QUESTION: During the last session the parliament was interrupted many times on Pegasus spyware questioning on the individual privacy. On the other hand, it seems to be a good weapon to fight against terrorists and anti-nationalists. Does it affect the citizens of India? What all are its consequences? – Raj Paul

ANSWER: Saji Mathew Kanayankal CST

Quite a few times, most of us have noticed the warning about CCTV surveillance and it became a necessity in many public places as well. But we have never bothered about it nor of its consequences. It was around last July that the news came out about illegal surveillance of many eminent politicians, journalists, activists and bureaucrats all over the world using a spyware, Pegasus. It was the result of a collaborative investigation of the French-based media non-profit organisation ‘Forbidden Stories’ with the technical support of Amnesty International in collaboration with many reputed news agencies like Washington Post, The Guardian, Le Monde, and The Wire. The report brought out the names of many reputed persons under surveillance. Among the long list, over three hundred were from India, including Rahul Gandhi, the former president of Congress, two cabinet ministers and their families, a non-compliant official of India’s election commission, a non-compliant senior intelligence officer, many dissident journalists, many business persons, and intellectuals and human right activists.

Pegasus- A Silent Attacker

Pegasus is a very powerful hacking spyware to be used in the smartphones developed and marketed by NSO, an Israeli organised firm. By a simple WhatsApp call to a target device, malicious Pegasus code could be installed on the phone, even if the target never answered the call. Its infections can be achieved through ‘zero click’ attacks, which means it does not require any interaction from the owner to operate the movement. It enables law enforcement and intelligence agencies to remotely and covertly extract data from any mobile device. Once infected, a phone becomes a digital spy under the attacker’s complete control and without any notification to the owner, Pegasus can harvest any information or extract any file. It can be a ‘good’ device to turn the phone into 24-hour surveillance. Pegasus can copy the messages, harvest the phone, or record the calls and function as a camera to bring one’s movement in the limelight. It can pinpoint the travels one made, the different persons one has come across, and the complete details of one’s whereabouts. The different activities on the phone like SMS messages, address books, call history, calendars, emails and internet browsing histories, all can be exfiltrated. The attacker can even control the microphone, and use the GPS function to track a target. As the highest form of technology in the software, it is almost impossible to detect and identify Pegasus infections and even the most security-conscious mobile phone user cannot prevent an attack. It is already confirmed that this spyware was used to snoop hundreds of individuals, including Indians.

Saving or Looting Life?

Though it is true that just being having the number list does not mean that the fellow was hacked, the investigation team has already confirmed that at least 37 smartphones of journalists and human right activists have been hacked. However, NSO Group, which created and leases the Pegasus spyware, has denied the existence of such a list. They denied any kind of wrongdoing with the product and claimed that the ‘global investigation’ is “full of wrong assumptions and uncorroborated theories.” For the company, it is a ‘vicious and slanderous campaign’ of certain media. The company asserts that they made the spyware to save the life. According to the company, the spyware is meant to fight against crime and terrorism and it sells its products legally, only to law authorities and to security agencies. It also meets international standards in the field of human rights. The national security or intelligence organisations had to act diligently for the basic security of their citizens. By using this technology, the life of thousands is being saved globally. Their dealing is only with the governments and the spyware is not sold to any private agencies! To clear its authenticity, the company also published its ‘transparency report.’ As it claims, the project was completely approved by the government of Israel. Once it is sold to the clients the company does not operate the system nor has access to the system or data of the client. In that case, the company exempts itself from any kind of malpractices and thus it does not have any responsibility for the wrongdoing.

However, the claim of the company is not conclusively without loopholes. Though we can partially agree with the intention of the company, and certain positive actions are taken in the use of its products, this is not an accurate portrayal of the situation. The authorisation of the Ministry of Defence of Israel does not guarantee due diligence before sales to entities known to violate human rights as per the stipulations of the international law. It also does not answer to some of the fundamental questions such as whether these individuals who were under surveillance were targets or potential targets of government or military agencies? Do they have made any precaution not to misuse the spyware for the self-interest of a person or group? Is there any criterion in selling such powerful spyware to autocratic regimes, especially in the context of silencing the voice of the dissents? Do they have foreseen the proposed danger to intrude into the privacy of an individual in its format? All the more, whatever be the purpose, is it ethical to bring one into the surveillance only because he or she is a ‘suspect’?

It is alarming that the names that appeared from India are mainly the opposition leaders and the critics of the central government. Here is the validity for the accusation against the central government. If the accusation is true, it is evident that the government has used this weapon against its citizens and institution. It is mere treason, an assault on privacy, human dignity and the value of our republic. As Pavan Duggal, Supreme Court lawyer and cyber law expert pointed out, the allegations must be investigated as privacy is a part of the fundamental right to life. If the ruling party or the government is used it as a weapon to harass the opponents, the credibility and moral integrity of it is seriously challenged. It also brings up a lot of questions concerning the individual freedom and privacy of each citizen which shadows the long-lasting political and cultural legacy of our country. Can one simply assume that the persons who oppose the ideology of the ruling regime as someone dangerous to the society?

