Pegasus Hacking Scandal: Modi Government Must Face Independent Investigation

The Modi Government’s use of Israeli “Pegasus” spyware technology to secretly and illegally hack into and take control of the phones of thousands of Opposition leaders, journalists, Supreme Court judges, activists and other Indian citizens is by far the biggest criminal act by a Government in 75 years of independent India.

Investigations by the Paris-based non-profit ‘Forbidden Stories’ as well as Amnesty International have been verified and simultaneously published by reputed media organisations around the world. These investigations establish that the Israeli firm NSO sells Pegasus software only to governments, ostensibly for “national security” and “counter-terrorism” purposes. Pegasus can be used to hack into smartphones remotely, and then gain control over those smartphones, without the knowledge of the target. Media organisations conducted forensic analysis of phones belonging to those whose numbers figured on the list of targeted numbers. This forensic analysis has conclusively established that not only was Pegasus used in 2017-18 to target Opposition leaders, journalists, judges, lawyers, activists of student movements, workers movements, human rights defenders and other individuals – Pegasus continues to be active on the current phone sets of several of those targets.

The targets include leader of the Opposition Rahul Gandhi and his closest aides; Trinamool Congress leader Mamata Banerjee’s nephew Abhishek Banerjee; election strategist Prashant Kishore; Congress and JD(S) leaders in Karnataka; a sitting Supreme Court judge; a large number of journalists (editors as well as reporters); and a large number of activists.

Pegasus has been found active on Prashant Kishore’s phone currently, which indicates that he was a target for hacking during the recent West Bengal elections in which he was the election strategist for the BJP’s rival Trinamool Congress. The numbers of key Congress and JD(S) leaders of Karnataka were reportedly added to the list of targets just prior to collapse of the Congress-JD(S) coalition government, paving the way for the BJP to capture power. Here, the question arises – was the Modi government using Pegasus technology purchased at a steep cost to the taxpayers, to target its political rivals to benefit the ruling BJP party? If so there can be no greater instance of political corruption.

The most shocking and blatant act of criminality is the inclusion of the Supreme Court staffer who accused Chief Justice Ranjan Gogoi of sexual harassment, and 11 of her family members in the list. Phones belonging to members of this particular family were selected for targeting days after one of them filed a sexual harassment complaint against CJI Gogoi. This raises the question: was the government of India hacking into the phones of a sexual harassment complainant and her family members in order to be able to stalk and intimidate them as well as snoop on their legal strategy? Was this done to protect the accused Chief Justice of India Ranjan Gogoi – and if so was any deal struck with the CJI in exchange? What was the impact of these actions on crucial Supreme Court judgments in which the Government had a special interest?   

In its defence the Modi Government says that the UPA tapped phones too. But there is a legal infrastructure governing phone taps: phones can be tapped by the government in exceptional circumstances relating to national security, but only with a range of checks and balances which ensure that the order permitting the phone taps are sent to a Review Committee within a week. If the UPA violated these rules in its tenure, why has the Modi regime not pursued those cases and punished the offenders? Pegasus is used to hack phones, not tap them – and hacking is a criminal offence in India.  

The Modi Government further says there is no proof linking Pegasus to the BJP or its government; however, it has not categorically denied purchasing and deploying Pegasus. NSO says that it sells only to governments. But if some non-government entity purchased and used Pegasus against Indian citizens, why is the Modi Government not interested in identifying and punishing this entity? Why is it not interested in protecting Indian citizens from such an entity? Why is it treating the Pegasus revelations as a non-issue?

According to 2016 estimates, the NSO’s charge for spying on just 10 people using Pegasus was around Rs 9 crore. The recent revelations show that Pegasus was used to hack into some 1500 phones in India in 2017-18. Presumably this number only increased in the years since 2018 till the present. Have Indian taxpayers (suffering demonetisation; joblessness; rises in food and fuel prices; and lockdowns) been footing the bill for this massive crime? How has this expense been disguised in the accounts? How was the Comptroller and Auditor General (CAG) office prevented from noticing such a massive expense?     

