By Professor Pallavi Gupta and Professor NK Bahl
Every nation craves to protect its core values to enable its people to lead their lives in a free and secure manner, according to their shared common beliefs by preserving their national identity and sovereignty. National security is an umbrella under which core values are well protected and promoted through application of a well thought out strategy. In other words, national security is a state where our most cherished values, beliefs, our democratic way of life, our institutions of governance, our unity, welfare and well-being as a nation are permanently protected. Foreign invasions, terrorists, unwanted viruses and softwares peeping into our privacy may be threat to national security. Pegasus is one such software.
National security is the defence and security of a nation, including its citizens, economy and institutions. Has the security of the nation really been affected by violation of privacy through a spyware like Pegasus or is national security used to invade into the privacy of an individual, especially in the absence of a law?
Justice KS Puttaswami vs Union of India (2017) was a breakthrough judgment of the Supreme Court wherein the right to privacy was upheld as an intrinsic part of the right to life. A nine-judge bench unanimously held that right to privacy was a constitutionally protected right in India. This case was filed by a retired judge of the High Court challenging the government’s proposed Aadhaar scheme for a uniform biometric based identity card which would be mandatory for access to government services and benefits.
So what is Pegasus? Pegasus in Greek mythology is a winged horse that sprang from the blood of the Gorgon Medusa as she was beheaded by the hero, Perseus. Subsequently, Bellerophon attempted to fly with Pegasus to heaven but was unseated and killed. Pegasus ultimately could not make it to heaven and instead, became a constellation in the northern sky. The moral of the story is to avoid hubris, which may be defined as overweening presumptions that leads a person to disregard the divinely fixed limits on human actions in an ordered cosmos.
On the petition of N. Ram and Sashikumar, the Supreme Court took the right step in checking the flight of the modern-day Pegasus. The order of inquiry by the Court whether the government purchased the Israeli spyware Pegasus and used it to access private information on the mobiles of citizens must be acclaimed. The State cannot get a free pass every time in the garb of national security to violate the fundamental right to personal liberty and privacy of its citizens by orchestrated snooping through the Pegasus spyware.
The right to privacy and Pegasus appear to be the antithesis of each other because the latter undermines privacy. Pegasus can be covertly installed on mobile phones running with the IOS and android versions. End to end encryption is a technology that scrambles messages on your phone and unscrambles them only on the recipient’s phone. This means that anyone who intercepts the messages in between can’t read them. This kind of encryption is good for protecting the privacy of an individual. Governments of a few countries do not like this liberty because it makes it difficult for them to spy on criminals, terrorists, dissidents, protesters and journalists.
Pegasus can stealthily enter a smartphone and gain access to its camera and microphone. It is designed to infiltrate such devices and turns them into surveillance devices. Once this spyware worms its way into a mobile phone, it can convert it into a 24×7 surveillance device. Pegasus can track a mobile’s location by tracking cell signals from a cell tower transceiver like a stingray device. Wi-Fi and Bluetooth signals can also be used to track the mobile phones. Consequently, the keeper of it can be traced.
The stand of the spyware selling company that it sells Pegasus only to governments for the purpose of tracking criminals, terrorists and law enforcement works. The company does not disclose its clients. How to check the misuse of the software in such a scenario?
The earlier version of Pegasus was installed on smartphones through vulnerabilities in commonly used apps or by spearphishing, which involves tricking a targeted user into clicking a link that is secretly installed in the software. Pegasus spyware can also be installed over a wireless transceiver located near a target. Nowadays, Pegasus can be installed on smartphones by just giving a missed call on WhatsApp. This means that this latest version of Pegasus does not require the user to do anything, and it amounts to zero-click-exploitation of the user.
After installation, Pegasus can harvest any data from the smartphone and transmit it back to the attacker. It can steal photos, videos, recordings, location, communications, web searches, passwords, call logs and even social media posts. Pegasus also has the capacity to activate cameras and microphones for real time surveillance without permission or knowledge of the user.
In India, the Pegasus project investigations alleged that the spyware was used on ministers, Opposition leaders, political strategists, journalists, activists, Supreme Court judges, religious leaders and administrators like Election Commissioners and heads of CBI, etc.
Based on the petition, the Supreme Court appointed a three-member panel of cyber experts to probe the alleged use of Pegasus for surveillance, saying that every citizen needs protection against privacy violations and mere invocation of “national security by the state” does not render the Court a “mute spectator”. Former Supreme Court judge, Justice RV Raveendran was urged to oversee the functioning of the three-member panel. The appointment of this fact-finding committee appears to be a necessity in the present circumstances.
In a democratic country governed by the rule of law, indiscriminate spying on individuals cannot be allowed except with sufficient statutory safeguards by following the procedure established by law under the Constitution.
The violation of fundamental rights is a matter of serious concern. If the government is acting in accordance with the law of the land, then it is ok, otherwise its actions are bound to be condemned. National security cannot be the answer every time. There are reports that the spyware was purchased by official agencies, and at the same time, it was used to access personal information from the mobiles of certain individuals, who approached the Supreme Court for violation of their privacy. The answer was not coming from the government.
The government might be justified in its right to withhold this information on the ground that its disclosure would compromise national security. The important point is that if the government is not willing to make disclosure before the Supreme Court citing confidentially, it would be very surprising if the committee will be able to make much headway and succeed in accomplishing its purpose.
Why was the Supreme Court obliged to pass such an order of appointment of a fact-finding committee? The probable answer appears to be that there is no law which could regulate the surveillance for lawful purposes through a fair and reasonable procedure. In the absence of any such law, the surveillance is ordered and executed through decisions of the bureaucrats, which patently remains outside the pale of law. Secondly, whenever a writ is filed before the court, it is bound to balance the right of privacy of the individual vis-à-vis national security. Judges are bound to apply their discretion while balancing the rights and national security; intelligence gathering will depend upon the subjective views of various judges.
At the same time, the outcomes are bound to be governed by the thinking of the judges, which may be pro-liberty or pro-security. These orientations may have their own merits, but neither the appointment of the fact-finding committee and gathering of facts, nor the foundation of right to privacy can function in such an ad-hoc manner.
Moreover, constitutionally, surveillance through Pegasus can never be a license in the hands of the government to peep into the personal life of the individuals. But fear and apprehensions are created by executive dictates in the absence of proper legislation. Surveillance and intelligence gathering have to be done in accordance with procedure established by law. Such a law will ensure responsible investigations and enjoy the confidence of the public at large.
It is also suggested that accountability of the investigating officers should also be fixed by law so that they work sincerely. All said and done, kudos to the Supreme Court for taking a bold step in checking the flight of the modern-day Pegasus. But the enactment of legislation for lawful surveillance through programmes like Pegasus is the need of the hour.
—Professor Pallavi Gupta is HoD, JEMTEC School of law, Greater Noida, and Professor NK Bahl is a former District & Sessions judge, UP