Pegasus Spyware Controversy: Supreme Court’s Privacy Safeguards Under Spotlight as New Surveillance Risks Emerge in 2026
By Suman Munshi | IBG NEWS
NEW DELHI, 2 November 2026: India’s Pegasus spyware controversy continues to raise critical questions about digital privacy, government accountability and the limits of electronic surveillance. Although the Supreme Court of India ordered an independent technical investigation into allegations of unauthorised phone surveillance in October 2021, the publicly disclosed findings did not conclusively establish Pegasus infections in the 29 mobile phones examined or identify the authority responsible for the alleged surveillance.
Five years after the landmark judicial intervention, the debate has acquired renewed significance. Sophisticated commercial spyware, increasingly complex cyberattack methods and the growing dependence on smartphones for political, professional and personal communication have made digital surveillance a continuing concern for democratic institutions.
The controversy centres on Pegasus, an advanced mobile surveillance system developed by Israel-based NSO Group. The software attracted international attention in July 2021 when the Pegasus Project, an investigation involving international media organisations, reported that telephone numbers associated with politicians, journalists, activists and other public figures appeared in a leaked database linked to potential surveillance targets.
However, the presence of a telephone number in such a database does not independently establish that the corresponding phone was successfully infected.
Supreme Court’s 2021 Intervention: Privacy Cannot Be Overridden by a General Security Claim
On 27 October 2021, a three-judge bench of the Supreme Court, headed by then Chief Justice of India N.V. Ramana and comprising Justices Surya Kant and Hima Kohli, delivered an important order in Manohar Lal Sharma v. Union of India (2021 INSC 682).
The Court considered petitions seeking an independent investigation into allegations that Pegasus had been used to monitor Indian citizens without lawful authorisation.
The judgment placed particular emphasis on the constitutional protection of privacy. It recognised that unauthorised surveillance can seriously affect an individual’s personal liberty, confidentiality and freedom of expression.
A significant observation concerned the Government’s reliance on national security. The Court made clear that invoking national security cannot automatically prevent judicial examination of allegations involving possible violations of fundamental rights.
The bench also expressed dissatisfaction with the limited information provided by the Union Government and declined to leave the investigation entirely in the hands of a committee appointed by the executive.
Instead, it constituted an independent technical committee under the supervision of former Supreme Court judge Justice R.V. Raveendran.
What Did the Supreme Court Investigation Reveal?
The Supreme Court examined the committee’s reports on 25 August 2022. The publicly disclosed findings provided an important but incomplete picture of the investigation.
The technical committee examined 29 mobile phones submitted for forensic assessment. Some form of malware was detected on five devices, but the Court clarified that this did not establish that Pegasus was responsible. The available material was insufficient to conclusively determine the nature and source of the suspected infections.
The Court also disclosed that the committee had reported a lack of cooperation from the Union Government.
The reports were retained in sealed custody because they contained sensitive technical information and potentially confidential personal data.
Consequently, the proceedings did not establish that the Indian Government had deployed Pegasus against the named individuals. Nor did they establish that every person whose telephone number appeared in the leaked database had been successfully targeted.
The distinction between suspected targeting, attempted infection and confirmed device compromise remains essential to understanding the case.
Indian Journalists and the Continuing Surveillance Debate
The controversy did not end with the Supreme Court’s 2022 proceedings.
In December 2023, Amnesty International’s Security Lab, working with The Washington Post, published forensic findings concerning Pegasus activity involving Indian journalists Siddharth Varadarajan and Anand Mangnale.
The investigation reported evidence of Pegasus-related activity on their iPhones. In Anand Mangnale’s case, researchers identified evidence of a zero-click exploit delivered through iMessage in August 2023. Amnesty stated that it was unclear whether the attempted exploit had successfully compromised his device.
The investigation also identified Pegasus-related traces on Siddharth Varadarajan’s phone, including evidence of renewed targeting in October 2023.
These findings were significant because they came from forensic examination of devices rather than relying exclusively on the appearance of telephone numbers in a leaked database. Nevertheless, the technical findings must be distinguished from any conclusion about the identity of the operator or the legal authorisation behind the activity.
