At an Independence Day function organised by the Supreme Court Bar Association, Chief Justice of India N.V. Ramana lamented the lack of debate in parliament before laws are passed. This, he said, leads to a lot of confusion and multiple rounds of unnecessary litigation.
The CJI also called upon intellectuals and lawyers to actively participate in public life.
The need for parliamentary debates is rooted not only in the desire to iron out creases in draft legislation, but also to address issues of public importance and inform citizens on state policies and clarify issues that may emerge from time to time. It is precisely this function which parliament failed to fulfil, for one reason or another, in the abruptly concluded Monsoon Session. The Modi government chose not to make clear and categorical statements regarding the serious allegations of the use of Pegasus spyware to snoop on the opposition, journalists and human rights activists.
While the government is suggesting that any public discussion on the use of Pegasus may pose a threat to national security – the CJI has said that the court will be mindful of this – that in itself does not prevent a discussion on the legal regime of surveillance in India and whether the use of Pegasus would fall within or without the confines of the law.
Simply put, spyware like Pegasus cannot be lawfully used in India as it is not only unconstitutional but also does not have legal sanction.
The Telegraph Act
Section 5(2) of the Telegraph Act of 1885 provides the basis for interception of telephone calls, or phone-tapping as it is colloquially called. The constitutionality of this was challenged in the Supreme Court by the People’s Union for Civil Liberties, and in a judgment dated December 18, 1996, the Supreme Court upheld the constitutionality of the provision, subject to certain procedural safeguards which were later codified in Rule 419A of the Telegraph Rules, 2007.
The suggestion that since phone-tapping is permitted under Section 5 of the Telegraph Act, this means Pegasus can also be procured and put to use under the said provision, is a lazy analysis not only of the law but also of Pegasus, which is by no means a mere tool for the interception of messages.
Also read: A Look at How Pegasus Brings the Best of Technology to Achieve the Worst
The scope of Section 5(2) of the Telegraph Act is to prevent transmission, carry out interception and ensure disclosure of message(s).
The term ‘message’ is defined in Section 3(3) of the Telegraph Act to mean “any communication sent by telegraph, or given to telegraph officer to be sent by telegraph or to be delivered.”
Thus, at best, Section 5(2) can be resorted to in order to authorise interception of messages including multimedia messages sent (or received) by a device to (or from) another device. It does not envisage constant surveillance by the electronic device including of all multimedia files which were created in the device and not sent by telegraph to anyone else, nor does it envisage recording people’s real-life interactions that take place in the vicinity of their device but not through it.
Illustration: The Wire
This concept is better understood once the term “interception” has been analysed.
Information Technology Act
The Minister of Electronics and Information Technology, Ashwini Vaishnaw, on July 19, 2021, stated in parliament with regard to the allegations of the use of Pegasus that, “In India, there is a well established procedure through which lawful interception of electronic communication is carried out…”.
This begets the question – what is the scope of the term “interception”?
The answer to this lies in Rule 2(f) of the Information Technology (Procedure for Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, which were passed in furtherance of Section 69 of the IT Act which provides power to issue directions for interception, decryption or monitoring of information.
Interception is defined to mean the acquisition of the contents of any information so as to make the contents of the information available to any person other than the sender, recipient or intended recipient of the communication. Thus, it is amply clear that ‘interception’ can only be done of the contents of information that forms part of some ‘communication’ through a computer resource, and not of actions and conversations that simply happen to be near a computer resource.
In simpler words, this implies that lawful interception means that the government can have eyes and ears on messages and media shared through electronic devices, but it cannot weaponise the device itself to be an eye and an ear to what happens around it as opposed to in it.
Intercepting messages does not mean turning phones into spy-cams
In effect, interception of messages and information under the Telegraph Act and the IT Act only applies to ‘communication’ made through telegraph or computer resources, which is very different from the wide arsenal of surveillance that is offered by Pegasus once it infects a phone.
The use of someone’s mobile phone’s microphone or camera to record her actions or conversations which take place in their daily lives, and not over their electronic device, is thus not authorised by either Section 5(2) of The Telegraph Act or Section 69 of the Information Technology Act.
