Pegasus snooping row: Need for a privacy law?

Nancy Srivastava

Pegasus, the malicious software often categorized as spyware, was recently discovered to have been used to surreptitiously monitor and spy on a large number of public personalities in India. It is meant to access devices without user awareness and collect and send personal data to whoever the software is being used by to spy. The Israeli company NSO Group, which was founded up in 2010, created Pegasus. Pegasus’s initial version, which was caught by researchers in 2016, has infected phones using so-called “spear-phishing”- text messages or emails which lure a target into a dangerous link just by clicking.

Nevertheless, the capabilities of NSO attacks have been increased since then. Infections of Pegasus can be accomplished using so-called “zero-clicks” which don’t require the owner to interact to succeed. It uses the over-the-air (OTA) option to send a push message to the target that covertly injects the spyware. They typically exploit “zero-day” defects or problems in an operating or function system that the manufacturer of the mobile phone does not know about and thus has not been in a position to fix them.

Human rights activists, journalists and lawyers throughout the globe were targeted by the Israeli surveillance company selling phone spyware to governments. The list of those whose phones may have been infiltrated by malware also includes Indian ministers, government officials, and opposition leaders. WhatsApp sued Israel’s NSO Group before the US court in 2019, saying that the company included cyber-attacks on the app by infecting mobile equipment with harmful software.

Protective Legislation

Under the Information Technology Act, 2000, regime Section 66 read with Section 43 makes all spyware-related actions as an offence, since the spyware activity amounts to unauthorized, dishonest, or fraudulent access to the computer resource, without the consent of the user or owner of the computer. Sec 43 furthers makes the access of the computer system, without the permission of the owner a punishable offence.

Since spyware in India itself is prohibited, spyware interception is also unlawful, without the permission of the competent authority. Section 69 Information Technology Act 2000 read with Sec 5 Indian Telegraph Act 1885 provides the Central govt. the power of interception in the interest of sovereignty and integrity of India, security of the State, preventing incitement to an offence. Supreme Court in People’s Union for Civil Liberties v. Union of India (1997) provided the safeguard against the misuse of interception. Spyware also engages in acts that fall under the definition of cybercrime under Section 66B of the Information Technology Act of 2000, which deals with the theft of computer resources. Furthermore, malware is punishable under Section 378 (theft), 424 (dishonest and fraudulent removal of property) and 425 (mischief) of the Indian Penal Code, 1860.

Supreme Court has read into article 21 the right to privacy as one of its facets in Justice KS Puttaswamy v. Union of India. The guarantee of privacy rights put the govt. under the constitutional responsibility to take immediately to safeguard the personal data of its residents, including their privacy. Every action of the Executive must be tested on the lines of proportionality doctrine enunciated by the 9-judges bench. Other clear and decisive actions to prevent unlawful interception and surveillance of persons are sought from the government. Given that no law has been approved by Parliament authorizing the government to use spyware for the interception, such use is plainly forbidden by law and uncalled for. Moreover, there is a brazen attack on freedom of speech and expression under Article 19(1) (a) and an attempt to silence the dissenters and critiques of the authority in power.

Current status of the Controversy

PIL has been filed by N Ram seeking a court-monitored probe into the Pegasus snooping row. Moreover, the Editors Guild of India (EGI) condemned the surveillance of journalists saying it was an attack on the freedom of the press and demanded an independent inquiry into these snooping charges under the aegis of the Supreme Court of India. The Supreme Court’s CJI-led bench also comprising of Justice Vineet Saran and Justice Surya Kant has been hearing the PIL (Manohar Lal Sharma v. The Prime Minister (Narendra Damodar Das Modi), Writ Petition (Criminal) No(s). 314 of 2021 filed by prominent journalists demanding an independent investigation into the Pegasus. The petitioners have been pressing for a legal framework suitably adjusted to guarantee a golden balance between preserving the government’s sovereign rights and protecting user’s digital rights and freedoms. Court has posted the matter for 16 Aug as the Solicitor General sought time for taking instructions. It would be enthralling to observe how the Pegasus controversy is resolved by various stakeholders in times to come.

The author is a LLM student of Constitutional Law at Maharashtra National Law University, Aurangabad

You may follow us on Instagram and Linkedin for daily legal updates.