Pegasus Is A Malware Which Is Per se Illegal, The Fact That Govt. Have Not Denied it Means They Used It: Kapil Sibal Tells Supreme Court

In the Pegasus issue, the petitioners on Monday did not take kindly to the Centre telling the Supreme Court that it has nothing more to say than what has been said in its first and only affidavit (described as "limited" by the court)- that it does not deem it appropriate to state whether any particular software was employed or not, that there has been no illegal interception, and that it is willing to quell the concerns of the petitioners by constituting an expert inquiry committee.

The following are the arguments by the battery of senior advocates for the petitioners before the bench of Chief Justice N. V. Ramana and Justices Surya Kant and Hima Kohli.

The CJ had told the senior advocates to keep in mind that the proceedings are at an interim stage at present- "You have placed some material before us. We have given enough opportunity to the government to make some statement. They are saying- for whatever reason, I don't want to make any comment on that- that they don't want to file an affidavit. We have no option now but to pass whatever order we have to pass. We thought if the government will file some counter-affidavit, how to go further would depend on that. Now we will consider what are the interim orders that we will have to pass"

Senior Advocate Kapil Sibal, for N. Ram, former Editor of The Hindu, and Sashi Kumar, Chairperson of the Asian College of Journalism

Beginning, Mr. Sibal indicated the observations of the Supreme Court in the 2011 case of Ram Jethmalani v. UOI, where the court had noted that the burden of protection of fundamental rights is primarily the duty of the State, and hence, withholding of information from the petitioners, or seeking to cast the relevant events and facts in a light favourable to the State in the context of judicial proceedings, would be destructive to the guarantee in Article 32, and the State has the duty to reveal all the facts and information in its possession to the Court, and also provide the same to the petitioners.

"This is their duty, My Lords. They cannot say that I will not tell anything! What is happening today is that the government and the State are now telling you that we will not tell you the facts. It is its bounden duty! All we want to know is whether they used Pegasus, that is all. That does not reveal any secrets of the State and does not impact national security. But the SG says that making that statement on oath is detrimental to national security itself! I would say not doing so is detrimental to the process of justice! They have to protect our fundamental rights. We can only come to court, nothing more than that. I am sorry to say that today the SG, in making the statement, is denying protection to me which the court must uphold in my favour!", Mr. Sibal advanced.

"This is a malware which is illegal per se. That is the position. The fact that they have not denied it means they have used it. So if they don't file an affidavit, the court must accept! Because these are the allegations which have been made that Pegasus was used, and if Pegasus was used in the targeting of ordinary citizens, it is per se illegal, it has no legal basis and it cannot be used! This is a very serious matter! If it can be used, then it can only be used in accordance with appropriate procedure. This appropriate procedure has appropriately not been followed. It has been admitted by them that this spyware has been used! The CJ rightly noted that in response to a question in the Parliament in November, 2019, the then-IT and Law Minister had said that the government has taken note of the fact that a spyware/malware has affected some WhatsApp users. Why have they not taken any action until 2021? Because of the use of the spyware against citizens of the country! Otherwise, they would have taken action against NSO, Pegasus, all those who were intercepting! Have they tried to find out? It is unbelievable that the government of India says I will not tell the court!"

Mr. Sibal read out the 2019 response of Minister Ravi Shankar Prasad in the Parliament on the question of interception of mobile phone data- "Government has taken note of the fact that a spyware/malware has affected some Whatsapp users. According to WhatsApp, this spyware was developed by an Israel based company NSO Group and that it had developed and used Pegasus spyware to attempt to reach mobile phones of a possible number of 1400 users globally that includes 121 users from India...The Indian Computer Emergency Response Team (CERT-In) published a vulnerability note on May 17, 2019 advising countermeasures to users regarding a vulnerability in WhatsApp. Subsequently, on May 20, 2019 WhatsApp reported an incident to the CERT-In stating that WhatsApp had identified and promptly fixed a vulnerability that could enable an attacker to insert and execute code on mobile devices and that the vulnerability can no longer be exploited to carry out attacks. On September 5, 2019 WhatsApp wrote to CERT-In mentioning an update to the security incident reported in May 2019, that while the full extent of this attack may never be known, WhatsApp continued to review the available information. It also mentioned that WhatsApp believes it is likely that devices of approximately one hundred and twenty one users in India may have been attempted to be reached. Based on media reports on 31st October, 2019, about such targeting of mobile devices of Indian citizens through WhatsApp by spyware Pegasus, CERT-In has issued a formal notice to WhatsApp seeking submission of relevant details and information", the Minister had said then.