New Technical Insights in 2026: How Pegasus Has Evolved
A major development in understanding commercial spyware came on 16 July 2026, when Amnesty International’s Security Lab published an extensive technical analysis titled Inside Pegasus: The Evolution of the World’s Most Notorious Spyware System.
The research drew on previously unpublished NSO Group training material, marketing documents and internal technical records disclosed during the long-running legal dispute involving WhatsApp, Meta and NSO Group in the United States.
The analysis provided additional insight into the architecture and operational methods associated with Pegasus.
It described several categories of infection methods, including:
- One-click attacks: A target is persuaded to open a malicious link or interact with deceptive content.
- Zero-click attacks: Exploitation of a device vulnerability can occur without the target clicking a link or taking an obvious action.
- Network-based attacks: Specialised infrastructure can be used to attempt delivery through network connections.
- Physical-access methods: A device may be targeted when an operator has direct physical access.
The research also described the complex infrastructure supporting the system, including anonymised transmission networks, customer-specific accounts and technical support arrangements.
According to Amnesty’s analysis, Pegasus is not simply an application installed on a phone. It is part of a sophisticated cyber-intelligence ecosystem requiring technical infrastructure, exploit development and continuing operational support.
The 2026 research therefore adds an important dimension to the debate: investigating sophisticated spyware requires examination of the entire operational infrastructure, not merely the suspected infected device.
Risk of Similar Spyware and Advanced Surveillance Tools in 2026
The Pegasus controversy illustrates a broader cybersecurity challenge. The risk in 2026 is not confined to one company, one software product or one country. Commercial surveillance technologies and advanced mobile exploits create a wider environment in which journalists, politicians, business leaders, lawyers, activists and government officials may face targeted digital threats.
Human Rights Watch, in a report published on 12 May 2026 titled Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators, warned that commercial surveillance technology exports continue to create human-rights risks. Its investigation highlighted weaknesses in transparency, export oversight and safeguards against misuse.
Several developments deserve particular attention.
1. Zero-click exploitation
One of the most serious risks is the possibility of attacks that do not require a person to click a suspicious link. Vulnerabilities in messaging applications, browsers and operating systems may be exploited through specially crafted digital content.
This reduces the effectiveness of traditional advice such as avoiding suspicious links. Keeping devices updated and maintaining strong security settings therefore becomes particularly important.
2. Growth of commercial spyware markets
Sophisticated surveillance capabilities are no longer discussed only in the context of intelligence agencies. A wider international market of commercial surveillance vendors supplies different categories of monitoring and investigative technology.
The level of capability varies considerably between products. Not every surveillance product has Pegasus-level access, and not every monitoring application is equivalent to military-grade spyware.
Nevertheless, inadequate oversight of procurement, deployment and export can create opportunities for misuse.
3. Targeting of journalists and confidential sources
Journalists frequently communicate with confidential sources, whistle-blowers, political representatives and individuals involved in sensitive investigations.
If a journalist’s device is compromised, the consequences may extend beyond personal privacy. Source identities, unpublished investigations, documents, photographs and communications may also be exposed.
Such risks can discourage sources from speaking to the media and weaken the ability of journalists to investigate matters of public interest.
4. Risks to political and administrative institutions
Political representatives, election officials, government employees and senior administrators regularly handle confidential information through digital devices.
Unauthorised access could potentially expose private discussions, policy documents, strategic communications and sensitive personal information.
The existence of these risks does not establish that any particular Indian official is currently under surveillance. It demonstrates why independent safeguards and effective cyber-defence arrangements are necessary.
5. Artificial intelligence and the changing cyber-threat environment
Artificial intelligence is increasingly relevant to cybersecurity, including the development of malicious content, automated reconnaissance, social engineering and the analysis of stolen information.
AI does not automatically create Pegasus-like spyware, nor does it independently guarantee successful phone infection. However, its potential use in preparing convincing impersonation attempts and processing compromised information may increase the scale and sophistication of certain cyber threats.
The combination of advanced exploitation techniques, commercial surveillance infrastructure and AI-assisted cyber operations deserves continued monitoring.
How Can Indian Citizens and Institutions Reduce the Risk?
Although ordinary security practices cannot guarantee protection against highly sophisticated state-level spyware, they can reduce exposure to many common forms of digital compromise.
