[1]A watchtower in the US area of the special ammunition depot in the Dernekamp hamlet, Kirchspiel, Dülmen, North Rhine-Westphalia, Germany (Dietmar Rabich [1], CC BY-SA 4.0 [2])
The Pegasus Project, [3]a collaboration of 17 media organisations, released a report on July 18 detailing the potential hacking and illegal surveillance of 50,000 phone numbers [4], mostly in countries with authoritarian regimes, through the use of the Israeli-made spyware Pegasus [5]. The targets of this alleged espionage include human rights defenders, activists, journalists, politicians, high-ranking public officials and business people. Reportedly, more than 1,000 phone numbers [6] from India are a part of this list.
Pegasus users can access [7] unencrypted content stored on a phone (messages, emails, photos, videos, etc.), record phone calls, track geo-locations and activate microphones and cameras without the user's authorization.
The leaked list of Pegasus targets includes two phone numbers of Rahul Gandhi [8], a member of the Indian Parliament and the former President of the Indian National Congress (INC) [9], who was unsuccessful in his election campaign against the incumbent Indian Prime Minister Narendra Modi in 2019. The Guardian noted [8] that the selection of Indian phone numbers coincided with Modi's 2017 visit to Israel that led to significant growth in the relationship between India and Israel. INC, the main opposition party in the Indian parliament, has accused [6] Modi of ‘treason’ and compromising the country's national security.
Also included on this list is the phone number of former bureaucrat Ashok Lavasa [10], who was an election commissioner in 2019. As commissioner, he argued for imposing sanctions on Modi for his heated political speeches, which were linked [8] to increased attacks on Indian Muslims.
Ashwini Vaishnaw [11], India's Minister of Railways, Communications and Electronics and Information Technology and Prahlad Singh Patel, the Minister of State for Jal Shakti (the water ministry), are two recently sworn-in ministers whose numbers have also been found [12] on the list. Incidentally, Vaishnaw's ministry oversees India's digital surveillance regulations.
What is Pegasus?
Pegasus [5] is a type of spyware — a software that allows users to secretly gather and receive data in someone's phone, computer or electronic device — made by Israeli tech firm NSO Group [13].
The Pegasus Project includes 80 journalists from 17 media organizations from 10 countries, with Paris-based media not-for-profit Forbidden Stories [14] coordinating and the human rights not-for-profit Amnesty International overseeing forensic tests. Siddharth Varadarajan and M.K. Venu, the two founding editors of the Wire [15], an independent Indian media organisation that is assisting in the investigations, both had devices infected with Pegasus [16]. One other editor from the Wire and three regular contributors also had their phone numbers on the list.
Amnesty's Security Lab produced a detailed technical report [17] after analyzing the leaked list. So far they have analysed 67 phones and found [18] traces of Pegasus in 37 of them. Citizen Lab, an interdisciplinary research lab based at the University of Toronto, Canada has independently reviewed and approved [19] Amnesty's forensic examination methods.
BREAKING: massive, global leak of the targets of NSO Group's Pegasus spyware. *huge deal.*
Forensic investigation by @AmnestyTech [20]
in collaboration with @FbdnStories [21] reporters.We @citizenlab [22] conducted peer review.
Here's an explainer THREAD.https://t.co/TasFCy5EGW [23] pic.twitter.com/rGGKAkfSry [24]
— John Scott-Railton (@jsrailton) July 18, 2021 [25]
While having a phone number on this list does not necessarily confirm that the phone has been infected with Pegasus, the users of these phones can theoretically be targetted by one of the NSO Group's clients. The Amnesty Security Lab has also published the Mobile Verification Toolkit [26] (MVT), an open-source mobile forensic tool to simplify the process of gathering and analysing data from potentially compromised Android and iOS devices.
The aftermath in India
Reporters Without Border calls India ‘one of the world’s most dangerous countries for journalists trying to do their job properly’, while placing the country's Press Freedom Index at 140 [27] out of 180 ranked countries. Journalists like Nitin Sethi cited conscious efforts to not report about the Pegasus Project in mainstream Indian media outlets.
Lesson for journalists: A controlled way to kill a story in the headline and by prioritizing down information in the main text. pic.twitter.com/YvXgEZuA19 [28]
— Nitin Sethi (@nit_set) July 20, 2021 [29]
The range of potential Pegasus victims is huge. It includes political activists who have been accused [30] of Maoist links who were arrested in 2018 to those who opposed [31] the National Register of Citizens (NRC) and Citizenship Amendment Act (CAA). Eight of the arrested activists were arrested based on evidence planted [32] on their devices before their arrests. Both CAA and NRC are controversial [33] for their alleged role in the probable displacement of more than 1.9 million residents — mostly minority Muslims — in the state of Assam.
Media outlets that are critical of Modi's ruling Bharatiya Janata Party are seeing a retaliation in the form of tax raids. The noted Hindi-language newspaper Dainik Bhaskar was raided [34] by tax officials on July 22. Dainik Bhaskar not only reported on Pegasus but has persistently questioned the government's choice to downplay COVID-19 related deaths.
Under Prime Minister Modi several critical media outlets have found themselves in tax investigators’ cross-hairs, raising fears about the health of the independent press in the world’s largest democracy. With @gerryshih [35] #DainikBhaskar [36] https://t.co/DJovrPBVta [37]
— Niha Masih (@NihaMasih) July 22, 2021 [38]
The Indian government has largely avoided addressing the issue, not confirming whether they purchased and or used Pegasus. An official response claimed [39] that the recent report is based on conjecture:
The allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.
Speaking in Rajya Sabha (the upper house of the Indian parliament), Vaishnaw termed [40] the media reports on the government's link to Pegasus a ‘sensational story’.
In the past, similar claims were made regarding the use of Pegasus on WhatsApp. Those reports had no factual basis and were categorically denied by all parties, including in the Supreme Court. pic.twitter.com/tDhNsLc8p0 [41]
— Ashwini Vaishnaw (@AshwiniVaishnaw) July 22, 2021 [42]
Journalist Barkha Dutta commented on the situation through Twitter:
I never thought I’d write the following : India’s IT Minister revealed to be on Pegasus list of surveillance targets on day he denied the charge of unauthorised surveillance.
— barkha dutt (@BDUTT) July 19, 2021 [43]
On July 22, 2021, public interest litigation was filed [44] in the Indian supreme court, seeking a court-monitored probe by a Special Investigation Team into the reports about Pegasus’ intrusion in India.
Hacking devices for surveillance remains illegal [45] in India. Other forms of interception and monitoring are permitted to authorised agencies via the Rule 419A of the Indian Telegraph Rules, 1951 [46], Section 92 in the 1973 Code of Criminal Procedure [47], Section 69 [48] and 69 B [49] in the 2000 Information Technology Act of the Indian Constitution.
However, as Indian lawyer and co-founder of tech and policy nonprofit the Centre for Internet and Society Pranesh Prakash highlights [50], there is no clarity about when these rules apply. The Center for Public Interest Litigation and Software Freedom Law Center in Delhi each filed a petition in December 2020 looking to stop several state-run surveillance agencies. But many forms of rampant surveillance continue [51] in India today. Indian society is currently grappling with the tensions between government surveillance and citizens’ right to privacy — a guaranteed constitutional right [52] under Article 21 of the Indian Constitution.