Pegasus and the Law

The Pegasus spyware controversy, which involved the use of zero-click vulnerabilities to take control of android and iOS devices of many Indian journalists, human rights activists, and lawyers, has reached the Supreme Court of India. In an order in the case of Manohar Lal Sharma v Union of India, the Supreme Court has constituted a committee to look into the questions that carry implications for India’s surveillance laws, future data protection legislation, and the right to privacy. Here is a look at some of the legal questions that must be addressed going forward.

There are questions regarding the applicability of surveillance law in India to the Pegasus spyware. For instance, can Section 5 of the Indian Telegraph Act, Rule 419A of the Telegraph Rules, Section 69 of the Information Technology Act, and the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, which provide for the interception of messages, be relied upon for the use of spyware such as Pegasus? Fundamentally, does the use of Pegasus constitute interception or monitoring as per the definition of these terms under the law, and can the grounds of occurrence of public emergency or the interest of public safety be relied upon for the use of Pegasus? If yes, an important question is also whether the condition is fulfilled that the information could not have been intercepted by reasonable means other than the use of an intrusive spyware such as Pegasus. Alternatively, can it be said that the Pegasus software goes beyond just intercepting information. It involves hacking of devices by gaining access to the device’s microphone and camera, for which a penalty is prescribed under Sections 43 and 66 of Chapter IX of the Information Technology Act.