On October 27, India’s Supreme Court ordered a “thorough inquiry” into the government’s alleged use of Pegasus spyware to monitor journalists and others by secretly surveilling their cell phones. The Israeli company NSO Group, which created Pegasus, says it sells only to official law enforcement agencies.
Journalists in India have been aware of the threat since 2019, when WhatsApp notified several that a Pegasus operator had tried to exploit the messaging app to access their phones; a former home secretary told CPJ at the time that Pegasus was “available and used” in India. In July 2021, when allegations of Pegasus surveillance surfaced across the globe, Indian news website The Wire partnered with Amnesty International and the investigative journalism group Forbidden Stories to reveal the names of 161 possible Pegasus targets in India, including 29 journalists.
NSO has disputed the allegations by WhatsApp (the company is fighting a lawsuit WhatsApp filed against it in a U.S. federal court) and said the Pegasus Project allegations are false. CPJ emailed the company’s press email to request comment about sales to India, but received an error message.
Indian government officials also said the Project’s reporting had no substance, and five of those affected – freelance journalists Paranjoy Guha Thakurta, S.N.M. Abdi, Prem Shankar Jha, Rupesh Kumar Singh, and activist Ipsa Shatakshi – petitioned the Supreme Court to intervene.Three were suspected targets, while Amnesty confirmed traces of Pegasus infection on phones belonging to Guha Thakurta, a former editor of the Economic and Political Weekly journal, and former Outlook journalist Abdi,according to The Wire.
Ajay Prakash Sawhney, secretary of India’s ministry of electronics and information technology, did not immediately respond to CPJ’s email requesting comment.
Lawyer Apar Gupta, who has argued before the Supreme Court and is the executive director of the local digital rights group Internet Freedom Foundation, spoke to CPJ by phone about the Supreme Court’s move, and what will happen next. The interview has been edited for length and clarity.
Why should journalists, in India and elsewhere, be paying attention to the Supreme Court’s initial judgment?
The petitioners who have approached the court include senior journalists as well as journalists who work in rural districts. This issue concerns much more than surveillance – democratic processes will be subverted once controls are exerted over [journalists] or information gathered on them in a clandestine manner.
[The Supreme Court] stated that working journalists’ ability to gather information and talk to their sources will be impacted by surveillance. It has also stated that such surveillance brings into focus the larger public injury of self-censorship – which is essentially any person fearing that they can be infected [with spyware], thereby causing a chilling effect in which people don’t express criticism or displeasure against government policies.
Is this good news for the petitioners?
It is premature to have any celebrations. It is only the commencement of the process of investigation and we are quite distant from any kind of accountability.
The court has directed an independent committee to probe into two clear aspects. First, the committee should inquire about certain questions, and second, make recommendations towards accountability and changes in law.
What are your expectations from the committee?
While some commentators are a bit more cynical about the committee, I do hold some hope [for] a positive outcome, because it is headed by a retired supreme court judge [Justice R.V Raveendran]who has a fairly good reputation. Further, it comprises of a technical expert [Sundeep Oberoi] in the domain of cybersecurity, alongside a former senior civil servant [from the] intelligence services, Alok Joshi, [formerly] the head of the Research and Analysis Wing, which is a powerful policing and surveillance body in India.
The court has also crafted well-structured terms of reference which are direct as well as expansive, so they give [the committee] ample powers and flexibility.
[However,] the committee could have included voices from civil society who have been at the forefront [of anti-surveillance campaigns] or digital rights experts who understand Pegasus spyware.
The Indian government has been largely unresponsive on this important issue. What is your reading of the court’s judgment on this matter?
The judgment notes the non-cooperation of the [central] government in providing even the most basic information beyond what it calls a “limited affidavit” – which was essentially two pages, and annexed a pre-existing statement made by [Ashwini Vaishnaw], the minister of electronics and information technology, before parliament on July 18.
The court states that facts [in the petitions] are not just reliant on newspaper reports, but on actual forensic reports. The nature of such allegations requires a specific response. The court expresses dissatisfaction [with the government’s affidavit] and provides further time to the government to look at the petitions factually and specifically. The government fails to do this.
The court notes that these are serious violations because of the impacted parties, including Rupesh Kumar Singh, a journalist from Jharkhand. [Spyware surveillance] would not only cause him mental duress and anxiety, but would also have a direct impact on [his] freedom of speech and expression, given that he is a working journalist and it will compromise his sources.
The government’s [claim is] that talking about this issue will impact national security, and terrorists will get to know how we procure technologies and how we use them. The court goes on to say: “National security cannot be the bugbear that the judiciary shies away from by the virtue of its mere mentioning.”
These are significant observations, which, if followed as legal precedent, will help check the rampant use of national security as a [cover] for state impunity, in which legal examination is prevented in courts and tribunals in India.
At an advanced stage of the hearing, [the government] offered to set up [its own] expert committee. The court notes that there is reasonable apprehension expressed by the petitioners: given that Pegasus can only be purchased by governments, there is a real possibility of its use by an Indian state agency. Secondly, it notes that there is a lower degree of confidence in the government, given that there is lack of progress in any official investigation regarding the first Pegasus disclosures in November 2019. That’s why it sets up a committee independent of the government.
Another independent investigation, under a parliamentary standing committee headed by opposition lawmaker Shashi Tharoor, stalled. Why do you think this committee will be any different?
As per media reports, the standing committee had a high degree of division along political lines. One of the sittings could not be conducted, as lawmakers from the ruling Bharatiya Janata Party refused to sign the attendance register. This is symptomatic of the polarization which has impeded the functioning of this committee. The committee which has been set up by the Supreme Court does not have such limitations.
[Editor’s note: BJP lawmaker Nishikant Dubey, a member of the parliamentary standing committee on information technology, did not immediately respond to CPJ’s email requesting comment.]
Has the court set any time frame for the committee’s inquiry?
No time frame has been set for the committee. On the contrary, [it] has been given full liberty to devise its own process and procedure. However, the [Supreme Court] has kept [its own] judgment pending on the Pegasus petitions, which will come up for hearing after eight weeks. At that point of time, we will get to know much more.