Manohar Lal Sharma v. Union of India: the Pegasus committee

The facts in brief

In July 2021, the Pegasus Project — a consortium of seventeen media organisations, working with Amnesty International's Security Lab and Citizen Lab at the University of Toronto — published an investigation alleging that more than 50,000 phone numbers worldwide had been targeted using Pegasus, military-grade spyware sold by the Israeli firm NSO Group. NSO's own representations stated that Pegasus was sold exclusively to "vetted governments". Roughly 300 verified Indian numbers were on the targeting list. Among the targets were journalists (Siddharth Varadarajan, Paranjoy Guha Thakurta, Sushant Singh, Rohini Singh), Opposition political figures (Rahul Gandhi, Prashant Kishor, Abhishek Banerjee), activists, advocates representing the Bhima Koregaon-accused, and a former Supreme Court judge's family member.

A clutch of writ petitions followed. Advocate Manohar Lal Sharma filed W.P.(Crl.) No. 314 of 2021 as the lead petitioner. N. Ram and Shashi Kumar, as Editors Guild members, filed W.P.(Crl.) No. 387 of 2021. Separate petitions were filed by the Editors Guild of India itself, by CPI(M) MP John Brittas, by Paranjoy Guha Thakurta, by the Software Freedom Law Centre (SFLC.in), and by former Union Minister Yashwant Sinha, among others. The petitioners sought a declaration that the alleged deployment of Pegasus was unconstitutional, a court-monitored independent investigation, and disclosure of whether the Union or any state agency had procured or deployed the spyware.

The Union of India, through Solicitor General Tushar Mehta, filed a "limited affidavit" declining to confirm or deny the use of Pegasus, citing national security. It offered instead to constitute its own committee chaired by a former Supreme Court judge. The petitioners objected to a self-investigation by the very entity whose conduct was in question. After hearings in September and October 2021, the Court reserved orders on 13 September 2021 and delivered the operative order on 27 October 2021.

The constitutional question

The principal question was whether the State, by mere invocation of "national security", could defeat the Court's duty under Articles 14, 19 and 21 to examine alleged violations of fundamental rights. Did a bare assertion of security oust judicial review? Or was the State required specifically to plead and prove the security concern before the proportionality framework laid down in K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 yielded?

A linked question was the institutional one: in the absence of a cooperative State affidavit and in the presence of credible technical attribution from independent forensic laboratories, how was the Court to undertake fact-finding on a question of digital forensic attribution that lay outside conventional judicial expertise?

What the Court held

The national-security plea rejected

The bench refused the Union's "limited affidavit". The State, the Court held, cannot rely on a generalised invocation of national security to insulate itself from constitutional scrutiny. It must specifically plead and prove the security concern. Affidavit-by-incantation does not suffice. A "free pass" for national-security pleas, the bench observed, would hollow out the proportionality framework that Puttaswamy had so carefully built.

Surveillance, rule of law, and statutory safeguards

The Court framed targeted spyware deployment as a category of State action that, if proven, would engage the foundational Puttaswamy triad: legality (a clear statutory anchor), legitimate aim, and proportionality. Neither s.5(2) of the Indian Telegraph Act, 1885 nor s.69 of the Information Technology Act, 2000 was held, on the face of the order, to authorise the kind of covert device-level intrusion that Pegasus is technically capable of. Whether the existing statutory regime was sufficient to authorise such deployment — and whether, if not, the deployment was unlawful — was left for later determination on the Committee's findings.

The Raveendran Committee

The Court constituted an Expert Committee with Justice (Retd.) R.V. Raveendran, former Judge of the Supreme Court of India, overseeing its work. He was assisted by Mr. Alok Joshi, former IPS officer and former Chief of India's Research and Analysis Wing, and Dr. Sundeep Oberoi, Chairman of a sub-committee of the International Organisation for Standardisation. Three technical members were appointed: Dr. Naveen Kumar Chaudhary (Dean, National Forensic Sciences University, Gandhinagar), Dr. Prabaharan P. (Amrita Vishwa Vidyapeetham), and Dr. Ashwin Anil Gumaste (IIT Bombay).

The Committee's Terms of Reference required it to determine: whether Pegasus was used to access devices of Indian citizens; which agency procured or used it; whether victims were notified or had given any form of consent; and what legal and institutional framework was required for protection against illegal surveillance. The Committee was authorised to receive evidence from individuals who suspected their phones had been compromised, to forensically examine devices, and to report to the Court.

Press freedom as an independent injury

Although the order's principal doctrinal axis is the Puttaswamy privacy line, the bench treated targeted surveillance of journalists as engaging Article 19(1)(a) press freedom directly — not merely derivatively through privacy. The chilling effect of source-compromising surveillance on investigative journalism was recognised as a constitutional harm of its own kind.

The doctrinal architecture

Sharma operationalises three strands of doctrine simultaneously.

