Is Govt's Stance in SC on Pegasus an Admission They Used It? What Happens Next?

Solicitor General Tushar Mehta's responses raise red flags, but Centre could still hide behind 'sealed cover'.

(On 13 September, Solicitor General Tushar Mehta reiterated the arguments made by him on behalf of the Modi government nearly a month before, that they did not wish to state on affidavit that they had used Pegasus spyware against Indian citizens. As with his arguments on 17 August, he insisted that a confirmation or denial would not be in the interests of national security, and that the government would instead provide answers to an expert committee which could look into the issues, which would then report to the Supreme Court. This article analysing the earlier arguments, originally published on 18 August, is being republished in light of the final position taken by the Centre on the Pegasus issue on 13 September.)

Did the Modi government inadvertently admit to using the Pegasus spyware on Indian citizens?

"I’m not saying I will not tell anyone, I just wish to not say it publicly."

That's what Solicitor General Tushar Mehta said in the Supreme Court on Tuesday, 17 August. He was explaining why the central government did not want to confirm or deny on affidavit if it had purchased and used the Pegasus spyware on Indian citizens.

The court had asked Mehta if the Centre would be willing to clarify whether it had done so, as this question was relevant to the petitions before it regarding use of the spyware.

Several pleas have been filed in the court asking for judicial probes into the allegations, and disclosures by the government of its use of such spyware, both in writ petitions by alleged Pegasus victims as well as PILs by journalists, activists and MPs.

While the Centre had filed an affidavit in the apex court on 16 August, in which they claimed the allegations were based on "surmises and conjectures" and "unsubstantiated media reports", the affidavit had not denied that the central government or any of its agencies had deployed the spyware.

The Modi government had, in this affidavit, said it was willing to set up a committee of experts to examine the issue, and it was to this that Mehta returned on Tuesday, telling the court that the Union Government would be willing to provide all relevant information to this committee – but not to the public.

"We will place everything before the expert committee. But it can’t be the subject matter of an affidavit or public debate," the Solicitor General said, adding that the committee could provide a report to the Supreme Court with its findings.

Is This an Admission That the Modi Govt Purchased and Used Pegasus Against Indian Citizens?

It has been highlighted many times already that the government has thus far never denied purchasing and using Pegasus.

In statements such as those given by current IT Minister Ashwani Vaishnaw in the Parliament, the government has reiterated that it has the power to lawfully intercept communications under the Information Technology Act and its Rules, and that no 'unauthorised interception' has taken place.

Some of the petitions in the Supreme Court, including those by alleged victims of Pegasus hacking, have taken this failure to deny its use as grounds to argue that the deployment of the spyware on Indian citizens was "state-sponsored illegal hacking".

Before considering the Centre's reluctance to answer the question as an implicit admission, it would only be fair to look at the rest of what the Solicitor General said in court to justify its stance.

Mehta argued that the IT Act and its rules, in particular the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009, create a statutory procedure for interception of communications.

"It is nobody's case that under the [2009 Rules], a software cannot be used for the purposes of national security and terrorism," he went on to say.

This is significant, because it means the Centre is not ruling out the possibility of acquiring and utilising a tool like Pegasus. One might think this is justified in the interests of national security, but the legality of such a move would be questionable.

While the 2009 Rules do allow for monitoring and interception of electronic communications, they do not allow hacking of a device, which remains illegal under Section 43 of the IT Act, with no exceptions.

As has been pointed out by cybersecurity and privacy experts since 2019, the use of Pegasus goes beyond mere surveillance – which is legal under our current laws – and is instead a tool for hacking, since it allows not just interception, but also turning features on/off and even planting files.

On this basis, the Centre should in fact have a clear policy against the use of software like Pegasus against Indian citizens – the fact that it does not is very much a red flag.

Mehta's next comments also only raised more red flags. He said that the petitioners want the government to divulge which software it used and did not use, which no government would agree to do as persons "who are likely to be intercepted, may take preemptive or corrective steps."

The problem is, of course, that this would only be a problem if the government's answer on affidavit is that it had in fact purchased and used spyware like Pegasus. A denial of the use of Pegasus would not change the behaviour of potential surveillance targets – unless the government wants all citizens to fear being hacked in such a thorough way.

