Case Summary and Outcome

The Supreme Court of India found that there was a prima facie case to create an Expert Committee to examine the allegations of unauthorized surveillance and privacy breaches by the Indian government and foreign parties on Indian citizens. Numerous petitioners, including journalists, lawyers and other human rights activists, alleged that their digital devices were compromised by Pegasus spyware, developed by an Israeli technology firm, on the basis of an investigation conducted by 17 media organizations from around the world. The Court ruled that unauthorized surveillance of stored data from the digital devices of citizens through spyware for reasons other than the nation’s security would be illegal, objectionable, and could have far-reaching consequences to not only privacy rights, but also rights to freedom of expression. Given the government’s refusal to provide information under the blanket defence of “national security”, the Court found that it had failed to provide sufficient information to justify its position and thus ordered the creation of an independent committee to investigate the petitioners’ allegations.

---

Facts

The Petitioners in this case were a group of Indian citizens, including journalists, lawyers and human rights activists, who claimed to be directly affected by Pegasus spyware, alongside numerous other public interest litigants concerned about unauthorized surveillance and communication interception in India.

In September 2018, a Canadian research laboratory named Citizen Lab revealed that certain unnamed government intelligence and law enforcement agencies had been using Pegasus, “a spyware suite” developed by an Israeli technology firm (the NSO Group). The software compromises a person’s digital device by giving a Pegasus user real-time access to that person’s entire stored data, emails, texts, phone calls, camera, and sound recordings. The entire control is given to the Pegasus user, who can then remotely control different functionalities of the device without any action by the device owner. Citizen Lab estimated that it had affected citizens from nearly 45 countries. In May 2019, instant messaging giant WhatsApp Inc announced that Pegasus could have infiltrated the devices of WhatsApp users. On 20 November 2019, India’s then Hon Minister of Law and Electronics and Information Technology revealed in parliament that certain Indian citizens had been affected by the software.

On 15 June 2020, Citizen Lab and Amnesty International announced they had discovered another spyware campaign which targeted nine people in India.  On 18 July 2021, 17 media organizations from around the world, including one Indian organisation (“The Wire”) revealed a list of some 50,000 mobile numbers which were allegedly infiltrated by Pegasus software (and thus under surveillance by clients of the NSO Group). Consequently, foreign governments either started engaging with the Israeli government or initiating internal investigations into the allegations. Allegedly, around 300 of these phone numbers belonged to Indian journalists, doctors, political figures and court staff. At the time of filing the writ petitions, Pegasus software had been confirmed to be found on ten Indian citizen’s phones.

On 18 July 2021, the Minister of Railways, Communications and Electronics and Information Technology (representing the Indian government, who was the Respondent in this case) questioned the factual basis of the reports and denied the occurrence of any illegal surveillance. The Minister also repeated the “extremely rigorous” nature of Indian laws relating to surveillance and communication interceptions, and that no illegal surveillance would be able to take place under that regime [para. 8].

On 10 August 2021, the petitions were served on India’s Solicitor General. The Petitioners filed their writ petitions in the Supreme Court of India against the Respondent (the Indian government), requesting an independent investigation into the allegations of unlawful surveillance, cyberattack and breach of privacy of these Indian citizens. Citing the inaction of the Respondent to appropriately consider the allegations raised by the many reports into the use of Pegasus software, the Petitioners questioned whether the Respondent and its agencies had been a client of the NSO Group without following the established statutory regime regarding surveillance in India.

---

Decision Overview

The Chief Justice of India, N V Ramana, Justice Hima Kohli, and Justice Surya Kant delivered the judgment of the Supreme Court of India as a three-judge bench on 27 October 2021. The main issue for consideration was whether a prima-facie case had been sufficiently made out by the Petitioners against the Respondent regarding alleged unauthorized surveillance and breach of privacy, which would warrant the establishment of an independent committee to investigate the allegations.

Petitioners’ arguments: 

The Petitioners raised various arguments against the Respondent. To bolster their claims, they relied on various affidavits of cybersecurity experts, cross-verified reports from various reputable news organizations across the world, and reports of organizations like Citizen Lab.

Most significantly, the Petitioners claimed that the Respondent’s unauthorized surveillance through the Pegasus spyware not only violated their right to privacy, but also amounted to a “chilling” of their freedom of speech [para. 21].

They argued that the Pegasus software could be used not only to monitor an individual’s device, but also to implant false documents and evidence into it – which could implicate that said person. As such, it was the Respondent’s responsibility “to take necessary action to protect the interests and fundamental rights of the citizens, particularly when there existed the risk that such an attack was made by a foreign entity” [para. 19]. Similarly, the Petitioners claimed that, despite the Parliament’s acknowledgment in 2019 that some form of hacking had occurred, no subsequent action had been taken – which was a “grave concern” [para. 18]. Instead, the Respondent had refused to provide any information to them on the current matter – and that withholding of information violated their fundamental rights as Indian citizens.

