Blog

The Supreme Court-appointed technical committee submitted its report on investigation in the use of Pegasus spyware in the country on August 9, and the hearing in Supreme Court in the case on August 25 showed that the committee could not find any conclusive evidence of the use of the malware in India.

The committee did find malware in five out of 29 smartphones submitted to it, but failed to affirm if it was indeed Pegasus.

For the uninitiated, Pegasus is a malware/ spyware developed by Israel’s NSO Group. It is designed to access any smartphone through zero-click vulnerabilities remotely. Once a phone is infiltrated, the spyware can access entire data on that particular phone. It also gets real-time access to emails, texts, and phone calls, as well as camera and sound recording capabilities of the smartphone.

After infiltration, the entire control over the device can be handed over to the Pegasus operator, who can remotely control all the functionalities of the phone and switch on or off the different features.

In its latest Transparency and Responsibility Report, the NSO Group yet again clarified that Pegasus spyware is used exclusively by government intelligence and law enforcement agencies, and it does not operate the Pegasus system.

According to an investigation carried out by Indian media portal ‘The Wire’, along with 16 international media groups, the spyware was allegedly used to target 174 influential Indians, predominantly journalists, leaders and activists.

Congress MP Rahul Gandhi, IT minister Ashwini Vaishnav, political strategist Prashant Kishor, The Wire’s founders MK Venu and Siddharth Varadarajan, and journalist Rohini Singh are among the Indians who were allegedly targeted by the spyware.

The SC-Constituted Committee Report

The technical committee’s report is divided into three sections. While the first section contains publicly available research material about different types of spyware and their functioning, the second part is about the findings from the 29 mobile phones that were submitted to it for investigation. The third section has the committee’s observations and conclusion.

It is the third section where the technical committee has asserted that there is no conclusive evidence that the malware found in five of the mobile phones belonged to Pegasus.

One of the cybersecurity experts who assisted the technical committee during the investigation and also submitted his report on the matter said, “I did analyse the five malware which was given to us. We analysed how dangerous that malware was, but we had no way to prove that this was from NSO, or Pegasus. That’s exactly what I said to the committee.”

The cybersecurity expert didn’t want to be named due to the political nature of the case.

Justice R.V. Raveendran, who was asked to supervise the entire investigation, has also submitted a separate report with recommendations for laws on data privacy and cybersecurity in the country.

The Wire’s Varadarajan, who is also a petitioner in the case, told Inc42, “CJI Ramana said in open court that Justice Raveendran’s portion of the report would be uploaded, and a redacted version of the technical report too. The written order is silent on these aspects. This is a pity. The report must be made public with whatever necessary redactions are needed to protect the privacy of those who shared their phone details with the committee.”

Why Was The Investigation Inconclusive?

Another expert, who submitted his report to the technical committee, said that there was a slew of issues that led to the inconclusive report.

• Out of the 174 alleged victims, hardly two dozen people submitted their mobile phones despite repeated requests by the committee. This restricted the scope of the investigation.
• Amnesty International’s Security lab provided us with reference points. However, it was not possible to independently establish the link of the malware found in the phones with Pegasus until and unless NSO group cooperated with the investigation.
• Pegasus differs from the dozens of spyware currently being used across the world in terms of its delivery mechanism. Due to the very self-destructive nature of the delivery mechanism and the zero-click factor, it is almost impossible to detect Pegasus through its delivery mechanism. Otherwise, some other malware too has similar capabilities of monitoring and controlling smartphones.

However, some of the experts, including cybersecurity expert Anand Venkatanarayanan, in their submission to the technical committee asserted that the malware in Varadarajan’s and journalist Sushant Singh’s phones was indeed Pegasus.

Venkatanarayanan, in his submission, said, “I found out that malware was indeed found on the phones of Siddharth Varadarajan and Sushant Singh, who are journalists. The malware is indeed the Pegasus of NSO and that there are enough indicators that the Indian state had bought Pegasus.”

On the committee’s failure to corroborate the use of Pegasus, Varadarajan said, “This is precisely why the report needs to be made public…so that we and experts in the field like Citizen Lab, Amnesty International Security Lab and others can evaluate and review the methodology and findings of the committee.”

Government of India’s Non-cooperation

While hearing the Pegasus case in October 2021, the CJI Ramana-headed bench directed the Centre and state governments to fully cooperate with the technical committee.

“The Respondent Union of India and all the State Governments, as well as agencies/authorities under them, are directed to extend full facilities, including providing support with respect to infrastructure needs, manpower, finances, or any other matter as may be required by the Committee or the overseeing former Judge to effectively and expeditiously carry out the task assigned to them by this Court,” the bench said.

However, on August 25, 2022, CJI Ramana told solicitor general Tushar Mehta, “One thing the committee has said, Government of India has not cooperated. The same stand you took here, you have taken there…”

The question is if this amounts to contempt of court by the Indian government.

“The government’s refusal to cooperate with the committee should lead to an adverse inference about the government’s use of spyware like Pegasus against ordinary citizens. And since the Supreme Court last October said national security was not an acceptable alibi for the government, its continuing non-cooperation definitely amounts to contempt,” Varadarajan said.

Next Hearing Likely On September 23

The Pegasus case is likely to be listed on September 23, 2022. With CJI Ramana already retired and Justice UU Lalit taking over as the new Chief Justice of India, the bench will see a change in its members. Besides, the short tenure of Justice Lalit, who is set to retire on November 8, 2022, may push the case further, according to experts.

Justice Lalit has called for greater transparency in the judiciary and is looking to transform some of the administrative practices of the top court, such as the formation of benches and allotment of cases.

Varadarajan said that there are great expectations from the new CJI that he will take this matter to its logical conclusion by making the report public and compelling the Indian government and named officials, serving and retired, to submit affidavits, failing which they should be held in contempt and punished.

The petitioners want to hold the government accountable for its non-cooperation in the investigation.

The Supreme Court recognised privacy as a fundamental right in a landmark judgement in August, 2017. The question is if the country’s apex court can now draw a clear line to restrict the central and state governments from encroaching on the fundamental rights of the citizens in the name of national security.

It seems difficult to do so in this case, say constitutional experts.