Digital Surveillance, Privacy and Constitutional Accountability: A Critical Analysis of Manohar Lal Sharma v Union of India (The Pegasus Spyware Case)

Abstract

The expansion of digital technologies has transformed the nature of State surveillance and created serious challenges for constitutional democracies. The Pegasus spyware controversy brought these concerns into sharp focus by raising allegations of sophisticated surveillance against journalists, activists, politicians and other citizens. In Manohar Lal Sharma v Union of India, the Supreme Court of India confronted the constitutional implications of such allegations and examined the relationship between national security, privacy and judicial accountability. This article critically analyses the decision within the framework of Indian constitutional law and international human rights law. It examines the right to privacy under Articles 14, 19 and 21 of the Constitution, statutory powers of interception under the Indian Telegraph Act 1885 and the Information Technology Act 2000, and the principles developed in Justice KS Puttaswamy (Retd) v Union of India. The article argues that the Pegasus decision is significant because it rejects the proposition that an executive invocation of national security can automatically exclude judicial scrutiny. At the same time, the judgment leaves unresolved broader questions concerning institutional oversight and the regulation of advanced surveillance technologies. By locating the case within Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights, the article demonstrates the wider international relevance of India’s constitutional response to digital surveillance.

Keywords:

Digital Privacy; Pegasus Spyware; State Surveillance; Right to Privacy; National Security; Constitutional Accountability; Judicial Review; International Human Rights Law.

1. Introduction:

Digital communication has become inseparable from modern life. Mobile phones now contain personal conversations, photographs, financial information, professional documents, location histories and access to private networks. Consequently, surveillance technologies capable of penetrating such devices present a far greater threat to privacy than conventional methods of communication interception. The controversy surrounding Pegasus spyware therefore raised questions that extended beyond a single allegation of governmental surveillance: it challenged the constitutional limits of State power in the digital age[1].

The decision in Manohar Lal Sharma v Union of India, commonly associated with the Pegasus spyware controversy, occupies an important position in India’s developing privacy jurisprudence[2]. The Supreme Court was required to respond to allegations that sophisticated spyware had been used against Indian citizens while the Union Government declined to provide a detailed affidavit concerning the allegations, relying substantially upon national security concerns. The Court’s response was institutionally significant. Rather than accepting the executive position as conclusive, it emphasized the continuing role of constitutional scrutiny and constituted an independent Technical Committee supervised by Justice R V Raveendran.

This article analyses the Pegasus decision as a constitutional and international human rights issue. It argues that the judgment reinforces the principle that national security is a legitimate governmental objective but not a constitutional blank- cheque. Effective protection of privacy requires legality, necessity, proportionality and meaningful procedural safeguards. The article also considers the limitations of the judgment and proposes a stronger framework of independent surveillance oversight.

2. Background to the Pegasus Controversy:

Pegasus is sophisticated spyware reportedly capable of accessing extensive information stored or generated through a mobile device. Allegations concerning its use attracted international attention after reports suggested that journalists, human rights defenders, political figures and other individuals may have been selected for surveillance. In India, multiple petitions were filed before the Supreme Court seeking an independent investigation into the alleged use of Pegasus against citizens.[3]

The petitioners argued that unlawful surveillance could violate the fundamental right to privacy and produce a chilling effect upon freedom of speech and expression. These concerns were particularly serious in relation to journalists, lawyers, activists and political opponents because the possibility of constant surveillance may discourage confidential communication and democratic participation. The Union Government, however, did not provide a comprehensive factual response regarding whether Pegasus had been used. Its limited position relied upon concerns connected with national security.

The Supreme Court recognized that national security is a legitimate concern of the State. Nevertheless, it refused to accept the proposition that merely invoking national security places executive action beyond judicial examination. The Court observed that constitutional rights cannot be rendered ineffective simply because an allegation concerns surveillance or intelligence activities. In light of the technical complexity of the allegations and the need for public confidence, an independent Technical Committee was constituted to investigate relevant questions.[4]

3. Constitutional and Statutory Framework Governing Surveillance:

    3.1 Constitutional Protection of Privacy and Liberty:

The constitutional framework begins with Articles 14, 19 and 21 of the Constitution of India. Article 14 protects individuals against arbitrary State action. Article 19(1)(a) guarantees freedom of speech and expression, while Article 21 protects life and personal liberty. In the context of surveillance, these rights frequently operate together. Secret monitoring may intrude into private life, discourage free expression and create arbitrary distinctions in the exercise of State power.

The foundation of modern Indian privacy jurisprudence is Justice KS Puttaswamy (Retd) v Union of India, in which a nine-judge Bench unanimously recognized privacy as a constitutionally protected fundamental right.[5]The judgment connected privacy with dignity, autonomy, liberty and individual choice. It also made clear that privacy is not absolute. An invasion of privacy must, however, satisfy constitutional requirements of legality, legitimate State aim, proportionality and procedural safeguards. These principles became central to the constitutional understanding of surveillance.