Recommended precautions include:
- Install operating-system and security updates promptly.
- Enable advanced security features offered by smartphone manufacturers, where appropriate.
- Use strong, unique passwords and multi-factor authentication for important accounts.
- Review applications and remove software that is unnecessary or untrusted.
- Restrict microphone, camera, location and other sensitive permissions.
- Avoid installing applications or configuration profiles from unknown sources.
- Treat unexpected account-security alerts seriously and verify them through official channels.
- Seek qualified digital-forensic assistance if credible evidence of targeted surveillance emerges.
Journalists, public officials and other individuals handling sensitive information should also consider dedicated security assessments and organisational device-management policies.
A routine antivirus scan cannot reliably rule out sophisticated spyware infection. Equally, unusual battery consumption, device heating or unexpected data usage alone cannot prove that a phone has been compromised.
The Need for Stronger Legal and Institutional Safeguards
The Pegasus proceedings highlighted the importance of independent oversight of intrusive surveillance technologies.
India’s constitutional framework requires State action to respect fundamental rights, including privacy. Any surveillance undertaken by public authorities must operate within applicable law and constitutional safeguards.
The larger policy debate concerns whether existing oversight mechanisms provide sufficient transparency and accountability in an era when commercial technology can potentially access highly personal digital information.
Several measures merit serious consideration:
- Independent oversight of the acquisition and deployment of highly intrusive surveillance systems.
- Clear legal authorisation and documented necessity for targeted surveillance.
- Periodic technical audits by independent cybersecurity experts.
- Effective grievance and investigation mechanisms for individuals who suspect unlawful monitoring.
- Greater transparency regarding government contracts with private surveillance vendors, subject to legitimate national-security restrictions.
- Stronger human-rights due diligence in the international trade of surveillance technologies.
The 2026 Human Rights Watch report on surveillance exports also underlines the importance of stronger export controls and meaningful assessment of the human-rights implications of such technologies.
Conclusion: Technology Must Remain Within Constitutional Limits
The Pegasus controversy has developed into a wider debate about the relationship between technological power and constitutional democracy.
The Supreme Court’s intervention in 2021 reinforced the principle that privacy and national security must be considered within the framework of constitutional law. The investigation that followed did not publicly establish conclusive Pegasus infections among the 29 examined phones or identify the authority responsible for the alleged surveillance.
Subsequent forensic investigations involving Indian journalists and Amnesty International’s 2026 technical analysis have nevertheless demonstrated why advanced spyware remains a serious international concern.
As digital surveillance technology continues to evolve, the challenge for India and other democracies is to ensure that legitimate security requirements do not become a substitute for accountability.
The central question is no longer limited to whether a particular smartphone can be monitored. It is whether legal institutions, technical safeguards and independent oversight can keep increasingly powerful surveillance systems within the boundaries of law, necessity and individual liberty.
For a constitutional democracy, protecting citizens from unlawful digital surveillance is not merely a cybersecurity requirement. It is an essential part of protecting privacy, freedom of expression and public trust.
Sources and References
- Supreme Court of India, Manohar Lal Sharma v. Union of India, judgment dated 27 October 2021, 2021 INSC 682.
- The Indian Express, No evidence, Govt didn’t cooperate: SC panel on Pegasus, 25 August 2022.
- Amnesty International, India: Damning new forensic investigation reveals repeated use of Pegasus spyware to target high-profile journalists, 28 December 2023.
- Amnesty International Security Lab, Inside Pegasus: The Evolution of the World’s Most Notorious Spyware System, 16 July 2026.
- Human Rights Watch, Looking the Other Way: EU Failure to Prevent Surveillance Exports to Rights Violators, 12 May 2026.
- The committee’s conclusion was narrower:
- Pegasus infection was not conclusively proven in the examined phones.
- The committee did not rule out Pegasus generally.
- Some findings remained confidential.
- A sentence clarifying this distinction would improve precision.
Editorial Note: This report distinguishes judicial findings, independently reported forensic evidence, technical analysis and potential future risks. It does not claim that the Indian Government or any named individual or institution has been conclusively proven responsible for the alleged surveillance.
