New Delhi: A Pune police refusal to reply to right-to-information (RTI) queries about the use of Israeli spyware Pegasus raise several questions about whether the military-grade hacking weapon was deployed in implicating lawyers, activists, and academics in the Bhima Koregaon-Elgar Parishad (BK-EP) case, which invokes India’s draconian counter-terrorism law, the Unlawful Activities Prevention Act, 1967.
Over the course of the past year, this reporter filed seven RTI applications with the Pune police commissioner’s office seeking answers about Pegasus and any possible links with it. The reason answers were sought from Pune police—under the Bharatiya Janata Party (BJP) and Shiv Sena coalition government in 2018—was due to their role in initially investigating the BK-EP case before the National Investigation Agency (NIA) took over.
Reports have since confirmed that at least eight of the accused activists may have been the target of the spyware and malware called NetWire. This malware allows a hacker to gain access to the target’s devices and even plant documents.
The Washington Post, in February 2021, had reported that around 22 incriminating documents were planted using this malware in the laptop of one of the Bhima Koregaon accused- Rona Wilson before his arrest in June 2018. These files have, since 15 November 2018, been cited, initially by the Pune police and then by the NIA, as key evidence, leading to the arrest of 15 others including lawyers, academics, and activists.
There have been growing concerns about government snooping on citizens, especially those critical of them. Largely, surveillance remains widespread and unaccountable in India. Executive oversight over executive surveillance has failed and experts are calling for urgent surveillance reforms.
No Law Authorises Hacking Of Individual’s Device
The police refused to admit any of the seven RTIs on technical grounds, thereby evading an admission or denial of the spyware’s usage.
Asked if Pegasus or NetWire was specifically used on the BK-EP accused, the Pune police commissioner’s office said that if the “procedure established by law” is followed, the liberty of the BK-EP accused cannot be said to have been infringed.
The claim is oblivious to the fact that no such law authorising the hacking of an individual’s device exists in India. The police also claimed that the Supreme Court’s right to privacy judgement does not apply in all cases.
Experts Article 14 spoke to found this argument “flawed”. The police argued the information existed in several files and that they were not bound to collect or collate the information. Most queries only required a yes or no answer.
Former Madhya Pradesh chief minister Digvijay Singh had alleged that the Devendra Fadnavis-led BJP government (2014-19) had tapped the phones of several opposition leaders of the state and used Pegasus to hack into their mobile devices. Singh had even claimed that the police had used Pegasus in the Bhima Koregaon case and had unsuccessfully attempted to implicate him in the case.
Based on The Washington Post report, the activists had sought an independent inquiry and dismissal of the case against them before the Bombay High Court. The Pune police, now under a non-BJP government, and the NIA both opposed these pleas.
A few of these accused have also written to the Technical Committee constituted by the Supreme Court in response to petitions filed after the recent Pegasus Scandal. An international consortium of media outlets led by Paris-based Forbidden Stories had revealed the widespread misuse of Pegasus against civil society members, journalists, and political figures worldwide, including India.
The New York Times in January 2022 reported that India had purchased the Pegasus spyware in July 2017 as part of a larger defence deal during Prime Minister Narendra Modi’s visit to Israel.
Through the lens of the Bhima Koregaon case, Article 14 has previously reported how security laws and surveillance technology has been used to target critics and erode the rule of law since the Modi-led BJP came to power at the Centre in 2014, and then won state after state including Maharashtra that same year.
The role of the states is as much important since in the recent past, at least three chief ministers have either confirmed to have received a proposal from NSO Group for purchase of Pegasus, or have alleged its usage by the previous party in power—Mamata Banerjee, Jagan Reddy, Bhupesh Baghel.
The Pune police and former chief minister Devendra Fadnavis, who led the BJP- Shiv Sena coalition government in 2018, have refuted allegations of using Pegasus against the Bhima Koregaon accused.
Police Officials Unanimously Deny Any Involvement
Shivaji Bodkhe, the joint commissioner of the Pune police in 2018, who was also involved in the BK-EP probe, and is now retired, said there was no foul play in the case.