A Government which hacked into phones of judges, journalists, Opposition leaders and activists could potentially stalk and blackmail these individuals or threaten their lives to silence them or to extract favours from them. It could plant evidence on their phones in order to frame them: as in the Bhima Koregaon case where Pegasus was used to target the accused. It could keep track of the strategies of Opposition politicians; and use knowledge obtained through hacking to topple Opposition governments and buy Opposition MLAs. It could be pre-warned of every journalistic investigation, so that it could destroy evidence in advance.

In other words, the list of targets indicates that Pegasus was used, not for any purpose of governance or national security, but simply to serve the private interests of the ruling party or some of its leaders. In the USA’s Watergate episode, President Nixon was forced to resign for planting bugs to listen in on a Convention of the opposition party. The use of Pegasus in India is a crime of far greater proportions than Watergate – and demands investigation and punishment.

Did the Modi regime purchase Pegasus during Prime Minister Modi’s visit to Israel in 2017? Did it deploy Pegasus to try and control every branch of India’s democracy: the political Opposition; the judiciary; the press; and civil society? Why does the Government not tell the people: did they, or did they not, purchase and deploy Pegasus? If they did not, who did? Indian citizens deserve answers to these questions.

If the Government hacked our phones, it is an attack on the Constitution and the rights of Indian citizens. If some other force hacked our phones, then it is truly a threat to national security and the security of India’s citizens. The fact that an Israeli company has access to thousands of India’s citizens including journalists and judges, is in any case a serious breach of national security.  

An independent tribunal must be empowered to seek time-bound answers from the Modi government and its functionaries at every level, so as to ensure that those responsible for the criminal use of Pegasus are identified and prosecuted.

​

Understanding the Pegasus Project

The Pegasus Project is an international media consortium that launched a collaborative investigation into spying on thousands of individuals across the world being done through the spyware developed and sold by the Israeli technology firm NSO Group.

Some facts:

• Who did the investigation? Multiple global media houses were involved. Media from 17 countries across the globe are part of the consortium, including some of the biggest media houses in the world – Washington Post, Le Monde etc.  


• Scope of the investigation? Investigation was not India specific; it covered at least 45 countries. The most number of targets of the Pegasus spyware were from Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates (UAE).


• How many victims of snooping? 50,000 individuals in all globally have been identified as potential targets. This includes 1000 Indians, 300 of whom we know for sure through forensic evidence have been snooped on. This includes journalists, human rights defenders, civil society members, lawyers, diplomats (most of them based in New Delhi, including heads of diplomatic missions of Pakistan, China, Afghanistan, Iran, Saudi Arabia, Nepal). The Indian list includes 49 Indian journalists, 3 opposition leaders, 2 Union Ministers. The global list includes 3 Presidents, 10 Prime Ministers and 1 King.

What does Pegasus do?

• 24x7 surveillance: Allows remote and complete access to electronic devices (phones, laptops) – call records, messages, audio and video, all apps being used. All personal and intimate details of one’s life is laid bare to those controlling the spyware. In other words, the mobile phone purchased by an individual essentially allows entire private life to be accessed by someone else, with no consequences.


• Is planting of evidence possible? The Bhima Koregaon episode tells us that Pegasus can be used to plant evidence too (at least on laptops). We are not yet sure if Pegasus allows planting of evidence (say sending emails on behalf of the tracked person) on mobile phone. It does not look improbable, given the nature of the software.   


• Who owns and develops Pegasus? It is sold by an Israeli tech firm, NSO. It is the sole product of the company.


• What is the role of governments? Pegasus is sold to a client only with the permission of the Israeli government’s Defense department and only to national governments and security agencies working under the aegis of national governments.


