What is the pegasus controversy in India
The pegasus controversy in India :========================
Pegasus is one of the most sophisticated and controversial spyware systems ever developed, symbolizing the growing power of digital surveillance in the modern world and raising profound ethical, legal, political, and human rights concerns. Developed by the Israeli cyber-intelligence firm NSO Group, Pegasus is designed primarily for government use, ostensibly to combat terrorism, serious crime, and national security threats. However, since its existence became publicly known, it has been repeatedly linked to the surveillance of journalists, activists, opposition politicians, lawyers, diplomats, and even heads of state, transforming it into a symbol of the darker side of digital technology. Pegasus operates by infiltrating smartphones—both Android and iOS—without the knowledge or consent of the user, gaining near-total control over the device. Once installed, it can access messages, emails, call logs, photos, videos, contacts, calendar entries, GPS location data, browsing history, and even activate the phone’s microphone and camera to record conversations and surroundings in real time. Unlike earlier spyware, Pegasus often requires no user interaction at all, exploiting “zero-click” vulnerabilities that allow infection through missed calls, invisible messages, or background processes, making it almost impossible for users to detect or prevent.
The origins of Pegasus lie in the broader evolution of cyber surveillance tools that emerged alongside the rapid growth of smartphones and digital communication. NSO Group was founded in 2010 by former members of Israeli intelligence units, particularly Unit 8200, which is known for its expertise in signals intelligence and cyber operations. The company marketed Pegasus as a lawful interception tool intended exclusively for use by authorized government agencies, such as law enforcement and intelligence services, to track terrorists, dismantle criminal networks, and prevent serious crimes. NSO has consistently claimed that it does not operate Pegasus itself but licenses it to governments under strict contractual conditions, including requirements that it be used only for legitimate purposes and not against journalists, human rights defenders, or political opponents. However, the repeated exposure of Pegasus misuse across dozens of countries has seriously undermined these claims and raised questions about the effectiveness of oversight, accountability, and regulation in the cyber arms trade.
Technically, Pegasus represents a leap forward in spyware capabilities. Traditional malware often required users to click on malicious links, download infected files, or install compromised applications. Pegasus, by contrast, has increasingly relied on zero-day and zero-click exploits—previously unknown vulnerabilities in widely used software and operating systems that allow attackers to gain access without any user action. For example, Pegasus has exploited vulnerabilities in Apple’s iMessage, WhatsApp’s calling feature, and other core services. A notable case occurred in 2019, when WhatsApp revealed that Pegasus had used a vulnerability in its voice calling function, allowing attackers to infect devices simply by placing a call, even if the call was never answered. Similarly, in 2021, researchers uncovered a zero-click exploit in iMessage, dubbed “FORCEDENTRY,” which allowed Pegasus to infiltrate iPhones silently by sending a specially crafted message that never appeared on the user’s screen. These exploits demonstrate not only the technical sophistication of Pegasus but also the scale of resources and expertise behind its development, rivaling or even surpassing those of many state-sponsored cyber programs.
Once Pegasus infects a device, it establishes persistent and stealthy access. It can exfiltrate data to remote servers controlled by the operator, often using encrypted communication channels to evade detection. Pegasus can bypass many security measures, including sandboxing, app isolation, and encryption, by operating at a deep level within the operating system. It can capture encrypted communications by accessing data before it is encrypted or after it is decrypted on the device. This means that even end-to-end encrypted messaging apps such as WhatsApp, Signal, Telegram, and iMessage are vulnerable, not because the encryption is broken, but because Pegasus accesses the data at the endpoint, where it exists in readable form. In effect, Pegasus transforms the smartphone into a surveillance device that the user carries voluntarily, unknowingly broadcasting their private life to external observers.
The public’s understanding of Pegasus expanded dramatically through investigative journalism and forensic research, most notably by organizations such as Citizen Lab, Amnesty International’s Security Lab, Forbidden Stories, and a consortium of international media outlets. These investigations revealed not only the technical details of Pegasus but also the scale and scope of its deployment worldwide. The most significant revelation came in 2021 with the “Pegasus Project,” a collaborative investigation based on a leaked database of more than 50,000 phone numbers believed to be potential surveillance targets of Pegasus clients. While not all numbers were necessarily infected, forensic analysis confirmed that many devices belonging to journalists, human rights defenders, opposition politicians, lawyers, activists, business leaders, and even heads of state had been successfully compromised. Among those reportedly targeted were journalists investigating corruption and human rights abuses, opposition figures challenging authoritarian regimes, and activists advocating for democracy, minority rights, and social justice.