It was also raised that the Respondent had not made any specific statement denying the allegations that it had used the software or otherwise illegally monitored the Petitioners. As such, it could be inferred that the Respondent had admitted to the allegations. Further, given this lack of denial, the Respondent could not be trusted to form its own Committee to investigate the matter – rather, the Court must create an independent Committee headed by a retired judge to avoid any “credibility issues” whereby neither the public nor the Petitioners would trust the results of the investigation [para. 20].

Respondent’s arguments: 

The Respondent filed a “limited affidavit”, arguing that the kind of surveillance information sought by the Petitioners could not be made public as it may jeopardize the national security of India and could be used by terrorist groups. Reiterating the statement made by the Minister of Information Technology, the Respondent emphasized it had not engaged in any illegal surveillance.

The Respondent was willing to create an Expert Committee to investigate “all aspects of” these allegations, and to “assuage the concerns of the public and to dispel any wrong narratives” [para. 17]. Despite the Petitioners concerns, it argued that there was no reason for the public to doubt the credibility of any such Committee constituted by the Respondent.

Applicable Law

The right to privacy is constitutionally protected under the “right to life,” enshrined in Article 21 of the Indian Constitution. This right to life in India has an “expanded meaning” – which “does not refer to a mere animal existence but encapsulates a certain assured quality” [para. 30], including the “sacred private space of an individual” [para. 31]. As held by the Court in the landmark case of K S Puttaswamy v Union of India (2017) 10 SCC 1 (“Puttaswamy”), the right to privacy in India was held to be “as sacrosanct as human existence and is inalienable to human dignity and autonomy” [para. 32].  The Court in that case recognised that the right to privacy is not absolute and noted the competing rights of other constitutionally valid restrictions: namely, a law justifying any such encroachment on privacy; the requirement of a “legitimate State aim” ensuring the “nature and content of the law which imposes the restriction falls within the zone of reasonableness”; and the proportionality of the legislation to “the object and needs sought to be fulfilled by the law” [para. 34].

The right to privacy in the information age

The Court began by immediately upholding the right to privacy as “sacrosanct” and constitutionally protected, as per its previous ruling in Puttaswamy [para. 32]. Particularly in this era of “information revolution, where the entire lives of individuals are stored in the cloud or in a digital dossier”, the Court stipulated that it must recognise the ability of technology to breach an individual’s privacy in the same way it can improve their lives [para. 31]. Further, it noted that information from Indian citizens is now collected not only by classic State and intelligence agencies, but also by financial services companies, telephones, emails and the like – which can be used for legitimate purposes such as preventing violence and terrorism, but any such use must be “evidence-based”, as well as “absolutely necessary for national security/interest and… proportional” [paras. 35-6]. Drawing from Article 21 of the Constitution, the Court reasoned that every single citizen of India as “[m]embers of a civilized democratic society have a reasonable expectation of privacy… [i]t is this expectation which enables us to exercise our choices, liberties, and freedom” [para. 32]. However, as stated above, this right has reasonable restrictions – as do all other fundamental rights – and the Court will need to balance competing interests accordingly.

While applying these legal principles to the present case, the Court acknowledged that“ [i]n a democratic country governed by the rule of law, indiscriminate spying on individuals cannot be allowed except with sufficient statutory safeguards, by following the procedure established by law under the Constitution” [para. 36]. The Court opined that the right to privacy is directly infringed whenever the state or any external agency surveils or spies on an individual, and this trade-off must be appropriately balanced.

Surveillance and press freedom

The Court further noted that the threat of surveillance, or indeed, knowledge that one may be being spied on, can hugely impact the way a citizen “decides to exercise his or her rights”, and may result in self-censorship, which is particularly significant when relating to freedom of the press [para. 39]. It stated that “such a chilling effect on the freedom of speech is an assault on the vital public watchdog role of the press, which may undermine the ability of the press to provide accurate and reliable information” [para. 39]. Referring to the case of Anuradha Bhasin v. Union  of India, (2020) 3 SCC 637, the Court had applied a test of comparative harm whereby it had judged whether the State’s restrictions had had a restrictive effect on other similar individuals during that time, as well as on any such Plaintiff – and that, without that evidence, it is impossible to “distinguish legitimate claim of chilling effect from a mere emotive argument for a self-serving purpose” [para. 39].