“No foul play was ever required,” said Bodkhe. “The evidence was crystal clear. We didn’t use Pegasus, and neither did the government.”
On being informed that the Washington Post had reported planting of evidence in the case, he said that the “defense will always try to create confusion” and questioned the report’s credibility.
On being asked whether the Pune police has ever used the Pegasus, Joint Commissioner of Police (Jt. CP) Ravindra Shisave said, “I don’t think so.”
Follow-up questions went unanswered.
Dr. Shivaji Panditrao Pawar, the investigating officer in the BK-EP case when contacted and asked about the Pegasus said that he is not in a capacity to comment. “I am no more in the Pune police, and I don’t want to make any comment on it,” he said
In September 2018, the Supreme Court had come down heavily on Pawar, now posted at the Maharashtra police academy in Nashik, for what it called “casting aspersions on the court” for telling the press that SC should not get involved in the BK-EP case.
The Story Changed To ‘Urban Naxalism’
Before the NIA took over the Bhima Koregaon case in January 2020, the Pune police carried out synchronised raids across cities, arresting five activists—Surendra Galding, Mahesh Raut, Sudhir Dhawale, Rona Wilson and Shoma Sen—in June 2018 followed by five more in August 2018— Sudha Bharadwaj, Arun Ferreira, Vernon Gonsalves, Gautam Navlakha, and P Varavara Rao—in August 2018, accusing them of having ties with the banned Communist Party of India (Maoist) and booked them under the UAPA.
So far, only human rights lawyer Sudha Bharadwaj has received default bail, granted by the NIA court in December 2021. Poet and activist Varavara Rao is out on medical bail since September 2021. Recently, the Bombay HC rejected his plea for permanent medical bail and extended his temporary bail for three more months.
The Pune police started arresting activists, five months after the violence at the 200th anti-caste commemoration at Bhima Koregaon near Pune on 1 January 2018. Lakhs of Bahujans, majorly Dalits had gathered at the place to commemorate the participation of Dalit soldiers who had defeated the ‘casteist’ Peshwa-led army of the Maratha empire in 1818.
The police claimed that the accused persons had a direct role in inciting violence at Bhima Koregaon by organising and participating in the Elgar Parishad event that happened a day earlier. Later, as the Pune police launched an all-India probe into what it claimed – the spread of “urban naxalism”, the story changed to “a Rajiv Gandhi style assassination” of Prime Minister Narendra Modi, and an “international angle” and Maoists were later introduced. The police claimed to have recovered several incriminating letters and documents from the electronic devices of the accused.
Refusing To Admit RTIs For Exceeding Word Limit Of 150 Words
Three RTI applications filed with the Pune police Commissioner’s office in April, July, and August 2021 seeking to know whether the Pune police or its associated officers purchased or used the Pegasus in any manner did not elicit any information.
Instead, its public information officer (PIO) Surendra Deshmukh and Milind Patil refused to admit the RTI applications on technical grounds, thereby leaving no chance for putting on record a refusal or acceptance of the spyware’s usage.
Two RTIs filed in the same time period seeking to know if the malware NetWire was ever used by the Pune police or its connected persons, also met the same fate.
The queries in these RTIs also sought to know whether it has ever had any relations with the NSO Group—the makers of the Israeli spyware and whether they ever received a proposal for buying the spyware. The RTI mentioned past reports of Indian journalists and activists being illegally snooped using the Pegasus and so a legitimate existence of a threat to one’s life and liberty.
Refusing to admit the RTIs on the grounds of “exceeded word limit of 150 words”, the PIO Deshmukh at the Pune police commissioner’s office said that the “information you request is not limited to a single archive/document, but must be compiled and edited… The (RTI) Act does not intend the PIO to do so”. The reply makes it clear that the information did exist but only that it was scattered in various files.