• Is this snooping Illegal? Surveillance can be done by governments under certain (very stringent) conditions. According to India’s Telegraph Act:

In the landmark PUCL [People’s Union for Civil Liberties] verdict of 1997, the Supreme Court set restrictions on the scope of the Indian Telegraph Act that permits phone taps. The concerned section S.5(2) of the Telegraph Act reads:

“ On the occurrence of any public emergency, or in the interest of public safety, the Central Government or a State Government or any Officer specially authorised in this behalf by the Central Govt. or a State Government may, if satisfied that it is necessary or expedient so to do in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of and offence, for reasons to be recorded in writing, by order, direct that any message clear of messages to or from any person or class of persons, relating to any particular subject, brought for transmission by or transmitted or received by any telegraph, shall not be transmitted, or shall be intercepted or detailed, or shall be disclosed to the Government making the order or an officer thereof mentioned in the order.”.

The PUCL verdict introduced a number of rigorous procedural safeguards, among them,

“1. An order for telephone-tapping in terms of Section 5(2) of the Act shall not be issued except by the Home Secretary, Government of India (Central Government) and Home Secretaries of the State Governments. In an urgent case the power may be delegated to an officer of the Home Department of the Government of India and the State Governments not below the rank of Joint Secretary. Copy of the order shall be sent to the Review Committee concerned within one week of the passing of the order.”

* What is the government saying? Essentially, denial, obfuscation and lying.

• Has the Modi government purchased the Pegasus spyware? The Government has not categorically admitted or denied that it has the Pegasus spyware. It is indulging in obfuscation and diversion (for example, saying that several other countries have been named so why target India and so on). An RTI reply to an request filed by Saket Gokhale says that the government, through the Integrated Finance Division, had indeed allocated a budget for purchase of Pegasus spyware.


• Is the snooping by the Modi government legal and authorized? Government says “no illegal, unauthorized snooping”. So does that mean the snooping is legal, and authorized by a government agency? Which one and why? Surveillance has to be okayed under Section 5(2) of Indian Telegraph Act,1885 and section 69 of the IT (Procedure and Safeguards for Interception, monitoring and Decryption of Information) Rules, 2009 by the Home Secretary of Union or State government, or authorities designated to do so by them. There is also an oversight mechanism in the form of a review committee headed by a Cabinet Secretary, which allows for adjudication process for those affected. So was this done? No clear answers as of now. The adjudication process has certainly not taken place.  


• Official justification (or not) for the snooping: The spyware is supposed to be used only to detect and stop acts of terror. It is clear from the list of targets that ‘terror’ and ‘national’ security’ have nothing to do with the use of Pegasus. Rohini Singh, who was following up on scams related to Jay Shah, Amit Shah’s son, was tracked; women journalists covering the education and election commission, as well as the home ministry beats were tracked; the woman complainant who accused Ranjan Gogoi of sexual harassment and her entire family were put under surveillance after the complaint was filed; Ministers and leaders from the Karnataka Congress and JD(S) were tracked just when the BJP was trying to topple the coalition government in Karnataka; a sitting Election Commissioner known to have been tough on Narendra Modi and the BJP was put under surveillance; the CBI chief that the Modi regime ousted in a midnight coup was added to the list along with seven members of his family. Such snooping could potentially obtain information through any means possible on political opposition and dissenters; information that could then be used to blackmail individuals, sabotage opposition campaigns, sabotage institutions and democratic processes, and even steal elections.  


• Lying: The government is also simply lying. We are being told for instance that WhatsApp denies any infiltration via Pegasus, whereas WhatsApp said exactly the opposite. It informed MeiTY in September 2019 that 121 Indians were targeted by Pegasus via its platform.


• Is this a global conspiracy to defame India? The government says this is a grand conspiracy to defame India. As mentioned earlier, this is an international effort conducting investigations across the globe. India is not a specific target.