It locates privacy-as-substantive-constitutional-value in the State-surveillance context, completing an arc that began with the Puttaswamy nine-judge declaration of privacy as a fundamental right and continued through the Puttaswamy II — Aadhaar application of proportionality to a State data architecture. Sharma takes the framework to the next surface: covert, targeted, device-level intrusion by an unknown State actor.

It narrows the sealed-cover doctrine. Joining a line that includes the subsequent two-judge bench in Madhyamam Broadcasting v. Union of India (2023) 13 SCC 401, Sharma signals that sealed-cover production cannot be deployed where the substantive question is judicial review of executive action against fundamental rights. The State must come into the open and defend.

It establishes an institutional fact-finding template — the court-supervised expert committee — for technology-forensic questions that lie beyond conventional judicial competence. The device is not novel (it traces to the Lalita Kumari committee and the Manipur EFEFR extra-judicial killings inquiry) but its application to digital-forensics attribution sets a new institutional precedent for surveillance litigation.

The adjacent precedents the order weaves together are Puttaswamy itself, PUCL v. Union of India (1997) 1 SCC 301 on telephone-tapping safeguards under s.5(2) of the Telegraph Act, and the proportionality framework imported from Modern Dental College & Research Centre v. State of Madhya Pradesh (2016) 7 SCC 353.

What the judgment did not decide

The order is interim. It does not decide whether Pegasus was, in fact, used by the Government of India. It does not declare s.5(2) of the Indian Telegraph Act or s.69 of the Information Technology Act unconstitutional. It does not rule on whether bulk or targeted spyware deployment falls within the Puttaswamy proportionality framework — the merits await final disposition.

It does not address surveillance-reform legislation directly, an architecture that had been pending in successive draft cycles from the 2018 Justice Srikrishna Committee report through the personal-data-protection draft sequence to the eventual DPDP Act, 2023, none of which decisively reformed the lawful-interception regime.

The Court did not order disclosure of the Expert Committee's report. The report was filed in sealed cover in August 2022 and the matter was listed in August 2022 and intermittently thereafter. As of writing, it has not been finally disposed, and the Court has not itself pierced the sealed-cover protection over its own committee's findings.

After the order

The Expert Committee's interim findings, partially reported in August 2022, indicated that of twenty-nine phones submitted for forensic examination, five showed signs of malware. The Committee, however, could not conclusively attribute the malware to Pegasus and observed that the Union of India had not cooperated with its inquiry. The Committee's final report remains in sealed cover.

The order's most consequential downstream effect has been its contribution to the narrowing of sealed-cover doctrine. The two-judge bench in Madhyamam Broadcasting v. Union of India (5 April 2023) cited Sharma among the precedents disapproving sealed-cover production where the substantive question is fundamental-rights review of executive action. The journey from Sharma to Madhyamam Broadcasting shows the Court progressively constraining a procedural device that had become an instrument of executive concealment.

The doctrinal afterlife of Sharma in Puttaswamy-line privacy litigation is robust. It is cited in every petition challenging targeted surveillance, including challenges to the carve-out for State agencies under s.17(2)(a) of the Digital Personal Data Protection Act, 2023, and to the lawful-interception framework under s.20 of the Telecommunications Act, 2023. Whether a final merits judgment ever issues, the 27 October 2021 order has already done substantial doctrinal work.

Related on Valkya

• Shreya Singhal v. Union of India: striking down Section 66A
• Anuradha Bhasin v. Union of India: internet as an Article 19 right
• K.S. Puttaswamy v. Union of India: the nine-judge privacy declaration
• K.S. Puttaswamy v. Union of India — the Aadhaar judgment

Sources

1. SCC OnLine Blog — "Pegasus: National security cannot be the bugbear that the judiciary shies away from": https://www.scconline.com/blog/post/2021/10/28/pegasus-national-security-supreme-court/
2. Supreme Court Observer — Pegasus Spyware Probe case page: https://www.scobserver.in/cases/manohar-lal-sharma-v-union-of-india-pegasus-spyware-probe-case-background/
3. LiveLaw — "Supreme Court Constitutes Independent Expert Committee To Probe Pegasus Snooping Allegations": https://www.livelaw.in/top-stories/pegasus-spyware-supreme-court-judgment-technical-committee-184404
4. Internet Freedom Foundation — "Supreme Court of India says: Investigate Pegasus!": https://internetfreedom.in/sc-appoints-a-committee-to-examine-the-use-of-pegasus-spyware-in-india/
5. Global Freedom of Expression (Columbia) — Manohar Lal Sharma v. Union of India: https://globalfreedomofexpression.columbia.edu/cases/manohar-lal-sharma-v-union-of-india/
6. BarandBench — Pegasus order coverage: https://www.barandbench.com/news/litigation/supreme-court-pegasus-snooping-allegations-independent-committee