“The legal reasoning appears to be flawed. They cannot resist a clear answer on the utilisation of any spyware. The reply seems to be evasive, defeating the purpose of the RTI Act which is to bring transparency and provide information as sought for,” said Apar Gupta, executive director at Internet Freedom Foundation, a non-profit that works on digital rights and privacy.
Prasanth Sugathan, legal director at sflc.in, another non-profit working on digital freedom and one of the petitioners in the Supreme Court case seeking investigation into the Pegasus scandal, said that the Pune police’s RTI replies are “not surprising”.
“You don’t need to compile anything, as is being claimed in the reply. A straight question was asked for which a straight yes or no answer could be given,” he said.
“If Procedure Followed By Law, No Infringement Of Accused’s Rights”
This reporter also filed two other RTI applications with the Pune police commissioner’s office, naming each of the Bhima-Koregaon accused, such as Rona Wilson, Sudha Bharadwaj, and Gautam Navlakha, asking whether it had ever used Pegasus or NetWire to keep them under surveillance or for any other purpose.
A reply was requested within 48 hours under the ‘threat to life & liberty’ provision of the RTI Act.
The RTIs also explained how the Supreme Court’s right to privacy judgement, legally known as the Puttaswamy judgement, held that the right to privacy is part of the right to life and liberty under the Indian Constitution, and how any infringement of one’s privacy—like by using this spyware—is a threat to life and liberty.
The PIO’s strange replies to these RTIs raise more questions. The reply said that Article 21 of the constitution, while protecting the life and liberty of an Indian citizen, makes it clear that no person shall be deprived of the right to life or personal liberty except in accordance with the procedure established by law.
“This Office is of the view that if such a procedure is followed, life and liberty may not be said to have infringed upon the fundamental rights or privileges of the individual” read the reply. The police even declared that the Puttaswamy judgement “does not apply in all cases”.
In other words, the PIO’s reply makes it clear that the Pune police are of the view that any such snooping, if done as per established law, cannot be called an infringement of the person’s life and liberty—in this case, the Bhima Koregaon accused. But this is the problem. The use of hacking tools like the Pegasus—a military-grade weapon—is not authorised by any law in India.
Gupta said that there are no laws in India that authorise the use of hacking, and it is a criminal offence. The meaning of the word “interception” under the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, also includes the “diversion of any direct or indirect information from its intended destination to any other destination to any other destination”.
This provision, Gupta said, can be used by intelligence agencies to argue that there is authorisation for their actions, including any hacking. “This would be a form of spoofing and the constitutionality of this is suspect”, he said.
Sugathan was of the view that the police had no right to sit in judgement of a particular law and should instead raise exemptions provided under the RTI Act, in case they have to.
“Even if you are a convict, you have freedoms. The infringement should be as per the law and procedure established under it. The way the police has responded is not the way and the tone is surprising,” he said.
Was Spyware Used Against The Bhima Koregaon Accused?
The PIO then went on to quote and interpret random provisions of the RTI Act in the reply like listing out exempt agencies of the Maharashtra police (the RTI did not relate to them), asking information for only one subject matter (which it was), application to be in Marathi/Hindi/English (it was in English), etc.
What was not addressed however was whether the spyware was used against the Bhima Koregaon accused and on Pune police’s links to the NSO Group.
Even an RTI with a single line question—whether the Pune police has purchased or used the Pegasus spyware, was filed. Yet, a ditto reply as given in response to all other RTI applications was provided.
On a first appeal before the deputy commissioner of Pune police in August 2021, a response was never received. The Maharashtra home department too, was asked about the Pegasus via an RTI sent in April 2021 but it refused to provide any answers. The home department claimed exemption from the RTI Act granted by the State government via a Government Order (GO).
Gupta, from the IFF, said government departments use such GOs to evade accountability, even when questions of human rights are involved, for which it cannot claim any exemption.
“Information on activities that are required to be made public in view of SC judgements, even if they are denied citing exemption granted under a government order (GOs),”said Gupta. “Essentially, governments are citing GOs to defeat the very purpose of the RTI Act.”
