Abstract
The new-age development of technology has evolved into diverse forms of surveillance. One such surveillance tool is Pegasus, a spyware, which has gravely challenged the privacy rights of individuals in India and overseas. This research goes through the dynamics of this tool, and how this surveillance technology has emerged as a powerful symbol of growing tension. The NSO Group has developed this tool which is fundamentally meant to combat serious crimes but has altered the landscape of digital privacy in India. Though this tool is meant to fight against serious crimes, investigations have revealed a more complex reality; this spyware has been deployed against prominent figures such as journalists, political figures, and civil society members which has raised serious questions due to its intrusion in national security and individual rights.
The Pegasus spyware follows a mechanism of “zero-click” method that surpasses the need for user interaction as a whole due to which the data of the people and their privacy are put at stake and exposed to digital vulnerability. This paper examines how this advanced technological surveillance tool contravenes the Constitutional framework of India, especially Article 21 of the Constitution which guarantees its citizens the right to privacy. The paper also includes recent controversies revolving around this spyware, including the revelations in October 2023 of the Investigation Bureau’s procurement of Pegasus-compatible hardware. This paper also mentions how this tool challenges the present legal framework and oversight mechanisms.
The research includes the current legal frameworks, including the Telegraph Act and the Information Technology Act. Despite these frameworks, the acts struggle to address this tool and highlight the gap between technological capability and legal protection. This research emphasizes the urgent need for regulations that are robust and can effectively balance genuine security concerns while upholding the privacy rights of the citizens. The paper concludes by suggesting comprehensive reforms to strengthen privacy protections while maintaining necessary security measures.
Keywords – Pegasus Spyware, privacy rights, surveillance, Article 21, zero-click method.
Introduction
“Pegasus is a highly advanced tool of surveillance developed by Israeli cyber intelligence from NSO group established in 2010.” This advanced spyware has become a powerful tool for mobile monitoring and data extraction[1]. While the NSO group claims that Pegasus is only sold to government agencies for legitimate use, such as countering terrorism, human trafficking, drug cartels, and financial crimes, its use has been under severe global scrutiny. Evidence of its use to spy on a wide range of prominent individuals, including government officials, opposition leaders, journalists, human rights defenders, and civil society members, has created much controversy[2].
One of its defining and rather unsettling characteristics is the highly advanced mechanism of “zero-click” method[3]. Unlike most types of malware, Pegasus does not require user action through any form of social engineering technique to gain control over the device. Instead, it uses the vulnerability of communication platforms such as WhatsApp, gaining entry through message delivery or failed call attempts. After its entry, the installed spyware provides access to all the data that is on the target device, including encrypted communication, which is intercepted prior to the encryption process.
[1]“Pegasus spyware.” Encyclopaedia Britannica, Encyclopaedia Britannica, Inc. https://www.britannica.com/topic/Pegasus-spyware.
[2]“Pegasus: How it hacks phones and spies for NSO Group clients.” BBC News, 21 July 2021. https://www.bbc.com/news/technology-57910355.
[3]“What is Pegasus spyware and how it works?” GeeksforGeeks. https://www.geeksforgeeks.org/what-is-pegasus-spyware-and-how-it-works/.