The Indian government, among several other, was found using Pegasus spyware for mass surveillance of journalists, politicians, human rights advocates, and activists.

An investigation into the Pegasus software was led by the French Forbidden Stories, in collaboration with over 80 journalists from 17 organizations, including  The Guardian, The Washington Post, Haaretz, Suddeutsche Zeitung, Amnesty International, and the OCCRP.

The investigation revealed that several governments from across the globe were using military-grade spyware to carry out surveillance over their citizens and political figures.

Remember the name: Pegasus

Pegasus is a type of malware developed by the Israeli-based NSO Group company. It was meant to carry out advanced surveillance over terrorist organizations and crime figures.

This sophisticated piece of malware embeds itself in Android and iOS devices and gains access to messaging apps, emails, photos, and GPS. The spyware can also activate the device’s microphone and camera remotely without the user knowing.

According to the developers, Pegasus was only made available to government bodies and was never marketed to the general public.

50,000 under surveillance

Amnesty Internation and Forbidden Stories managed to obtain a list of phone numbers that NSO clients have been targeting since 2016.

The original list did not contain names, but the journalists identified over a thousand people from fifty different countries who were potential targets. Those were company executives, human rights activists, politicians, government and military functionaries, as well as several country leaders and prime ministers.

The list also included the names of 189 journalists.

One of the targets was Cecilio Pineda Birto – a Mexican journalist. His name was added to NSO surveillance list a few weeks before his assassination in 2017.

In another case, the spyware seems to have been used to hack into the phones of two women, close to the Saudi Arabian journalist Jamal Khashoggi who was murdered in October 2018.

One of the attempted attacks happened 6 months before his assassination, and the other one – a few days after.

At the time, the United States government accused the Crown Prince of Saudi Arabia Mohammed bin Salman as the person behind the assassination. These claims were denied by Riyadh.

The Indian government was one of 10 clients of NSO

The investigation also identified 10 countries as clients of NSO Group. These include Azerbaijan, Bahrein, Hungary, Kazakhstan, Morocco, Mexico, the United Arab Emirates, Rwanda, Saudi Arabia, and India.

The country with the most surveillance requests is claimed to be Mexico (over 15,000 requests), followed by Morocco and the United Arab Emirates (over 10,000 requests each).

Indian government’s involvement

One of the surveillance targets in India is claimed to be Rahul Gandhi – Prime minister Narendra Modi‘s most prominent political rival. Two of his numbers were chosen as surveillance targets, as well as at least five phone numbers of his closest friends and allies.

Other Indian surveillance targets identified in the report were political strategist Prashant Kishor and two Union ministers – Ashwini Vaishnaw and Prahlad Patel.

The list doesn’t stop there, however. The Indian intelligence agencies and the government seem to have been using Pegasus to target dozens of politicians, activists, journalists, and government critics.

The government’s response

As of now, Hungary, Morocco, Rwanda, and India have denied any involvement with NSO Group or the use of the Pegasus software.

Indian officials had a particularly lengthy response, stating that any involvement of the government with the Pegasus software is false:

The allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.

The official statement went into further detail on how surveillance requests and procedures are carried out in India, concluding that:

The procedure, therefore, ensures that any interception, monitoring or decryption of any information through any computer resource is done as per due process of the law.

Hungary’s prime minister Viktor Orbán has stated that he has no information about any kind of unlawful intelligence gathering or surveillance spoken about in the investigation:

“Have you asked the same questions of the governments of the United States of America, the United Kingdom, Germany or France? In the case you have, how long did it take for them to reply and how did they respond? Was there any intelligence service to help you formulate the questions?” – The government’s response.

Officials in Israel have explained that they only allow access to and export of their IT products for terrorism and crime prevention. The Israeli government itself does not have access to any information that may have been gathered by NSO Group or its clients.

Other governments and officials involved in the scandal have also denied the claims, or have not yet made a statement.

NSO denies the accusations

The company behind Pegasus has responded to the investigation, denying any of the journalists’ claims:

NSO Group firmly denies false claims made in your report, many of which are uncorroborated theories that raise serious doubts about the reliability of your sources, as well as the basis of your story.

The Israeli company sees these accusations as unfounded. The company’s officials have stated that the investigation is based on a data leak that has nothing to do with the Pegasus software or NSO Group.

However, NSO is determined to carry out its own investigation and take immediate action if its software was in fact used in cases that violate human rights.

Activists demand tougher control over surveillance

Some of the world’s leading activists, politicians, and journalists have already called for a tightening of control over the use and distribution of surveillance systems.

The infamous employee of the National Security Agency, Edward Snowden, called for a ban of all kinds of surveillance systems. He also stated that the developers of Pegasus should be held accountable for the deaths and imprisonment of those targeted by the spyware.

The coming week's stories about the global hacking of phones identical to the one in your pocket, by for-profit companies, make it clear that export controls have failed as a means to regulate this industry.

Only a comprehensive moratorium on sales can remove the profit motive.

— Edward Snowden (@Snowden) July 18, 2021

UN Special Rapporteur (2014-2020), David Kay, proposed a worldwide moratorium on the circulation of advanced spyware and surveillance software.

what's the solution to an out-of-control #spyware industry? start with a global moratorium on sale/transfer & move toward this (from my report to @UN_HRC in 2019): https://t.co/WEgxIN7stx pic.twitter.com/1uOtpB9f8A

— David Kaye (@davidakaye) July 18, 2021

Will Cathcart, head of the messaging app Whatsapp, said that Pegasus is used to violate human rights, and those who use it should be held accountable immediately.

This groundbreaking reporting from @Guardian, @WashingtonPost, and many others demonstrates what we and others have been saying for years: NSO’s dangerous spyware is used to commit horrible human rights abuses all around the world and it must be stopped.https://t.co/dMD0wKjceF

— Will Cathcart (@wcathcart) July 18, 2021