    3.2 Statutory Powers of Interception:

Indian law contains statutory provisions authorizing interception and monitoring in defined circumstances. Section 5(2) of the Indian Telegraph Act 1885 permits interception of messages subject to statutory conditions and safeguards.[6] Section 69 of the Information Technology Act 2000 authorizes the interception, monitoring or decryption of electronic information under specified circumstances.[7] The Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009 provide procedural mechanisms relevant to the exercise of these powers.[8]

However, statutory authorization alone cannot resolve every constitutional concern. In People’s Union for Civil Liberties (PUCL) v Union of India, the Supreme Court recognized telephone tapping as a serious invasion of privacy and prescribed safeguards against arbitrary interception.[9]The Pegasus controversy demonstrates why such safeguards must evolve with technology. Traditional interception generally concerns communications in transit, whereas advanced spyware may enable access to an individual’s entire digital environment. The intensity of intrusion therefore demands equally robust safeguards.

4. Judicial Reasoning in Manohar Lal Sharma v Union of India:

The central importance of the Pegasus decision lies in its approach to governmental accountability. The Supreme Court did not conclusively determine whether Pegasus had been deployed by the Government. Instead, it addressed whether serious allegations affecting fundamental rights could be left unanswered merely through a broad assertion of national security. The Court concluded that such an approach was inconsistent with the constitutional obligation of judicial review.[10]

This reasoning is significant because national security litigation often involves an asymmetry of information: the executive possesses relevant intelligence material while affected individuals may be unable to prove the full extent of surveillance. If the executive’s assertion of secrecy automatically ended judicial scrutiny, constitutional remedies would become largely unavailable precisely in the cases where covert State power is most difficult to challenge.

The Court’s constitution of an independent Technical Committee was therefore both practical and constitutional. Cybersecurity allegations require specialized expertise that ordinary judicial procedures may not independently possess. At the same time, allowing the executive alone to investigate allegations against itself could undermine public confidence. The Committee model attempted to address both concerns by combining technical expertise with judicial supervision.[11]

5. National Security and Constitutional Accountability:

The Pegasus case demonstrates the difficult relationship between privacy and national security. States have legitimate obligations to protect sovereignty, public order and citizens from serious threats. Surveillance can therefore serve lawful purposes, including the prevention and investigation of crime. International human rights law does not prohibit every form of surveillance. Instead, it requires restrictions on privacy to be governed by law and justified according to principles of necessity and proportionality.

The problem arises when national security is invoked without sufficient institutional accountability. The Pegasus judgment correctly recognized that courts need not require public disclosure of every sensitive operational detail. Nevertheless, confidentiality cannot mean complete constitutional immunity. A democratic legal system must preserve some mechanism through which an independent institution can assess whether surveillance powers have been exercised lawfully.

The Puttaswamy framework provides an appropriate constitutional structure. First, surveillance must have a clear basis in law. Secondly, it must pursue a legitimate State objective. Thirdly, the chosen measure must be necessary and proportionate to that objective. Finally, effective procedural safeguards must prevent abuse.[12]These requirements are particularly important where surveillance is secret and the affected person may never know that an intrusion occurred.

6. International Human Rights Perspective:

The Pegasus controversy has significance beyond Indian constitutional law because privacy is recognized as a universal human rights concern. Article 12 of the Universal Declaration of Human Rights protects individuals against arbitrary interference with privacy, family, home and correspondence.[13] Similarly, Article 17 of the International Covenant on Civil and Political Rights prohibits arbitrary or unlawful interference with privacy, family, home or correspondence and requires legal protection against such interference.[14]

The Human Rights Committee has emphasized that interference with privacy must not merely be lawful under domestic legislation; domestic law itself must be consistent with the purposes and objectives of the Covenant and must contain appropriate safeguards.[15] This approach closely resembles the constitutional concerns expressed in Puttaswamy and the Pegasus proceedings. Formal statutory authority cannot legitimize surveillance that is arbitrary, excessive or insufficiently supervised.

A comparative perspective also demonstrates the importance of independent oversight. Article 8 of the European Convention on Human Rights protects private and family life while permitting certain restrictions only where they are in accordance with law and necessary in a democratic society.[16]Although constitutional systems differ, a common principle emerges: secret surveillance is capable of producing profound rights violations and therefore requires clear law, necessity, proportionality and independent control.

For an international audience, the Pegasus case illustrates a broader challenge confronting democracies. Technological capabilities increasingly transcend traditional legal categories. A legal system designed primarily for telephone interception may not adequately address spyware capable of accessing cameras, microphones, messages and stored data. International human rights standards therefore provide an important normative framework for evaluating whether domestic surveillance regimes remain adequate in the digital era.

7. Critical Analysis and Limitations of the Judgment:

The Pegasus decision is a valuable affirmation of constitutional accountability, but it also has limitations. Its greatest strength lies in rejecting complete executive insulation from judicial scrutiny. The Court recognized that allegations involving fundamental rights require a meaningful institutional response even where national security concerns are raised. The Technical Committee was an innovative attempt to obtain specialized expertise while preserving independence.