The Pegasus Project transformed the public discourse around spyware by shifting the focus from theoretical concerns to concrete, documented cases of abuse. It exposed the gap between the stated purpose of Pegasus—fighting terrorism and serious crime—and its actual use in many contexts. In several countries, Pegasus was allegedly used to monitor political opponents, suppress dissent, intimidate critics, and consolidate power. For example, in Mexico, Pegasus was reportedly used not only against drug traffickers but also against journalists investigating corruption, anti-corruption activists, and even public health advocates campaigning for a sugar tax. In Saudi Arabia, associates of journalist Jamal Khashoggi, who was murdered in 2018, were reportedly targeted with Pegasus, raising questions about whether surveillance contributed to his killing. In India, allegations emerged that Pegasus had been used to spy on opposition politicians, journalists, activists, election strategists, and even members of the judiciary, triggering political controversy, parliamentary debate, and judicial inquiries. Similar patterns were reported in Hungary, Poland, Morocco, the United Arab Emirates, Azerbaijan, Rwanda, and several other countries.
The ethical implications of Pegasus are profound. At its core, Pegasus embodies the tension between security and privacy, between the state’s duty to protect its citizens and the individual’s right to personal freedom, dignity, and autonomy. Surveillance has always been a tool of governance, but digital technologies have magnified its scope, scale, and intrusiveness. Pegasus does not merely intercept communications; it penetrates the intimate sphere of an individual’s life, capturing personal thoughts, relationships, movements, and behaviors. This level of intrusion raises serious questions about proportionality, necessity, and consent. Even in democratic societies, the use of such powerful surveillance tools risks undermining the rule of law if not subject to strict legal frameworks, independent oversight, and effective accountability mechanisms. In authoritarian contexts, the risks are even greater, as Pegasus can be used to silence dissent, intimidate critics, and entrench power, eroding the foundations of democracy and human rights.
The legal landscape surrounding Pegasus is complex and evolving. NSO Group has argued that it operates within the law, that it sells Pegasus only to government clients, and that it complies with Israeli export controls and regulations. However, critics argue that existing laws are insufficient to regulate the export and use of cyber surveillance tools, particularly when they cross borders and operate in secrecy. Unlike traditional weapons, spyware is intangible, easily transferable, and difficult to monitor. It can be deployed remotely, without physical presence, and can target individuals in other countries without their governments’ knowledge or consent. This raises questions about sovereignty, international law, and jurisdiction. For example, if a government uses Pegasus to spy on individuals located in another country, does this constitute a violation of international law? What legal remedies are available to victims? Who is accountable: the operator, the vendor, or the exporting state?
In response to mounting evidence of abuse, several governments and institutions have taken action against NSO Group and the broader spyware industry. In 2021, the United States Department of Commerce placed NSO Group on its Entity List, effectively blacklisting it and restricting its access to U.S. technology, citing concerns that its tools had been used for transnational repression and human rights abuses. Apple filed a lawsuit against NSO Group, accusing it of targeting Apple users and violating its terms of service, and announced measures to enhance the security of its devices against spyware. WhatsApp had earlier sued NSO Group in 2019 over the exploitation of its platform. The European Parliament launched investigations into the use of Pegasus within EU member states, leading to reports and recommendations calling for stricter regulation, oversight, and accountability. Some countries have initiated judicial inquiries, parliamentary committees, and independent investigations to examine allegations of Pegasus misuse and to strengthen safeguards against unlawful surveillance.
Despite these actions, regulating spyware like Pegasus remains a formidable challenge. The cyber surveillance market operates in a grey zone between legitimate law enforcement tools and instruments of repression. Governments have a genuine need for advanced investigative technologies to combat terrorism, organized crime, cybercrime, and other serious threats. However, without clear and enforceable international standards, transparency requirements, and accountability mechanisms, these tools can easily be abused. One of the central difficulties lies in balancing secrecy and transparency. Intelligence and law enforcement agencies often operate in secrecy for legitimate reasons, but excessive secrecy can shield wrongdoing and prevent public scrutiny. Establishing oversight bodies with sufficient authority, expertise, and independence is essential but politically sensitive. Moreover, international cooperation is necessary, as spyware does not respect national borders, and abuses in one country can have global implications.