"What has happened to that? They don't tell us that! The government cannot tell the court that you shut your eyes and we will do whatever we want! That is exactly what the government's stand means!", argued Mr. Sibal.

The Senior Advocate took the bench through the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 and indicated CERT-In's responsibility to functions as the trusted referral agency for cyber users in India for responding to cyber security incidents and to interact with the stakeholders, the security and law enforcement agencies to prevent such incidents.

"All the petitions mention the fact that their privacy is being affected, their data is being looked at and changed, which is all unauthorised, and which is being done through NSO, through Pegasus. The government now does not want to file an affidavit about it! We saw that in the above incident involving WhatsApp, they were supposed to respond. What is that response? The government agency will have the report! Nothing has been done since 2019. And there is the admission that this spyware was used!", continued Mr. Sibal.

"International agencies have accepted the fact that Indians were affected. And we have given the names of the Indians whose phones were hacked. That has been seconded by experts all over the world. They have no interest in or bias towards India! Yesterday, Germany also accepted the fact that Pegasus was used in Germany for purposes of terrorism, combating terrorism etc. So why can't the government of India say whether Pegasus was used or not. If we make this allegation, they choose not to reply?", pressed Mr. Sibal.

"Why does the government want a government committee? Any such committee should be completely outside the government because it is our allegation that the government is hiding the facts! In the Hawala case, Your Lordships had set up a committee of sitting judges and then had conducted proceedings in-camera so that there was no breach of national security, and at the same time, the facts can come out and in the future, none of this can ever happen!", argued Mr. Sibal.

"The court should not allow the government to set up a committee! This will only be an exercise to obstruct the issue and hide the facts!", he concluded.

Senior Advocate Shyam Diwan, for activist Jagdeep Chhokkar

"The interlocutory reliefs that I am seeking are- one, there ought to be, in the facts and circumstances of this case, a detailed affidavit which is filed by none other than the Cabinet Secretary. I have also filed a supplementary affidavit in this court and we have indicated in that affidavit the cases where this court in the past has directed that the cabinet secretary must or ought to file the affidavit. There are many reasons for this – there could be an invasion of privacy either by some agent of the government or it could be from the outside.. Either way, it is the duty of the State to protect Indian citizens from this malware. The Cabinet Secretary is particularly suited for this because as the topmost bureaucrat in the country he has charge of all the various departments. There may be one department which says I don't use it, then there may be another which says I don't use it. It is the cabinet secretary's responsibility to extend and cover all of this. At the interim stage, we pray that the court issues an appropriate order directing the respondents to file a disclosure affidavit", commenced Mr. Diwan.

"The second point I am making is that while it is correct that in the realm of Parliament, a statement by the minister would be appropriate, in our institution and before the Supreme Court, it is the rule of pleadings which is paramount and we decide cases on the basis of the rule of pleadings. Because of this factor, an affidavit becomes essential. We have mentioned various decisions where the court has directed the cabinet secretary and other high-ranking government officials to depose in matters of national interest – the 2002 Tamil Nadu asylum fire case where there was death of 25 chained inmates, Paramvir Singh Saini matter of 2021 on the installation of CCTV cameras in police station, the 2014 case of Exploitation of children in orphanage", he continued.