However, the judgment did not establish a comprehensive doctrine governing the future use of advanced spyware. It also did not finally determine governmental responsibility for the alleged surveillance. Consequently, important structural questions remain unresolved. Who should authorize highly intrusive surveillance? Should prior judicial approval be mandatory in most circumstances? What form of post-surveillance review should exist? How should individuals obtain remedies when surveillance is secret?

A stronger legal framework should include independent authorization, periodic review and transparent reporting obligations. Parliamentary oversight can provide democratic accountability, while judicial or quasi-judicial authorization can protect individual rights in specific cases. Exceptional circumstances may require urgent action, but emergency procedures should themselves be subject to subsequent independent review.

Protection must also extend beyond ordinary privacy interests. Surveillance of journalists may threaten source confidentiality and press freedom. Surveillance of lawyers may compromise legal professional privilege. Monitoring political opponents or civil society actors may distort democratic participation. Thus, the consequences of digital surveillance frequently affect a wider network of constitutional freedoms rather than privacy alone.

8. Recommendations and Way Forward:

India should consider adopting a comprehensive and technology-sensitive legal framework for surveillance. First, legislation should clearly distinguish between different forms and levels of surveillance, recognizing that invasive spyware requires stricter safeguards than ordinary data requests or targeted interception. Secondly, prior independent authorization should ordinarily be required for highly intrusive surveillance measures, subject to narrowly defined emergency exceptions.

Thirdly, an effective review mechanism should periodically examine the continuing necessity of surveillance. Fourthly, anonymized transparency reports should provide the public with meaningful information about the scale and legal basis of surveillance without compromising legitimate security operations. Fifthly, remedies should be available where unlawful surveillance is established. Finally, special protections should be considered for communications involving journalists, lawyers and other groups whose confidentiality performs an important democratic or constitutional function.

These reforms would not prevent the State from addressing genuine threats. Rather, they would strengthen the legitimacy of lawful surveillance by ensuring that extraordinary powers are exercised within a framework of accountability. Constitutional democracies are not weakened when security agencies are subject to law; public confidence is strengthened when exceptional power is accompanied by independent oversight.

9. Conclusion:

Manohar Lal Sharma v Union of India represents an important moment in India’s response to digital surveillance. The decision reaffirmed that the protection of fundamental rights does not disappear when the State invokes national security. By constituting an independent Technical Committee and insisting upon the continuing relevance of judicial scrutiny, the Supreme Court reinforced the constitutional principle that executive power remains accountable to law.

The broader importance of the case lies in its connection with Puttaswamy and international human rights standards. Privacy in the digital age is closely connected with dignity, autonomy, free expression and democratic participation. The legality, necessity, proportionality and procedural safeguards required by constitutional and human rights principles must therefore guide the development of surveillance law.

The Pegasus judgment should ultimately be understood as an important institutional response rather than the final answer to digital surveillance. Rapid technological development requires clearer legislation, stronger independent oversight and effective remedies. The enduring lesson of the case is that national security and constitutional liberty should not be treated as mutually exclusive. A democratic State can protect security while remaining accountable to constitutional and international human rights commitments.

Table of Cases

Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1

Manohar Lal Sharma v Union of India (2021) 6 SCR 1066

People’s Union for Civil Liberties (PUCL) v Union of India (1997) 1 SCC 301

Bibliography

Cases

Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1

Manohar Lal Sharma v Union of India (2021) 6 SCR 1066

People’s Union for Civil Liberties (PUCL) v Union of India (1997) 1 SCC 301

Legislation and International Instruments

Constitution of India 1950

Indian Telegraph Act 1885

Information Technology Act 2000

Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009

Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights, as amended) (ECHR)

International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171

Universal Declaration of Human Rights 1948

Other Materials

Human Rights Committee, ‘General Comment No 16: Article 17 (Right to Privacy)’ (8 April 1988) UN Doc HRI/GEN/1/Rev.9 (Vol I)

[1] Manohar Lal Sharma v Union of India (2021) 6 SCR 1066.

[2] ibid.

[3] Manohar Lal Sharma v Union of India (2021) 6 SCR 1066.

[4] ibid.

[5] Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

[6] Indian Telegraph Act 1885, s 5(2).

[7] Information Technology Act 2000, s 69.

[8] Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information)   Rules 2009.

[9] People’s Union for Civil Liberties (PUCL) v Union of India (1997) 1 SCC 301

[10] Mahonar Lal Sharma v Union of India (2021) 6 SCR 1066.

[11] ibid.

[12] Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

[13] Universal Declaration of Human Rights 1948, article – 12.

[14]  International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March     1976) 999 UNTS 171, art 17.

[15] Human Rights Committee, ‘General Comment No 16: Article 17 (Right to Privacy)’ (8 April 1988) UN Doc HRI/GEN/1/Rev.9 (Vol I).

[16] Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human   Rights, as amended) (ECHR) art 8.