From a technological perspective, Pegasus has also exposed vulnerabilities in the global digital infrastructure and the limitations of current cybersecurity measures. The fact that Pegasus can exploit unknown vulnerabilities in widely used operating systems and applications highlights the ongoing arms race between attackers and defenders in cyberspace. Software vendors invest heavily in security, patching vulnerabilities, and hardening their systems, but well-funded actors like NSO Group can still discover or purchase zero-day exploits that bypass these defenses. This raises questions about the ethics of the zero-day market, where vulnerabilities are traded for high prices rather than disclosed responsibly to vendors. Some argue that the existence of such a market undermines global cybersecurity by incentivizing the hoarding of vulnerabilities rather than their repair, leaving billions of users at risk. Others argue that intelligence agencies require access to zero-day exploits for national security purposes and that responsible use can be justified under strict legal frameworks.
The psychological and social impact of Pegasus surveillance on individuals and communities is also significant. Victims of spyware often experience a profound sense of violation, anxiety, and fear, knowing that their private lives have been exposed and that they may be under constant watch. For journalists, activists, and opposition figures, this can lead to self-censorship, withdrawal from public engagement, and reduced willingness to communicate freely with sources, colleagues, and supporters. This phenomenon, often referred to as the “chilling effect,” undermines freedom of expression, freedom of association, and the free flow of information—cornerstones of democratic societies. When people believe they are being watched, they may alter their behavior, avoid sensitive topics, or refrain from challenging authority, even in the absence of direct repression. In this way, surveillance exerts power not only through direct action but also through the shaping of perceptions, expectations, and social norms.
Pegasus also raises fundamental questions about consent and autonomy in the digital age. Modern life is deeply intertwined with smartphones and digital platforms, which serve as extensions of our minds, memories, and relationships. We use them to communicate, work, learn, socialize, navigate, and express ourselves. When a device is compromised by spyware, it is not merely a technical breach but an intrusion into the core of a person’s identity and agency. The individual loses control over their own information, experiences, and interactions. This challenges traditional notions of privacy, which were often conceived in terms of physical spaces or discrete pieces of information, and requires a reconceptualization of privacy as a holistic, dynamic, and relational concept in the digital era.
The Pegasus controversy has also influenced public discourse on digital rights, surveillance reform, and the future of cybersecurity. It has prompted calls for a global moratorium on the sale and use of commercial spyware until robust regulatory frameworks are established. Some advocates argue for an outright ban on the development and sale of such tools, likening them to weapons that pose unacceptable risks to human rights and democracy. Others advocate for stricter licensing, transparency requirements, export controls, and oversight mechanisms, rather than a total ban, recognizing that governments may have legitimate uses for surveillance technologies. These debates reflect broader tensions in global governance, where technological innovation often outpaces legal and ethical frameworks, leaving societies struggling to catch up.
In India, the Pegasus issue has had significant political and legal ramifications. Allegations that Pegasus was used to spy on opposition leaders, journalists, activists, and even a sitting judge of the Supreme Court sparked widespread controversy, protests, and demands for accountability. The Indian government neither confirmed nor denied the use of Pegasus, citing national security considerations, which further fueled debate and suspicion. The Supreme Court of India constituted an independent technical committee to investigate the allegations, marking a rare instance of judicial intervention in matters of national security surveillance. The committee’s report, while not publicly released in full, reportedly found evidence of malware on some devices but did not conclusively attribute it to Pegasus, citing limitations in access to information and cooperation. The case underscored the difficulties of investigating covert surveillance and the need for stronger legal safeguards, transparency, and oversight in democratic societies.