Similarly, the Court stressed the importance of protecting sources of information, as one of the most basic conditions on any press freedom in India. Without this protection, sources could be deterred from helping the media to inform the public on matters of vital interest to the public [para. 40]. As such, the Court reasoned that this case assumed “great significance” given the “importance of the protection for journalistic sources for press freedom in a democratic society and the potential chilling effect that snooping techniques may have” [para. 41].

The excuse of “national security”

The Respondent had refused to provide sufficient information to the Court about this matter, on the grounds of “national security”, and had failed to clarify its stand on these allegations or any other facts of the matter [para. 45]. Drawing upon precedent set by Ram Jethmalani v. Union of India, (2011) 8 SCC 1, the Court condemned the Respondent’s withholding of information and otherwise “blinding the petitioner”, particularly in a case such as this where the constitutionally protected, fundamental rights of its citizens are concerned [para. 46]. Poignantly, the Court noted that the provision of information by the Respondent was an “important step towards Governmental transparency and openness, which are celebrated values under [the] Constitution” [para. 47]. Although there may be specific circumstances where the Respondent can rightly defend its position to deny the Court and/or the Petitioners access to certain information (such as to protect the sovereignty of India, public order, contempt of court and the like), the Respondent could not get a “free pass” each time it mentioned national security, allowing the Court to become a “mute spectator”, and nor could national security “be the bugbear that the judiciary shies away from, by virtue of its mere mentioning” [paras. 49-50]. The Court stipulated that the Respondent must be able to specifically plead, prove and justify a specific constitutional concern or other statutory immunity on affidavit, alongside the relevant facts which indicate the information that it requests to stay secret in the interests of national security.

Here, the Respondent had failed to show how the revelation of information could affect national security and that the mere mention of national security didn’t bar the court from exercising its power. As such, the Court felt it must accept the prima facie case brought by the Petitioners to investigate the allegations.

The Court found there to be a “broad consensus that the unauthorised surveillance/ accessing of stored data from the phones and other devices of citizens for reasons other than nation’s security would be illegal, objectionable and a matter of concern” [para. 52]. On that basis, its remaining question was which remedy it should issue.

The independent Expert Committee

Given the fact the Respondent had repeatedly failed to file an affidavit on record with any facts about the case or as to their national security defence, the Court was reluctant to direct the Respondent to file an affidavit with the relevant facts. Conversely, the Court passed an order to constitute an independent Expert Committee under the supervision of a retired Supreme Court Justice R V Raveendran, which would investigate the nature of the allegations, the “public importance and the alleged scope and nature of the large-scale violation of the fundamental rights of the citizens of the country” [para. 55]. The Committee further comprised of a non-biased, nonprejudicial and otherwise independent group, including Mr. Alok Joshi, former IPS officer; Dr. Sundeep Oberoi, Chairman, ISO/IEC; Dr. Naveen Kumar Chaudhary, Professor (Cyber Security and Digital Forensics); Dr. Prabaharan P., Professor (School of Engineering); and Dr. Ashwin Anil Gumaste, Institute Chair Associate Professor.

The Court reasoned that this was necessary, for reasons including the potential impact on the right to privacy and freedom of speech, the potential “chilling effect” of this case on the rights of the entire Indian population, the Respondent’s lack of action, the Government allegedly knowingly depriving the rights of its citizens, and the seriousness of any potential involvement of foreign parties/ countries, agencies or other private entities [para. 56]. It declined to allow the Respondent to appoint an Expert Committee for the purposes of investigating the allegations, as such a course of action would violate the settled judicial principle against bias, i.e., that “justice must not only be done but also be seen to be done” [para. 57].

The Court requested that the Expert Committee determine a variety of facts, including whether Pegasus spyware was used to access or otherwise intercept the information held by Indian citizens on their devices, which citizens had been affected, whether that spyware was acquired by the Respondent, and if used, under what law it was deployed. The Expert Committee was also asked to make recommendations on several issues including the need for, or amendment of, any laws surrounding surveillance, improvement of cyber security, prevention of invasion of citizens’ right to privacy through spyware, the establishment of a grievance mechanism, and the establishment of an independent premier agency to investigate cyber vulnerabilities [para. 61].

Conclusion

The Court was of the opinion that the allegations of unauthorised surveillance or otherwise access to the stored data of citizen’s devices for any reason beyond national security would be “illegal, objectionable and a matter of concern” [para. 52]. Given the potential ramifications for freedom of the press and the right to privacy, alongside the Respondent’s withholding of information with a blanket defence of “national security” purposes, the Court ordered the creation of an independent Expert Committee. The Respondent and its associated agencies/authorities were directed to provide full support to this Committee as may be required. The Court requested the Committee’s inquiry and subsequent report to be prepared as soon as possible.

---