Pegasus ruling a call for law on cyber security

Pavan Duggal

Cyber Law Expert

The Supreme Court has once again emerged as the guardian of privacy and other rights of the citizens with its landmark judgment in the Pegasus case. The Pegasus issue has rocked many countries across the world, including India. Various Indian stakeholders complained of being targeted by the Pegasus software, which is a spyware aimed to strip them of their privacy. Consequently, petitions were filed before the apex court.

While analysing those petitions, the court was categorically asking the Union of India to come up with its crystal clear response to the same. However, the government’s approach was embodied in raising the flag of national sovereignty and security. So much so, the government also did not take any clear stand before the court on the actions taken by it regarding Pegasus.

Consequently, keeping in mind the compelling circumstances, the court has come up with a judgment built upon the existing jurisprudence on privacy. By forming the technical committee, the court has started the process for examining in depth various allegations made by petitioners on the unauthorised activities and spying engaged in through the use of the Pegasus software, which is created by a legal entity based in Israel.

While surveillance is a legitimate tool in the hands of governments, it can only be in accordance with the stipulated parameters and procedures established by law. No wonder, the Supreme Court categorically held that indiscriminate spying of citizens cannot be allowed except in accordance with law. This becomes more relevant given the fact that India is a democratic country governed by rule of law.

While the said judgment is historic as it has upheld the importance of protecting the right to privacy, it is also equally a watershed inasmuch as it has, for the first time, addressed the nebulous issue of national security.

Earlier we had been seeing the scenario where the government would often raise the issue of national security and that alone would be enough for preventing the court from examining issues connected therewith. This is so because national security purely comes within the parameters of the executive and it’s the sovereign government which alone has the right to protect and preserve national security, sovereignty and integrity of India as also protecting the Indian sovereign interests in cyberspace.

While the court acknowledged the right of the government to deny information where the issue of national security is involved, it has once again reiterated that courts cannot become mute spectators at the mention of national security. The principle of law that has evolved is that the issue of national security does not escape the gaze of judicial review.

This judgment is effectively going to open a new door for the evolution of jurisprudence pertaining to national security and connected legalities. Cyber security today has become such an important element and factor impacting nations like India. Given the fact that India does not have any dedicated law on cyber security, this judgment throws light on the way forward as to how the issues pertaining to national security will have to be dealt with by the judiciary.

Following this judgment, governments of the day will have to quickly see the writing on the wall. They will have to be mindful of the fact that while they may raise the national security card in an argument before the court, it is not always that the courts are going to not pierce the veil of national security that is being popped up. This judgment also reiterates the power of judicial review. The executive has its responsibility towards protecting national security. However, it has an equally accountable responsibility towards the judiciary when the judiciary is exercising judicial review processes.

More and more national security issues as also cyber security aspects are likely to come up for consideration before the Supreme Court. Citing this judgment, courts could now push the envelope of cyber legal jurisprudence as also jurisprudence concerning national security law to come up with a balanced approach.

There is no denying the fact that national security is paramount. However, national security should not be used to trammel the liberties of citizens. There has to be a harmonious balance between the protection of national security on the one hand and the protection of enjoyment of individual liberties on the other.

The technical committee has been handpicked by the Supreme Court and has been given various terms of reference. These terms include the mandate given to the committee to inquire, investigate and determine various aspects pertaining to the use of the Pegasus suite of software on phones and actions connected therewith and also legalities pertaining to use of the Pegasus suite of spyware on the citizens of the country. In that direction, the court has authorised the committee to devise its own procedure to effectively implement and answer the terms of reference, hold such inquiry or investigation as it deems fit and take statements of any person in connection with inquiry and call for the records of any authority or individual.

Further, the court has requested the technical committee to make recommendations pertaining to the enactment of legal provisions on surveillance for securing the improved right to privacy and also for enhancing and improving the cyber security of the nation and all its assets and also to ensure the prevention of invasion of the citizens' right to privacy, otherwise done in accordance with law.

The court is further expecting the committee to come up with recommendations regarding the setting up of a well-equipped independent premier agency to investigate cyber security vulnerabilities, for threat assessment relating to cyber attacks and to investigate instances of cyber attacks in the country. As India does not have a dedicated cyber security law, this judgment represents a first major step forward in the evolution of a law in this regard. The committee is going to deal with issues that are transnational in nature. Further, the ability of the committee to access information residing on the NSO servers is an area where more clarity would be required.

The setting up of the committee is a great starting point. However, it’s not the destination; it’s the beginning of the journey where, as time passes, the court is likely to customise legal orders and approaches, keeping in mind the evolving cyber security standards and frameworks on the horizon. It is a call for the nation to wake up to the menace of cyber attacks and surveillance and come up with a dedicated, comprehensive legislation on cyber security. At a time when countries like China, Singapore and Australia are moving miles ahead in this direction, India is a nation that is lagging behind. The Supreme Court has risen to the occasion and has, indeed, eminently played its role as the protector and torchbearer of individual rights and liberties.

However, going forward, a more holistic approach will have to be adopted. Governmental interests will have to be protected while individuals’ enjoyment of civil liberties and fundamental rights need to be also safeguarded. Hopefully, the SC judgment could act as a catalyst for the further evolution of cyber security legal jurisprudence in India in the coming times.