"The third point I wish to make is on the strength of two additional expert affidavits which I have filed", proceeded Mr. Diwan, indicating the affidavit by one Sandeep Shukla, who he described as the topmost cyber expert in the country, being a serving professor of computer science in IIT, Kanpur in the engineering department. "He has conducted laboratory experiments on Pegasus. He sets out how under his supervision and control, as part of the global effort, an independent analysis of six Pegasus malware samples was carried out. He concludes that each of these variants of Pegasus malware was able to spy on each and every information possessed by the victim on her personal mobile devices, including intimate pictures, personally identifiable data, documents, messages, videos, voice recording. He says that whoever has infected victims' devices without authorisation has effectively hacked the same, exfiltrated personal data and inserted malware. He says that it is important to note that a zero-click vulnerability does not require the victim to take any action to get infected by the malware, that it happens without the knowledge or action of the victim", quoted Mr. Diwan.

"We have read the reports. It can happen silently and without the consent and intelligence of the party. These are all facts about the technical issues...", remarked the CJ.

Mr. Diwan cited the affidavit by another expert, one Anand V., who was described as a qualified security and privacy researcher with a bachelors in computer science engineering from the University of Madras. "Anand V. says this is well beyond surveillance. These capabilities clearly establish that Pegasus is not just a surveillance software but is also an implantation mechanism where the deployer not just has access to the target's data but can also implant false and fake data into the target's device", quoted Mr. Diwan.

"This is well beyond anything in the IT Act or Telegraph Act or rules etc. What we are dealing with is something which is deployed against Indian citizens. The government of India has to be vitally concerned even if it is an external agency. If it is an external agency, the government of India has a duty to protect citizens. If it is a governmental agency, even then it cannot be done under the existing regime. My client is a retired IIM professor who says it is a complete assault on democracy!", argued Mr. Diwan.

Senior Advocate Dinesh Dwivedi, for an aggrieved journalist

Mr. Dwivedi advanced that the paragraphs in the counter-affidavit of the government are totally contradictory, and they have a denial which is totally non-specific. He indicated the Rules in Order 8 of the CPC to submit that it would not be sufficient for a defendant to generally deny the grounds alleged by the plaintiff and that he must deal specifically with each allegation of fact to which he does not admit; and that every allegation of fact in the plaint, if not denied specifically, shall be taken to be admitted.

"The Counter-affidavit says it is not possible to deal with all the facts raised in the batch of petitions before this court. On the one hand, it says that it is not possible to deal with them all, while in paragraph 3, they say 'I hereby unequivocally deny any and all of the allegations'". he argued.

"I am a journalist who has been actually snooped upon and the snooping has been corroborated twice by testing. I have annexed the reports also where it is indicated that my phone has been snooped upon and it is infected. This is one fact which has not been denied specifically", he advanced.

Mr. Dwivedi submitted that the transparency report submitted by the NSO itself corroborates this- "This is NSO's own admission- they say, 'We are most well-known for Pegasus, a technology used by states and state agencies around the world to collect data from mobile devices of specific suspected individuals. To be clear, we do not operate this technology nor do we have any knowledge of the individuals. We licence it only to the law enforcement and intelligence agencies of sovereign states'"

"So in the face of this, the denial of the minister in the Parliament has no bearing. Because NSO says they themselves don't know who the software is being used to snoop on. They say you may be snooping on everyone, everywhere and that it is beyond them, that they don't do it and that it is only the state agencies which get the license!", pressed Mr. Dwivedi.

"Journalists are peculiarly placed because if there is surveillance or snooping, their privacy is affected and their freedom of speech and expression gets affected. In the 2018 Puttaswamy case, Your Lordships accepted this fact of the psychological effect of breach of privacy! In CJ Ramana's judgment in the matter of restriction of internet service in J & K, the chilling effect of the blocking of internet was recognised but the Court said that it is not an appropriate case to deal with the issue because there was no evidence to indicate the fact of the effect. Here is a case where there is internet snooping! The evidence is available that my phone has been tapped! The Chilling effect arises loud and clear in this case", he stressed.

