On July 18, 2021, The Wire, as part of an international collaborative investigation titled “Pegasus Project”, revealed that the Israeli spyware firm NSO targeted “over 300 verified Indian mobile telephone numbers, including those used by ministers, opposition leaders, journalists, the legal community, businessmen, government officials, scientists, rights activists and others” through their spyware, Pegasus. Subsequent reporting by the Wire and the Washington Post revealed that forensic analysis conducted by Amnesty International's Security Lab definitively showed that the Pegasus spyware had been used to target 37 phones, of which 10 belonged to Indians.
Mr. Rupesh Kumar Singh and Ms. Ipsa Shatakshi are independent activists of repute, with over seven years of standing. Both of their phone numbers are in the leaked database. However, as of the date, it has not been verified whether their phones were attacked with the Pegasus Spyware. Mr. Singh and Ms. Shatakshi have approached the Supreme Court asking it to declare that the use of spyware such as Pegasus, is unconstitutional. The Supreme Court has pronounced a judgment regarding the use of Pegasus, constituting a committee of technical experts to examine the allegations of unauthorised surveillance using the Pegasus spyware. This is not the first time that the Supreme Court has taken such a measure, since earlier this year the Court had also constituted a four member expert committee on the controversial farm laws.
This Committee comes in the wake of the Government of West Bengal’s Commission of Inquiry, a two member Commission set up to investigate the issue. On August 3, 2021, the Commission had issued a public notice calling for statements on the Pegasus revelations. However, consequently, on August 25, 2021, the Government of West Bengal told the Supreme Court that the two-member Commission of Inquiry, headed by retired Supreme Court Judge Justice Madan B. Lokur, will not proceed until the apex court hears petitions seeking a probe into the alleged surveillance scandal as well as those challenging the state government’s decision to appoint the commission.
The Committee has been authorised by the Supreme Court to devise its own procedure, conduct investigation as it deems fit, take statements of any person in connection with the enquiry, and crucially “call for records of any authority or individual”. We urge the Committee of Experts to adhere to the following best practices:
- The Committee must place a public advertisement, preferably in a widely read national daily newspaper, calling for victims and those affected by Pegasus to submit comments to the Committee.
- The Committee must invite comments, suggestions and submissions from civil society organisations, independent technical and domain experts including Amnesty Tech and Citizen Lab, who have worked specifically on uncovering the use of Pegasus.
- The Committee must summon relevant government officials from the Ministries of Home Affairs, Electronics & Information Technology, Communication, Law & Justice and the Prime Minister’s Office (including the Cabinet Secretary) to provide testimony before it.
- The Committee must conduct a first hand forensic analysis of the affected devices in accordance with the highest international standards to ascertain the presence of the Pegasus and the probable attack vector.
- The Committee must make public all the submissions it receives from members of civil society and other independent cybersecurity researchers as well as the final findings of their own analysis.
- The Committee must make public the final report that it will submit to the Supreme Court at the end of its examination.
It is important to ensure that the Committee proceeds with the tenets of transparency and accountability in place since these norms have already been violated by the unconstitutional use of Pegasus on the victims.
Important Documents
- SC appoints a committee to examine the use of Pegasus Spyware in India dated October 27, 2021 (link)
- IFF’s Statement on Hacking Revelations made by the Pegasus Project dated July 19, 2021 (link)