Globally, the Pegasus scandal has also reshaped the relationship between technology companies, governments, and users. Companies like Apple, Google, Meta (Facebook/WhatsApp), and others have invested heavily in strengthening device security, introducing features such as enhanced sandboxing, memory protection, and lockdown modes designed to protect high-risk users from sophisticated attacks. Apple’s “Lockdown Mode,” for example, limits certain functionalities to reduce the attack surface for spyware, though at the cost of usability. These measures reflect a growing recognition that device security is not only a technical issue but also a human rights issue, particularly for journalists, activists, and vulnerable populations. At the same time, technology companies face pressures from governments seeking lawful access to data for security and law enforcement purposes, creating a complex and often adversarial dynamic.
The Pegasus saga also highlights the global inequalities in digital security and surveillance. Wealthy states and corporations possess advanced technologies and resources to develop, acquire, and deploy spyware, while individuals and civil society organizations often lack the means to defend themselves effectively. This asymmetry of power exacerbates existing social, political, and economic inequalities, allowing those in power to monitor, influence, and control those with less power. It also raises questions about digital colonialism, where surveillance technologies developed in one part of the world are deployed in other regions, often in contexts of weak governance, fragile institutions, and limited accountability, with profound consequences for local populations.
At a philosophical level, Pegasus forces societies to confront fundamental questions about trust, power, and the nature of the state. Surveillance has always been linked to power, but digital surveillance amplifies this relationship, enabling unprecedented levels of observation, prediction, and control. The ability to monitor individuals continuously, invisibly, and remotely transforms the balance of power between the state and the citizen, potentially shifting it in ways that undermine democratic accountability and individual freedom. At the same time, societies face genuine threats from terrorism, organized crime, cyberattacks, and other forms of harm, which require effective security measures. The challenge lies in reconciling these competing imperatives without sacrificing core values and principles.
In conclusion, Pegasus is not merely a piece of software but a symbol of the broader transformation of surveillance in the digital age. It represents the cutting edge of spyware technology, capable of infiltrating smartphones invisibly and extracting vast amounts of personal data. Its development and deployment reflect the convergence of technological innovation, national security concerns, commercial interests, and political power. At the same time, the repeated exposure of Pegasus misuse has revealed deep flaws in existing regulatory frameworks, oversight mechanisms, and ethical standards governing digital surveillance. The Pegasus controversy has sparked global debates about privacy, human rights, democracy, cybersecurity, and the future of governance in a connected world. Whether societies respond by strengthening protections, enhancing accountability, and reaffirming fundamental rights, or by normalizing pervasive surveillance in the name of security, will shape the trajectory of digital freedom and human dignity for generations to come.
The pegasus controversy in India :========================
To understand the Pegasus controversy in India, it is important first to grasp what Pegasus is and why it is so powerful. Pegasus is a sophisticated military-grade spyware designed to infiltrate smartphones running on Android and iOS operating systems. Once installed, it grants near-total access to the device, including messages, emails, call records, photos, location data, microphone, and camera, even on encrypted apps like WhatsApp and Signal. What makes Pegasus especially dangerous is its ability to exploit “zero-click” vulnerabilities, meaning it can infect a phone without any action from the user—no clicking links, no downloading files, and no suspicious behavior. This makes detection extremely difficult and gives the operator silent and persistent surveillance capabilities.
The Indian chapter of the Pegasus story began in October 2019, when WhatsApp revealed that approximately 1,400 users globally had been targeted using Pegasus via a vulnerability in its calling feature. WhatsApp subsequently informed the Indian government that at least 121 Indian users were affected. Among them were journalists, human rights defenders, lawyers, and activists. This revelation triggered initial concern and parliamentary questions in India, with opposition parties demanding explanations and accountability. The government, however, responded by stating that there was no unauthorized interception by government agencies and that India has a robust legal framework governing lawful surveillance.
The issue resurfaced with much greater intensity in July 2021, following the release of the “Pegasus Project,” a global investigative collaboration led by Forbidden Stories and Amnesty International, along with 17 international media organizations, including The Washington Post, The Guardian, Le Monde, and The Wire in India. The investigation was based on a leaked database of more than 50,000 phone numbers believed to be potential targets of Pegasus clients. While the presence of a number on the list did not necessarily mean that the phone was successfully infected, forensic analysis by Amnesty International confirmed infections or attempted infections in many cases.