To argue the contrary is to fundamentally fail in understanding the difference between surveillance by lawful interception and illegal surveillance by unlawful hacking of electronic devices.
The law allows the state, under certain circumstances, to keep an eye on our devices, but that does not permit the state to turn the device itself to its eyes to record things and actions that do not use the electronic device. It is that jump from surveillance over electronic devices to surveillance by electronic devices which makes Pegasus alien to the scheme of the Telegraph Act and the IT Act, and it travels from the field of interception to that of illegal hacking, which attracts the penalties listed under Chapter IX of the IT Act.
How will we fight terrorists then?
I do not argue against lawful interception of messages and information sent or communicated over electronic devices.
The law clearly allows for that, and that gives ample ammunition to the intelligence and law enforcement agencies to track terror activity. Any messages or information sent from one device to another can be lawfully intercepted by state agencies. Thus, if any terror outfit sends any messages or information to one of its sleeper cells, such messages can be intercepted under the law without even resorting to use of a deeply pervasive software like Pegasus.
The use of Pegasus allows interception and much more, and it is in this domain of what more Pegasus offers its clients which is of alarm and concern, and which travels far beyond the realm of lawful interception carried out in the interest of the State. The argument of need for Pegasus to intercept terrorism related messages is premised on the notion that lawful interception cannot be done by any other means, and that the use of Pegasus will be limited to interception only and nothing more, although there is no way to presently gauge its use and keep a check.
The government of India has not placed any material in the public domain to justify either of these two notions.
Also read: As Multiple Governments React to Pegasus Exposé, India Is an Outlier
Incompatible with India’s constitutional democracy
One of the essential limbs of the test of proportionality is that state action must have a legitimate aim which is permissible in a democracy, and that it must also be the least invasive means to achieve the state’s goal.
The use of a Pegasus-like spyware which provides remote access not only to the electronic device but also to the life and activity around the device, exposes journalists and political opponents of the government and leaves them vulnerable to excesses. One can imagine that if the government has eyes and ears on the whereabouts of all potential whistleblowers, then not enough whistles will get blown, which is detrimental to a functional democracy.
A deafening silence of state-controlled media would overpower public narratives and dissenting voices would find it impossible to exercise their constitutional rights if all their conversations and actions are under constant watch and scrutiny, even if it is carried out in the purported privacy of one’s home.
A deeply pervasive spyware like Pegasus, which effectively turns an electronic device into a spy cam, can never be permitted as an investigative or security tool which is deployed in use against India’s own citizens – be it journalists, social activists, politicians, lawyers, court officers, judges, or victims of sexual harassment at the hands of mighty men.
The distinction between intercepting messages or information sent over electronic devices vis-a-vis an electronic device working as a spy cam to record one’s actions and communications which were not carried out through the said device, is critical to the issue of illegality of Pegasus.
The law may permit the state to look through an individual’s phone for information, but it definitely does not permit the state to constantly look at the individual through his phone.
For instance, if I eat cake, and send a picture of it to my friend through my phone, the interception if carried out for one of the legitimate grounds listed under Section 69 of the IT Act, would result in the state learning that I sent a picture of myself eating cake to my friend. However, if I eat cake and take no picture of it and tell nobody, yet if the state uses my mobile which was in my shirt pocket to turn the camera on through Pegasus and record me eating cake, then such a recording is not lawful interception but illegal hacking which breaches the fundamental core of my privacy and my intimate life.
This example would hold true for anything one does without using their electronic devices, which the state captures an image, audio or video of, using Pegasus on people’s phones. Concepts of spousal privilege and lawyer-client confidentiality, the right to silence and the right against self-incrimination, would all stand in jeopardy under the glare of Pegasus.
The inner core of privacy, intimacy and human dignity would stand shredded if Pegasus was sanctioned by law, and that is why I argue that such a software would not be constitutionally compatible in India, even if new legislation is attempted to be brought in to protect it, as it would be an unreasonable and disproportionate restriction on the fundamental right to privacy and human dignity.
Soutik Banerjee is an advocate practising in New Delhi.
The Pegasus Project is a collaborative investigation that involves more than 80 journalists from 17 news organisations in 10 countries coordinated by Forbidden Stories with the technical support of Amnesty International’s Security Lab. Read all our coverage here.