The Supreme Court of India on Wednesday ordered an independent expert committee to investigate the widespread allegations around the use of Pegasus spyware to carry out surveillance on politicians, judges, journalists and activists in the country.

The Pegasus spyware scandal was first unveiled in July by media companies who obtained access to a list of phone numbers belonging to identifiable individuals who are suspected persons of interest to clients of the NSO Group which sells the software. Nearly 300 of these numbers belonged to Indians, and as of now, ten phones have been forensically analyzed to confirm the presence of the Pegasus software.

In this case, the top court compiled a batch of petitions filed by complainants and public interest litigants. The petitioners argued that illegal surveillance through Pegasus spyware constituted violations of the fundamental rights of privacy and freedom of speech under the Indian Constitution. They also stated that since the NSO Group only sells its spyware to governments, the surveillance was most likely being carried by the Indian government or some foreign government agencies.

The Government of India has refused to file a full affidavit on grounds of national security and has maintained that no illegal surveillance took place. The court partially rejected this submission, and held that the government must specifically “plead and prove” the facts which indicate that the information sought must be kept secret on grounds of national security:

It is a settled position of law that in matters pertaining to national security, the scope of judicial review is limited. However, this does not mean that the State gets a free pass every time the spectre of “national security” is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning.

Due to the seriousness of the allegations, and failure by the Government of India to provide a clear response, the court ordered the constitution of an independent technical committee whose functioning will be overseen by retired judge RV Raveendran.

The committee is responsible for investigating whether the Pegasus spyware was used on devices of Indian citizens for surveillance, whether the Government of India or any state government acquired and/or used the Pegasus spyware, and whether any domestic entity in the country has used the spyware on citizens.

It will make recommendations regarding strengthening the legislative framework around privacy, establishing a mechanism for citizens to raise grievances on suspicion of illegal suspicion, setting up an independent agency to investigate cyber security vulnerabilities and any measure that can be taken by the Supreme Court in the interim period to uphold citizen’s rights.