In India, the Pegasus Project identified more than 300 phone numbers as potential targets, including those belonging to prominent journalists, opposition politicians, election strategists, lawyers, activists, and civil society figures. Among the most notable names were journalists such as Siddharth Varadarajan, N. Ram, Shishir Gupta, and several others associated with leading media outlets; opposition leaders including Rahul Gandhi’s close associates, Prashant Kishor (election strategist), Ashok Lavasa (then Election Commissioner), Abhishek Banerjee (Trinamool Congress leader), and even members of the cabinet of the Union government and ruling party. Reports also suggested that the phone numbers of individuals associated with the Supreme Court, including a staff member and a woman who later accused the then Chief Justice of India of sexual harassment, were on the list.
These revelations triggered an immediate political storm. Opposition parties accused the government of running a “surveillance state” and of using Pegasus to spy on political opponents, journalists, and civil society, thereby undermining democracy and constitutional freedoms. Parliamentary proceedings during the Monsoon Session of 2021 were repeatedly disrupted, with opposition members demanding a statement from the Prime Minister and Home Minister and calling for a thorough and independent investigation. The government, however, maintained its stance of not confirming or denying the use of Pegasus, citing national security concerns. Ministers repeatedly stated that all surveillance in India is conducted lawfully under established procedures and that there was no unauthorized interception.
This refusal to provide clear answers intensified public suspicion and criticism. In a democracy, surveillance by the state is expected to be subject to legal safeguards, transparency, and accountability, even if operational details remain confidential. The government’s categorical silence—combined with the scale and nature of the allegations—created a perception of opacity and evasion. Critics argued that if the government had not used Pegasus, it could simply deny the allegations unequivocally; if it had, it was obligated to justify its actions within the framework of law.
The Pegasus controversy also raised serious constitutional questions. India’s Constitution guarantees the right to life and personal liberty under Article 21, which the Supreme Court has interpreted to include the right to privacy. In 2017, in the landmark Justice K.S. Puttaswamy v. Union of India case, a nine-judge bench of the Supreme Court unanimously affirmed that privacy is a fundamental right intrinsic to life and liberty. The Court held that any invasion of privacy must satisfy three conditions: legality (existence of law), necessity (legitimate state aim), and proportionality (reasonable means). The alleged use of Pegasus—capable of near-total surveillance—appeared to many legal experts to fail the proportionality test, especially if used against journalists, opposition politicians, activists, or private citizens without demonstrable links to terrorism or serious crime.
India’s legal framework for surveillance primarily rests on the Indian Telegraph Act, 1885, the Information Technology Act, 2000, and associated rules such as the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. These laws allow government agencies to intercept communications under certain conditions, such as national security, public order, or prevention of crime, subject to authorization by senior officials and periodic review. However, these laws were drafted in a pre-smartphone or early digital era and do not explicitly address advanced spyware that can take over an entire device, access encrypted data, or activate microphones and cameras. This legal gap has become a central issue in the Pegasus debate, highlighting the inadequacy of existing surveillance laws to regulate modern cyber surveillance tools.
In response to the controversy, several journalists, activists, and public figures approached the Supreme Court, filing petitions seeking an independent investigation into the alleged use of Pegasus. They argued that the allegations raised serious concerns about violations of fundamental rights, press freedom, and democratic processes, and that only an independent and transparent inquiry could restore public trust. The government opposed these petitions, reiterating that surveillance is conducted lawfully and that matters of national security cannot be subject to public scrutiny or judicial interference.
In October 2021, the Supreme Court delivered a landmark order in this matter. A bench headed by Chief Justice N.V. Ramana rejected the government’s argument that national security could be used as a blanket shield against judicial review. The Court emphasized that while national security is a legitimate concern, it cannot be invoked to avoid accountability altogether, especially when allegations involve serious violations of fundamental rights. The Court observed that “the mere invocation of national security does not render the Court a mute spectator” and that constitutional rights must be protected even in sensitive contexts.
The Supreme Court then constituted an independent technical committee to investigate whether Pegasus was used on Indian citizens’ devices and, if so, whether such use was authorized and lawful. The committee was chaired by Justice R.V. Raveendran, a former judge of the Supreme Court, and included experts in cybersecurity, digital forensics, and law. The Court also appointed former IPS officer Alok Joshi to oversee the committee’s functioning. The terms of reference included examining whether Pegasus spyware was used in India, identifying affected individuals, assessing the legality of any such use, and recommending measures to strengthen surveillance safeguards.