• Is the timing of release of Project Pegasus suspicious? The government claims that the Pegasus report has been released only to derail the Monsoon session of the parliament. This does not make any sense, as multiple media outlets (from 17 countries) are involved. It is highly unlikely that that India’s parliamentary procedures would have figured in any decisions regarding date of release of the report.


• We Surrender Digital Privacy To Facebook, Google etc, So Why Object At Pegasus Hacking? This argument peddled by pro-Modi propagandists, is like saying, we wear swimsuits in swimming pools, so why object if our boss secretly peeps into our window to see us in our underwear? Companies like Facebook and Google nominally ask our permission to take our data; their collection of our data is impersonal (i.e it targets everyone, not a specific individual); and the data is used for commercial purposes (to track our consumption preferences for example). All this, while very objectionable, is still a far cry from the Government secretly hacking into the personal phones of specific individuals to spy on their every action, including their most private moments.

​

CPIML Statement On Pegasus Spying Scandal

It has taken a collective global effort (called the “Pegasus Project”) by human rights organisations and journalists to expose the dubious use of Israeli Pegasus phone-hacking software in at least ten countries including India. These painstaking investigations including independent forensic analysis of phones pose very disturbing questions for democracy in India. It stands established that at least a 1000 Indian phone numbers (belonging to prominent leaders of Opposition, an Opposition election strategist, a large number of editors and reporters, a sitting Supreme Court judge, an Election Commissioner, a range of human rights defenders and activists, as well as a woman who complained of sexual harassment by a Supreme Court Chief Justice, and members of her family) figured on a 2017-18 list of potential Pegasus targets. Forensic analysis of a number of phones belonging to the potential targets has established that several were successfully infiltrated by Pegasus, and Pegasus has been found active this very month on the phone of at least one target – Opposition election strategist Prashant Kishor.

The Israeli company NSO states that it only sells to governments. So either the Government of India, or some foreign government, bought Pegasus (rates of which amount to at least Rs 1.5 crore per phone) to use the personal phones of journalists, judges, and activists to spy on every aspect of their lives, including their most private moments. Such a use of Pegasus is clearly nothing to do with “national security”; it is nothing but politically motivated espionage targeting critics of the ruling party. Information gathered thus can be used to blackmail, control, fabricate evidence against and falsely implicate the targeted individuals, thus undermining the key pillars of democracy: the free press, the judiciary, and an alert and active citizenry.

The Government of India’s bluster in response to these revelations indicates that it has something to hide. It dismisses the Pegasus Project revelations as a “conspiracy to defame India”, and at the same time denies any wrongdoing on its part. If indeed the Government did not buy and use Pegasus to hack phones, then why does it feel “defamed” by the revelations? Why is it not interested in investigating which forces in fact did purchase and use Pegasus to target Indian citizens? Surely, if a foreign power is spying on Indian citizens and meddling in Indian Parliamentary and Assembly elections, and if an Israeli company possesses the private data of Indians in sensitive positions, it is a serious breach of national security? Why is the Government unconcerned about investigating such a breach, and identifying the offenders?   

The Government also claims that any surveillance done by it is in keeping with the provisions of Indian laws. Existing Indian laws do allow for phone taps – in exceptional cases where there is a clear threat to public safety – as long as the orders to tap are reviewed by a panel within a week. Pegasus does not tap phones – it hacks them, and hacking is illegal in India. The Government must come clean and tell the Indian public: did it purchase Pegasus or not? Who authorised the purchase, and who footed the bill? Who selected the targets? Was there any panel reviewing such spying and seeking a justification for the selection of each target? Was a woman complainant who accused CJI Gogoi of sexual harassment, along with ten of her family members, targeted using Pegasus? Is there any record of the findings of such surveillance? In whose custody are such records stored?

We demand the immediate resignation of the Home Minister Amit Shah, as the first step towards an independent investigation, that is empowered to seek time-bound answers from the Modi government and its functionaries at every level, to identify those responsible for the criminal use of Pegasus.