Could the Ruling Shape Public Opinion and Policy in India?

December 22, 2024

In a landmark decision, a U.S. court has ruled in favour of WhatsApp, holding the Israeli spyware maker NSO Group directly liable for targeting about 1,400 users with its Pegasus spyware, including over 300 Indian mobile numbers.

The court’s ruling on Dec. 20 establishes that NSO Group violated the Computer Fraud and Abuse Act and California’s Cybersecurity laws by deploying Pegasus to infiltrate WhatsApp accounts, as reported by MSN. The victory marks the first instance where a U.S. court has held NSO accountable for its spyware activities, potentially setting a precedent for future cases against surveillance technology firms.

NSO Group has maintained that it only provides Pegasus to “vetted governments” for purposes such as investigating crimes and addressing national security threats. However, the U.S. court rejected this defence, stating that NSO could not evade liability despite its claims of using the spyware for legitimate purposes.

Will Cathcart, head of WhatsApp, described the ruling as a “huge win for privacy.”

“We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions,” Cathcart wrote on X. “Surveillance companies should be on notice that illegal spying will not be tolerated. WhatsApp will never stop working to protect people’s private communication.”

The verdict could shape public perception and regulatory approaches to spyware worldwide, including in India.

Since at least 2018, Pegasus spyware has been used to target over 300 Indian mobile numbers, including those belonging to two serving ministers, opposition leaders, journalists and businesspeople, raising alarms about the privacy and security in India.

The use of Pegasus in India aligns with a broader crackdown on freedom of expression and assembly, a previous report by the international human rights group Amnesty International has said. The Indian government denied any involvement in the surveillance activities linked to Pegasus.

Following the exposure of Pegasus’s activities in India, the Supreme Court formed a committee to investigate the allegations. While the committee subsequently found no conclusive evidence of wrongdoing, it criticised the central government for its lack of cooperation during the investigation.

State governments have also been accused of using Pegasus, according to The New Indian Express.

For instance, in West Bengal, the government established a commission to investigate claims that NSO offered the spyware to the state. In Andhra Pradesh, suspicions that Pegasus was used to monitor rival political figures have led to political tensions, with accusations directed at both former and current state administrations.

In India, WhatsApp is contesting Rule 4(2) of the 2021 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, which requires social media intermediaries to trace the first originator of information when ordered by a court or competent authority.  This means WhatsApp must store billions of messages for several years, a requirement unique to India.

While many constitutions do not explicitly mention a “right to privacy,” judicial interpretations have inferred this right from larger constitutional guarantees. In India, the Supreme Court has interpreted the right to privacy as part of the fundamental right to life and personal liberty under Article 21 of the Constitution.