The establishment of this committee was widely seen as a significant assertion of judicial independence and constitutional oversight. It underscored the judiciary’s role as a guardian of fundamental rights, even in matters involving national security and intelligence operations. However, the investigation faced several challenges. The government reportedly did not cooperate fully with the committee, citing security concerns and confidentiality obligations. The committee relied on voluntary submissions from individuals who suspected their phones had been compromised and on forensic analysis of available devices. As a result, its findings were necessarily limited in scope and certainty.
In August 2022, the Supreme Court stated that the committee had submitted its report, but the full contents were not made public due to the sensitive nature of the information. The Court observed that some malware had indeed been found on certain devices, but the report did not conclusively attribute it to Pegasus, partly because of the lack of cooperation and access to classified information. The Court nevertheless acknowledged the existence of vulnerabilities and potential surveillance and reiterated the need for stronger safeguards, transparency, and oversight. It also directed the government to consider reforms to surveillance laws and mechanisms.
Although the committee’s report did not definitively confirm Pegasus use, the controversy did not subside. For many observers, the government’s refusal to cooperate fully and to clarify its position reinforced suspicions rather than dispelled them. The lack of transparency, combined with the scale of the allegations and the global evidence of Pegasus misuse, left a lingering sense of unease about the state of digital surveillance in India.
The Pegasus controversy also had profound implications for press freedom in India. Journalists are often at the forefront of exposing corruption, abuse of power, and human rights violations, and their ability to communicate securely with sources is essential to the functioning of a free press. The alleged targeting of journalists with spyware capable of accessing their communications, contacts, and locations threatens not only individual journalists but also their sources, many of whom may face retaliation or harm if exposed. This undermines investigative journalism and the public’s right to know, eroding one of the pillars of democracy.
Similarly, the alleged targeting of opposition politicians and election strategists raises concerns about the integrity of the democratic process. In a competitive democracy, opposition parties must be able to organize, strategize, and campaign without fear of surveillance or interference by the state. If the ruling establishment uses surveillance tools to monitor political opponents, it creates an uneven playing field, distorts democratic competition, and undermines public confidence in electoral fairness. Even the perception of such surveillance can have a chilling effect, discouraging political participation and dissent.
The controversy also brought to the fore the vulnerability of civil society, activists, and human rights defenders. These groups often challenge state policies, advocate for marginalized communities, and hold power to account. Surveillance of their activities, communications, and networks can disrupt their work, expose their supporters, and subject them to intimidation or harassment. In environments where civil society already faces legal, financial, and political pressures, spyware adds another layer of control and repression, even if used selectively or covertly.
At a broader level, the Pegasus episode highlighted India’s lack of a comprehensive data protection and privacy framework. Although the Supreme Court recognized privacy as a fundamental right in 2017, India has struggled to enact a robust data protection law. The Personal Data Protection Bill, which was introduced in Parliament, underwent multiple revisions and faced criticism for granting wide exemptions to the government for reasons of national security, public order, and sovereignty. In 2022, the bill was withdrawn, with the government stating that a new framework would be introduced. In 2023, the Digital Personal Data Protection Act was enacted, but critics argue that it still grants broad powers to the state and lacks strong, independent oversight mechanisms. The Pegasus controversy underscores the urgency of having a clear, enforceable, and rights-based data protection regime that applies equally to state and private actors.
Internationally, the Indian Pegasus controversy placed the country in a global spotlight, alongside other nations accused of misusing spyware. As the world’s largest democracy, India’s approach to surveillance and digital rights carries symbolic and practical significance. Allegations of mass surveillance against journalists and political opponents risk damaging India’s democratic image and its credibility in advocating for human rights and the rule of law on the global stage. At the same time, India faces genuine security challenges, including terrorism, insurgency, cyber threats, and cross-border crime, which require effective intelligence and surveillance capabilities. The challenge lies in ensuring that these capabilities are exercised within a transparent, accountable, and rights-respecting framework.