The Solicitor General did indeed try to argue that even a denial would be a risk, but his own explanation devolved into an argument against a confirmation of use, not a denial.

"Suppose, I am a terrorist organisation. I am obviously aware that there would be some interception by the security agencies of every country. I am using several apparatus for the purpose of communication with my sleeper cells and so on. Suppose the central government of any country comes out and says that Pegasus was not used. The moment any government of any country says that we are not using a particular software on affidavit, I will change or modulate my software to such an extent that at least they are not compatible to what the government is using. The moment I say Pegasus is not being used, all the apparatus which the enemies of the nation are using can be reset and modulated so that it is not Pegasus-compatible."

As can be seen in the final sentence, the argument is about 'terrorists' being able to reset and modulate their devices to make sure they cannot be compromised by Pegasus, not the other way around.

Given the extensive nature of Pegasus hacking and its ability to compromise devices through a variety of apps without the need for a click, it is impossible to see how a denial of Pegasus use would affect any attempts to protect against it.

Reiteration of Claim About 'Narrative' Does Not Breed Confidence

On both 16 and 17 August, the Solicitor General argued that the recent revelations about snooping were an attempt by a "web portal" (presumably The Wire, as the Indian organisation part of the Pegasus Project) to "weave a narrative" and "sensationalise".

He sought to elaborate on this point on Tuesday, by saying there could be a narrative by a web portal in the future that military technology was being used for an illegitimate purpose.

"A petition is filed by a person who has nothing to do with this issue and who says that now the military must declare whether this particular apparatus is used or not. If I advise the government to divulge this on affidavit, making it a public issue, I would be failing in my duty," Mehta told the court.

The problem with this line of argument, though, is that there are parties before the Supreme Court who were reportedly on the list of potential targets, and so very much had something to do with the issue.

In the cases of those for whom forensic analysis has confirmed their phones were compromised – including journalists SNM Abdi and Prem Shankar Jha, who have approached the apex court – the argument about a 'narrative' falls apart entirely.

Raising such an argument in response to pleas which include confirmed cases of hacking, is not only disingenuous, but again suggests there is substance to the allegations that the Centre was behind them.

Will the Govt's Answer (If Any) to SC be Made Public?

The CJI and other judges on the bench, Justices Surya Kant and Aniruddha Bose, have repeatedly said that they cannot compel the government to give an answer to the question on affidavit, and said they aren't going to push the government to provide answers which will compromise national security.

However, as Justice Surya Kant pointed out on Tuesday, the potential Pegasus targets as revealed in the media (and in particular those confirmed by forensic analysis) do include civilians and 'persons of eminence', which would mean certain provisions of law would have to be followed for surveilling them.

"Here, the issue is very different. There are citizens, who are civilians, some of them are persons of eminence, who are complaining of hacking or interception of their phones. Even though the Rules permit an interception even for civilians, that can be done only by the permission of the competent authority. There is nothing wrong with that. What is the problem if that competent authority filed an affidavit before us?"

Justice Surya Kant, as reported in Live Law

However, the judge did seem to indicate that the Centre could take a call on to what extent the competent authority would disclose information and that the contents of the affidavit could also be kept confidential by the court.

There is therefore a distinct possibility that whether the court goes down the route of an expert committee as suggested by the Centre, a committee of its own, or even an affidavit from the Centre, the information could still be kept secret from the public, as the Centre wants.

While CJI Ramana has refused to accept information in a sealed cover before, for instance in the Kashmir hearings, it may well be that the government's clarification on Pegasus could end up being provided to the court in a sealed cover.

Of course, if the court were to hold that the use of a spyware like Pegasus is illegal, then the government might not be able to make this argument about national security stick. Several of the petitions filed in the Supreme Court, including by victims, have asked for a declaration from the court that the use of the spyware does amount to illegal hacking.

Since CJI Ramana has not yet made a decision on how to proceed, and has sought a more detailed response from the Modi government before doing so, the option to consider the legality of the use of Pegasus is still open to the Supreme Court.

It remains to be seen now how the government will respond to the bench, and what happens after 10 days.