No Pegasus proof; govt didn’t play ball: Panel

The Pegasus row erupted in July last year after an international consortium of media outlets and investigative journalists reported that the phones of Indian ministers, politicians, activists, businessmen and journalists were among the 50,000 that were potentially targeted by Pegasus, Israeli company NSO Group’s phone hacking software.

The Supreme Court on Thursday disclosed that a panel of experts it appointed has found no evidence of the use of Pegasus spyware to snoop on the 29 phones which were examined, even as the panel has complained that the Union government did not assist it in the probe. Some malware was detected on five of the 29 phones but there was nothing to show it was Pegasus, the court added.

HT , on August 6 first reported that the technical analysis of the mobile phones threw up lack of evidence to suggest use of the Israeli spyware. (AFP file photo)

“One thing the committee has said...the government of India has not cooperated. The same stand you took here, you have taken there,” the bench, headed by Chief Justice of India NV Ramana, told Solicitor General Tushar Mehta, who was appearing for the Union government.

Responding to a bunch of petitions filed by lawyers, politicians, journalists and civil rights activists, the Centre in August last year refused to confirm or deny whether it used Pegasus spyware for surveillance of Indians, contending that such disclosure would be against national interest.

In the wake of the Centre’s stand, the court , in October set up the expert panel, to be supervised by a retired judge of the court, RV Raveendran, to investigate whether the Centre or any state government acquired and used Israeli spyware Pegasus for surveillance of Indian citizens, and to also ascertain details of people targeted. It said noted that the government cannot get “a free pass every time” by raising the “spectre of national security”.

On Thursday, the bench revealed the crux of the confidential report, adding that the expert panel has further recommended a slew of reforms in the legal regime to protect citizens against illegal surveillance and cyber-attacks, apart from putting in place a robust complaint redressal mechanism.

HT , on August 6 first reported that the technical analysis of the mobile phones threw up lack of evidence to suggest use of the Israeli spyware.

During the brief hearing on Thursday, the bench, which included justices Surya Kant and Hima Kohli, revealed that the voluminous report is in three parts. While the first two parts dwell on examination of the phones, information about malware, public research material and materials extracted from the devices, the third part is authored by Raveendran.

The technical committee, said the bench, has requested the court not to put the first two parts in public domain in view of the sensitive information relating to malware and private information of persons whose phones were analysed.

The court added that Justice Raveendran’s report can be made public as it made recommendations regarding enacting a law on surveillance, protecting citizens’ privacy by strengthening the cyber security network of the country, and creating a special investigation agency for investigating cyber attacks.

“We can upload the overseeing judge’s report. There is no secret. As far as the other parts of the report are concerned, the committee has said that it is not for public consumption...the report has concluded that there is inconclusive evidence on Pegasus on any of the 29 phones that were given. In 5 phones some malware was found but the technical committee says it cannot be said to be Pegasus. It could be due to their poor cyber security...this is the crux,” the bench declared.

At this point, senior counsel Kapil Sibal, representing one of the petitioners who had demanded a court-monitored probe into allegations regarding use of Pegasus spyware by the central government, requested the bench to share with the petitioners a redacted version of the report to let them know what kind of malware was found. “We don’t want portions which have national security implications,” he clarified.

At this point, solicitor general Tushar Mehta intervened to say that the technical committee has already submitted its final report and has also expressed certain concerns about making certain parts public. “This court might take into account the concerns over national security while deciding the issue of sharing the report,” added the law officer.

To this, the bench retorted that the panel has complained in the report that it did not receive cooperation from the central government. Mehta replied that he is not aware of that.

The court then adjourned the case by four weeks, saying it would go through the report to ascertain the parts that cannot be shared. “We will look into this and see which portions can be released,” said the bench.

The Pegasus row erupted in July last year after an international consortium of media outlets and investigative journalists reported that the phones of Indian ministers, politicians, activists, businessmen and journalists were among the 50,000 that were potentially targeted by Pegasus, Israeli company NSO Group’s phone hacking software. According to this consortium, Pegasus can switch on a target’s phone camera and microphone, as well as access data on the device, effectively turning the phone into a pocket spy.

The Union ministry of electronics and information technology, in a three-page affidavit filed in August last year refused to confirm or deny whether it used Pegasus spyware for surveillance of Indians. The Centre instead offered to set up an expert committee to look into the controversy and “dispel any wrong narrative spread by certain vested interests”.

Cybersecurity experts sought more answers from the technical panel and how it concluded that there was no evidence. “The methodology of the scrutiny carried out by other countries and groups like Amnesty have been peer reviewed. Why has the committee not disclosed the methodology? Was the methodology tested as per standards? In other words, did the panel test the technique to rule out both false positives and false negatives,” asked Anand V, who was among the independent experts who deposed before the committee and had found evidence of Pegasus infection when he analysed the phones of some of the targets.

By its order on October 27, the court dismissed the Centre’s plea to let it set up a committee of experts, maintaining that such a course of action would violate the settled judicial principle against bias that justice must not only be done, but also be seen to be done. It instead constituted a panel on its own, engaging the services of some well-known experts in the field of computer science, cybersecurity and digital forensics.

It appointed National Forensic Sciences University’s dean Naveen Kumar Chaudhary, Amrita Vishwa Vidyapeetham’s professor Prabaharan P and IIT-Bombay professor Ashwin Anil Gumaste as members of the technical committee for submitting a report after a “thorough inquiry”. For assistance of Justice Raveendran the bench appointed former IPS officer Alok Joshi and cyber security expert Sundeep Oberoi for overseeing the functioning of the technical committee.

In its October 2021 order, the court asserted that “in a democratic country governed by the rule of law, indiscriminate spying on individuals cannot be allowed except with sufficient statutory safeguards, by following the procedure established by law under the Constitution”.

(With inputs from Binayak Dasgupta)