The Pegasus controversy also raises deeper philosophical and normative questions about the nature of governance in the digital age. Surveillance is no longer limited to intercepting phone calls or monitoring specific communications; it now encompasses the entire digital footprint of individuals, including their thoughts, relationships, movements, and behaviors. This level of surveillance transforms the relationship between the state and the citizen, potentially shifting it from one of trust and consent to one of suspicion and control. In a democracy, power is supposed to flow from the people to the state, subject to checks and balances. Unchecked surveillance risks reversing this flow, concentrating power in opaque institutions and undermining democratic accountability.
From a legal perspective, the Pegasus controversy underscores the need for surveillance reform in India. Legal scholars and civil liberties advocates have long argued that India’s surveillance laws are outdated, vague, and inadequate to protect fundamental rights in the digital era. The Telegraph Act and IT Act provide broad powers to the executive, with limited judicial oversight and weak transparency mechanisms. There is no independent oversight body comparable to those in some other democracies, such as parliamentary intelligence committees, judicial commissioners, or independent surveillance authorities. Authorizations for interception are typically granted by executive officials, and affected individuals are rarely informed, even after surveillance ends, depriving them of the opportunity to seek redress.
In the wake of Pegasus, there have been renewed calls for comprehensive surveillance reform, including clear statutory limits on the scope and duration of surveillance, strict necessity and proportionality tests, independent authorization by judicial or quasi-judicial bodies, robust oversight and audit mechanisms, transparency reports, and effective remedies for unlawful surveillance. Some have also called for a public debate on the use of commercial spyware and the establishment of a moratorium or strict licensing regime governing its acquisition and use. These proposals reflect a broader global movement toward embedding human rights principles into digital governance.
The Pegasus controversy also has implications for cybersecurity policy. The existence and use of spyware exploiting zero-day vulnerabilities highlight the tension between national security agencies’ desire to retain vulnerabilities for surveillance purposes and the broader public interest in cybersecurity. When vulnerabilities are exploited rather than disclosed and patched, millions of users remain exposed to potential attacks by criminals, hostile states, or other malicious actors. This raises questions about vulnerability disclosure policies, responsible cybersecurity practices, and the role of governments in safeguarding the digital ecosystem. In India, as elsewhere, there is a need for clear policies governing the acquisition, use, and disclosure of cyber vulnerabilities, balancing security interests with the protection of citizens and infrastructure.
Public reaction to the Pegasus controversy in India was marked by a mix of outrage, concern, skepticism, and resignation. Civil society organizations, journalists’ associations, lawyers’ groups, and digital rights activists organized campaigns, issued statements, and filed petitions demanding accountability and reform. Editorials and opinion pieces debated the implications for democracy, privacy, and governance. At the same time, some segments of the public viewed the controversy through partisan lenses, with supporters of the government dismissing the allegations as politically motivated or exaggerated, and opponents viewing them as evidence of authoritarian tendencies. This polarization reflects broader challenges in Indian public discourse, where issues of governance, rights, and accountability are often filtered through political loyalties rather than evaluated on their merits.
Despite the passage of time, the Pegasus controversy continues to cast a long shadow over India’s digital governance landscape. It has become a reference point in debates about surveillance, privacy, press freedom, and democratic accountability. It has influenced judicial discourse, legislative deliberations, and public awareness, even if concrete reforms have been slow and contested. The episode has also contributed to a growing recognition that digital technologies are not neutral tools but instruments of power that must be governed carefully and ethically.
In conclusion, the Pegasus controversy in India represents a watershed moment in the country’s engagement with surveillance and digital rights. It exposed the vulnerabilities of citizens in the face of advanced spyware, the inadequacies of existing legal frameworks, and the tensions between national security and constitutional freedoms. It challenged the government’s commitment to transparency and accountability and tested the judiciary’s role as a guardian of fundamental rights. It highlighted the risks faced by journalists, opposition politicians, activists, and civil society in an era of pervasive digital surveillance. Most importantly, it forced Indian society to confront fundamental questions about the kind of democracy it aspires to be in the digital age—one that prioritizes security at any cost, or one that seeks to balance security with liberty, dignity, and the rule of law. The answers to these questions will shape not only the future of surveillance in India but also the broader trajectory of its democratic institutions and constitutional values.
Comments