Gupta said that not only in the case of the Maharashtra government, but governments across states in his experience are very hesitant to be transparent on matters such as these, on digital rights, or even on enforcement of Supreme Court judgements in similar matters.
Allegations of Pegasus Use in BK-EP Case under Fadnavis Govt
In 2019, after The Indian Express had reported that a number of Indians were allegedly snooped upon using Pegasus, many being the Bhima-Koregaon accused, former Madhya Pradesh Chief Minister Digvijay Singh had alleged that the Devendra Fadnavis-led BJP government had tapped phones of several opposition leaders of the state and used Pegasus to hack into their mobile devices.
Singh alleged that a team of senior officials of the then Maharashtra government had visited Israel to execute this plan.
Singh even claimed that the police had used Pegasus in the Bhima-Koregaon case and had unsuccessfully attempted to implicate him in the case. His allegations were also echoed by his party colleague Sanchin Sawant who is the Maharashtra Congress party spokesperson.
Later, the present Maha Vikas Aghadi government of the Shiv Sena-Nationalist Congress Party-Indian National Congress ordered a high-level probe into these allegations. Years on, the probe has seemingly made no headway.
Sawant said that several officials visited Israel during Fadnavis’ time as CM.
“If you see the kind of concocted evidence used in the Bhima Koregaon case, like the Washington Post revealed, I am sure the BJP government could go to any extent (on using Pegasus). We are no longer fighting this fight within democratic realms. Modi has crossed all limits and democratic institutions are in his support,” he said.
Then CM and current Maharashtra leader of opposition (LoP) Devendra Fadnavis last year poo-pooed these allegations and said that his Government (2014-19) had not availed any facilities from the NSO Group in Israel. On a team of senior officials from DGIPR visiting Israel, he said that the team had gone there for “agriculture development purposes”.
However, an RTI reply revealed that this was not part of the tour’s agenda.
Recently, Rashmi Shukla, a senior IPS officer was charge-sheeted by the Maharashtra police in what is being called the “Phone Tap Scandal”. As the then state intelligence department (SID) commissioner, Shukla is alleged to have tapped the phones of senior Shiv Sena and NCP leaders on behalf of the BJP government.
This was during the crucial time in 2019 when discussions on government formation were ongoing. It was during Shukla’s time as commissioner of the Pune police when the Elgaar Parishad probe started.
SC Committee Probing Pegasus Links of Governments
After an international consortium of media outlets led by Paris-based Forbidden Stories revealed the widespread misuse of Pegasus against civil society members, journalists, and political figures, the Supreme Court on 27 October 2021 had set-up a committee headed by retired SC Justice R.V. Raveendran to investigate the allegations and submit a report “expeditiously”.
Though the court’s order, in response to a petition by a few victims of Pegasus and public-spirited organisations, was welcomed by many for noting that the government cannot merely evoke “national security” to stonewall judicial review and that there cannot be an omnibus denial of information, several others pointed out the Court’s hesitation to legally compel the government to answer a simple question—whether it ever purchased the Pegasus spyware.
Till date, the government has neither confirmed nor denied that question.
In February 2022, the Pegasus case was scheduled to be heard by a bench headed by the Chief Justice of India NV Ramana, but was postponed to, just a day earlier. Since then, the case, much like many other politically sensitive cases of constitutional importance, has not been listed for a hearing.
One of the objectives of the committee is: “Whether any Pegasus suite of spyware was acquired by the Respondent Union of India, or any State Government, or any central or state agency for use against the citizens of India?”
Recently, the committee wrote to the director generals of police of all states asking the same question as the RTIs: if Pegasus was purchased and used on any citizen of India.
Given the hesitation of the Pune police to categorically accept or deny purchasing Pegasus, much like the union government, the committee has the mandate to look into Maharashtra police’s possible links with the spyware, if any.
This research was supported by a grant from the Thakur Family Foundation. Thakur Family Foundation has not exercised any editorial control over the contents of this reportage.
(Saurav Das is an investigative journalist and transparency activist. He is the co-founder of The Taut.)