that the path of transparency is sometimes the only way to redress.

As other societies grapple with surveillance abuses – and government agencies hoping to avoid any serious scrutiny or reform – it’s a lesson worth noting. It now falls on activists and public interest lawyers to take the Pegasus precedent forward. It’s a battle worth fighting and one that we need to win.

* Murray is a Senior Analyst // Researcher at ALT Advisory.