Pegasus vs Privacy: What the government can expect from the Supreme Court

That the government’s refusal to furnish more details would result in an adverse inference being drawn by the SC is a certainty. What the consequences of such adverse inference is likely to be is the question that now takes primacy

Intrigue and mystery continue to hound the Pegasus row. The central government started off strong by categorically denying any violation of privacy but appears to have fallen short of the requirement expected by the Supreme Court (SC).

This studio photographic illustration shows a smartphone with the website of Israel's NSO Group which features Pegasus spyware. (AFP)

Two broad heads of inquiry were needed once the Pegasus spyware issue came to the fore — on its usage against citizens of India and its purchase. The latter does not, by itself, constitute material in the context of the hearing before the SC but the former, ie, usage of a spyware to monitor individuals, certainly raises serious concerns that needed to be addressed immediately.

On usage, the focus was, till now, on the individuals claiming violation of their privacy rights, whereas in law, the burden always lies with the person raising a claim. But with the ambivalent stand taken by the government before the SC, it appears that the norm may have been turned on its head and the government is now in the spotlight having to prove the negative (if negative it be).

That the government’s refusal to furnish more details would result in an adverse inference being drawn by the SC is a certainty. What the consequences of such adverse inference is likely to be is the question that now takes primacy.

The law is explicit on the Centre’s rights to intercept, monitor (including traffic data), decrypt or block. Parliament has enacted provisions under Sections 69, 69A and 69B of the Information Technology Act, 2000 (as amended), and read with the rules framed thereunder, these clearly delineate the permissible from the impermissible.

The permissible is restricted to access not only through compliance with the process set out under these provisions, including of reasonable cause and orders based thereon by a competent authority, but also for any act of interception, decryption or monitoring to be undertaken through the intermediary or service provider.

For instance, if law enforcement needed to decrypt or monitor a WhatsApp group for circulating paedophile content, the same would be feasible through a written order of the competent authority, based on the request in writing by a government agency, supported by reasonable cause. This order of the competent authority would be implemented thereafter through the service provider, which, in this hypothetical case, is WhatsApp. Nowhere in the IT Act or Rules is there permission for use of spyware.

Similarly, Section 5 of the Indian Telegraph Act, 1885 provides for taking temporary possession or for interception. The Rules framed for implementing Section 5 explicitly provide for the interception directions to be served on the designated officer of the licensees under the said Act. Hence, similar to the IT Act, the Telegraph Act also clearly vests the implementation of an order for interception in the licensee or service provider.

Usage of a spyware, therefore, for interceptions or monitoring does not have the imprimatur of law. The SC, in Puttaswamy v UOI (2017), upheld and clarified privacy to be a sacrosanct fundamental right. It cannot be trivialised or diluted, least of all through ambiguous claims.

The appointment of an independent committee by the SC appears inevitable. There can only be speculation on the scope of inquiry ie, of whether the same would expand to include purchase also or be limited to usage.

An adverse inference against the government would not, by itself, absolve the individuals claiming violation of their privacy of their burden of proof. At best, an adverse inference only provides the basis for the intervention of the SC. Each person claiming infringement of his or her rights would still have to establish such violation. However, if the scope were to include the issue of purchase, then the ball lies squarely in the government’s court. The reason to assume that the scope of inquiry may be limited to only usage is that while purchase may be assumed to precede usage, mere preparation in law is not a violation, unless such act of preparation itself amounts to a violation.

Either way, for India and its citizens, the Pegasus row is a positive move, for as with Narada and his trouble-making, it is from Kalaham (conflict) that clarity results.

NS Nappinai is an advocate, Supreme Court of India and founder – Cyber Saathi

The views expressed are personal