"If the allegations are true, then definitely there is an effect (chilling effect on Mr. Dwivedi's client as a journalist)", conceded the CJ. SG Tushar Mehta also said, "The effect is not disputed"

Mr. Dwivedi prayed for a 'cease and desist' order in favour of his client. "Why should they be allowed to continue with it when the issues under the scrutiny of this court?", he advanced.

Senior Advocate Rakesh Dwivedi for S. N. M. Abdi, a journalist whose name was in the potential list of Pegasus targets

"If the government does not file any further affidavit, the assumption would follow that what we have stated in our affidavits, based on prima facie analysis finding that our phones carry traces of Pegasus, is correct and there should be a presumption at least that we have been spied on. The government is refusing to file an affidavit saying even this much that we have not been spied on. I would have understood if the government had filed even a one-paragraph affidavit saying that we have not spied on the petitioners. That would have been the end of the matter- that we have not used any spyware to spy the petitioners. They don't even want to make a statement of one paragraph!", advanced Mr. Dwivedi.

"My prayer is that Your Lordships may constitute a committee, but it may not be set-up by the government because the question is of credibility. We are faced by a situation where the minister makes a statement rubbishing everything in Parliament. Now in the courtroom, we have the government's stand that we will constitute a committee of our own. So that will be another exercise of rubbishing everything. The issue is what is that credible methodology by which the truth can be ascertained. Allowing the government to constitute a committee and asking us to surrender our phones to them is entirely again a secretive, biased exercise which will not create credibility. I am not indicting the government but the question is that the inquiry must be credible and the citizens of the country must have faith in it", he continued.

"There are only two courses – first, the government should be asked specifically to state or deny whether they have spied, Pegasus or not; just deny or admit whether any malware or spyware was used to subject us to spying. Either that or Your Lordships should constitute a committee which should be under the court's control and which would submit a report to you", he concluded.

Senior Advocate Meenakshi Arora, for MP John Brittas

Ms. Arora advanced that she stands by all the submissions made by the earlier lawyers.

"I pray that, particularly in the present facts where the government has totally refused to file an affidavit, there must be a constitution of an SIT which may be headed by a retired judge of the Supreme Court so that the court can supervise and there would be some credibility to whatever investigation is carried out", Ms. Arora added.

Senior Advocate Colin Gonsalves for SFLC.in and alleged Pegasus target Degree Prasad Chouhan

Mr. Gonsalves advanced that the petitioner-journalist hails from Chhattisgarh and that though his phone was subjected to Pegasus, he was not able to give it for checking being a poor person and that he still has it.

"The Union of India, many state governments and many private parties have been engaging in surveillance for a long, long time. There is a Citizen Lab report that the Indian government has been dealing with some malwares akin to Pegasus", he began.

The SG interjected to say that they seriously doubt these reports. "They have the habit of always coming up with self-serving reports. I didn't say this for others", said the SG.

Mr. Gonsalves continued to submit that 5000 interception orders are issued in the name of the Home Secretary every month, proceeding to indicate an NDTV report of 2015 in this context and a statement of the Home Secretary that there is widespread use of malware.

Cutting him across, the CJ observed, "We are not on these issues. The other counsel also relied on the newspaper cuttings and reports and on the initial day itself, I had expressed reservation. We are going to only consider what interim order to pass"

"I am only trying to show that there is abundant evidence on record that the central government and state governments are indulging in widespread use of malware and that there is widespread surveillance. Most of this is unauthorised as the replies in the Parliament suggest. If this is the case, we cannot rely on the principle wrongdoer, that is, the central government. We must depend on retired or even sitting judges of the Supreme Court for this purpose", replied Mr. Gonsalves.

When he sought to indicate what other countries have done in similar circumstances, the CJ remarked, "Forget about what the other countries have done. See, there is material placed before us, all of the advocates argued, the government of India has taken a stand. We will examine it. We are not closing this space. We will see that these issues are dealt with"

Read Full Live Updates here