Legal experts delve into the unfolding Pegasus controversy and suggest future steps towards surveillance reform such as parliamentary oversight, judicial oversight, and more.

What do we do now? This has been the question on the minds of most citizens since Reports alleged that the Israeli company NSO Group’s spyware Pegasus targeted several Indian politicians, journalists and activists. First, It is unclear if there is any countermeasure against this military spyware that performs a zero-click attack – in essence, that means you don’t have to click on a malicious link to activate this malware; it can infect your phone due to an existing vulnerability in the system.

Secondly, Since the NSO Group has stated that it only sells its products to audited governments and agencies, there is greater concern about government sponsored surveillance. That brings us to the question: Is our current surveillance containment mechanism effective? Do we have enough controls and measures in place to, for example, question abuse of surveillance missions by a government or agency?

The experts MediaNama spoke to gave different answers in this regard. While one suggested a judicial oversight mechanism with sanctions for possible abuse, another claimed that the country’s existing laws and statutes are sufficient to tackle such cases. Another expert referred to the Report of the Shah Commission which was constituted after the emergency in India in 1975 to record institutional excesses.

Interestingly, many pointed to Congressman Manish Tewari’s bill to regulate intelligence, which was tabled in 2011. MediaNama summarized the various provisions of the bill.

What parliamentary structure should there be to combat surveillance?

Rahul Narayan, a Supreme Court attorney, was in favor of establishing an oversight mechanism in the parliamentary framework. He said the role of parliament would be to pass a law with robust guarantees and strict rules to be imposed on the executive branch before any surveillance is carried out.

“This should include guidelines on how long to monitor, delete data, and so on. The actual mechanism must involve at least one person outside the executive, usually a judge, who should have the responsibility to actually issue an arrest warrant based on evidence presented by him. ” The scope of emergency surveillance orders needs to be severely limited if a judge decides whether or not to continue, ”Narayan said.

Alok Prasanna Kumar, Senior Resident Fellow at the Vidhi Center for Legal Policy, said the first step should be to ensure that there is a legal basis for these agencies to exist that clearly dictates what they can and cannot do. “Without that, any parliamentary control is pointless,” he said.

It is a little difficult to determine with absolute accuracy what intelligence agencies can and cannot do, but what I think is more important is that they have to justify their actions and ask tough questions before a parliamentary committee or agency independent of the executive. On the whole, of course, it must not be allowed to collect data from anyone without proper authorization and reasons, not to violate the privacy of the individual without immediate justification, etc. – Alok Prasanna Kumar, Senior Resident Fellow at the Vidhi Center for Legal Policy

Is judicial supervision necessary?

Narayan said that while surveillance procedures are necessarily secret, there must be a way to control executive powers. “In this case, a careful law, interpreted by the judiciary, should allow surveillance when necessary, while ensuring that the process is not misused to gather information on opposition leaders, etc. “ He added that the judge should be responsible for issuing an arrest warrant based on concrete evidence in the areas of suspected organized crime, drug-related crime, national security issues, etc.

Meanwhile, Kumar disagreed. “Judicial oversight is almost never realistic oversight. The experience with this in India and elsewhere is that “judicial oversight” is usually used to give a cover of legality to the actions of the secret services. In the absence of transparency and guaranteed independence of the judges concerned, such judicial oversight inevitably becomes an exercise that ticks off,” he said.

Kumar stressed that the powers of intelligence agencies must be substantially restricted, and both Narayan and Kumar agreed that certain information obtained through surveillance should be released and made public after a certain period of time. While Narayan suggested a 10-year hiatus, Kumar did not provide a timetable. The latter also said that “blanket RTI exceptions should be removed and limited to operations only”.

“Sufficient protective measures already in place”

Supreme Court attorney Gopal Sankaranarayanan disagreed with the first two experts. He disagreed that there was a lack of regulation to deal with such situations. “According to the IT law and the Telegraph Act and Rules, there are sufficient safety precautions to cope with a Pegasus-like situation.”

However, he raised the following concerns about the Pegasus spyware attack:

  • A foreign private company hacked into the phones of Indian citizens.
  • The likely conspiracy of individuals in the Indian government to carry out such hacking attacks
  • The lack of any constitutional protection for the civil servants who have hired the NSO to carry this out.

Commissions had recommended that secret services be placed under a governance framework

Without going into details of what a possible framework for the government of intelligence agencies could look like, Nitin Pai, co-founder of the Takshashila Institution, pointed out that the Shah Commission’s report on the excesses during the emergency recommended the establishment of intelligence agencies and the CBI under a governance framework. “The LP Singh Committee, appointed to follow up the Shah Commission’s report, recommended that the IB be covered by statute and given a written charter,” he said.

What does the Shah Commission’s report say? According to India today, the Commission’s second report proposed that steps should be taken to improve the work of the secret services. The India Today article reads from the Shah Commission’s report: “Your activities and performance should be adequately monitored and assessed by responsible forums composed of individuals who, by virtue of their integrity and public sense of duty, work independently of the secret services . “

What does the LP Singh Committee report say? According to a report by outlook, the LP Singh Committee had advised that the Secret Service Bureau established by the British before 1947 and the Central Bureau of Investigation established after 1947 functioned without a formal constitution of their functions and responsibilities. The committee emphasized the need for formal charters to prevent future abuse, but also recommended Government Detailed Model Charter for Adoption.

“Needless to say, protecting the fundamental rights of citizens is crucial for this. The aim of the governance mechanism is to strike a conscious balance between national security and individual rights, ”he added.

Read more on Pegasus

Update, July 21, 1:50 p.m.: The Takshashila Institution was incorrectly referred to as the Takshashila Foundation. We regret the mistake.