Democracy in ICU

Individual privacy is a right protected by the constitution for the peaceful coexistence and growth of civil society. In a digitally guided world, mobile phones are a most intimate device to a person and they have become almost an extension of our brains and bodies. Most of the data are saved in mobile phones and illegal surveillance through mobile phones will create far-reaching consequences. More than intruding on the matters of the individual, the spyware can make changes in the device and the hacker can create any sort of files in the computer of the victims. It can also attack the entire social circle of the infected, their friends, families and colleagues at political, social and economic levels are also at risk. In the words of Agnes Callamard, the Secretary-General of Amnesty International, “not only does it expose the risk and harm to those individuals unlawfully targeted, but also the extremely destabilising consequences on global human rights and the security of the digital environment at large.”

The impact of the Pegasus controversy on the democratic fabric of our nation cannot be easily ignored. The collaboration between NSO and India has begun after the visit of Prime Minister Narendra Modi to Israel in 2017, which was celebrated by the Indian media with the title ‘Modi-Netanyahu romance.’ As Modi came back to power in 2019, the draconian anti-terrorism law, UAPA was expanded to include individuals and this law is widely misused to silence many human right activists and opponents of the central government. There are many incidents in attributing this law to different kinds of dissents like politicians, farmers, human right activists, intelligentsia, and thousands have been imprisoned under this law without bail.

As the list reveals, many human right activists, journalists and political leaders who are critics of the central governments seem to be under the surveillance. Among the list of political leaders, the phone numbers of some key political figures of Karnataka during the power struggle between BJP and JDS-Congress in 2019 are also seen. It is also argued that the activists who are jailed accusing the Bhima-Koregaon case are the victims of the planned conspiracy of the cooperate lobby and the government. Pegasus might have used as a powerful weapon to create shreds of evidence against them. The phone numbers of eight out of the sixteen Bhima-Koregaon accused, and the numbers of some of their close family members, have appeared on the leaked list. Since their phones are in police custody, it cannot be ascertained whether they are subjected to actual hack or any attack is made of them.

The Path towards Truth

As the report was out, within a few minutes, the government of India has responded that the allegations are false without any concrete basis. It states; “India is a robust democracy that is committed to ensuring the right to privacy to all citizens as a fundamental right. The Allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.” Though the Prime minster, remained aloof, leaving it to spokesmen to deny any link to Pegasus, union ministers, including Home Minister Amit Shah, have alleged that the release of the reports by the global media consortium was deliberately coordinated to coincide with the eve of the current session of the Indian parliament. He accuses; “this is a report by the disrupters for the obstructers. Disrupters are global organisations that do not like India to progress. Obstructers are political players in India who do not want India to progress.” For the IT and communication minister Ashwini Vaishnaw, the allegations are an attempt to malign the Indian democracy. As per the statement he made in the Parliament, with the help of various checks and balances, “any sort of illegal surveillance by unauthorised persons is not possible in India.” The Union Government has thus far rejected spying claims. For the ruling party, BJP the Pegasus story is “concocted, fabricated and evidence-less,” a product of ‘yellow journalism,’ and the list of mobile numbers are “fake.” As usual to any criticism, the party also sees this accusation as a conspiracy against national integrity! However, the central government has neither accepted nor denied the claims that it is a client of NSO Group. Moreover, the NSO Group, in a letter to Forbidden Stories has acknowledged the database, and said that many names listed there are not necessarily coming from Pegasus clients but are meant for “other purposes.” But the “other purposes” is not explained at all!

The government, snug in its parliamentary majority, has so far refused any debate on it in the Parliament and they are not courageous enough to face the different questions concerning the controversy. Though there were cases filed in the Supreme Court of India, seeking its direction on the protection of basic fundamental rights to privacy and free expression under Articles 14, 19 and 21 of the Constitution, the court is waiting for more evidence for the further steps. The court has already commented on the seriousness of the issue. The President-elect of the UN General Assembly, Abdulla Shahid said that the allegations are serious and the privacy of an individual is to be respected and any attempt to intrude into it is to be condemned. Amidst the controversy, the Israeli government has already opened an inquiry into the allegations and set an investigation committee to review the allegation of misuse of the NSO group’s surveillance software. The team has the mandate to investigate the whole matter in detail. France has instituted three enquiries, Hungarian prosecutors had opened a probe into allegations, and Mexico’s anti-corruption department started investigations. The Indian citizens are waiting for the intervention of the court!

Despite the denial of the central government, we have already sufficient signs of the extensive surveillance of the citizens of our county. But there is no clarity about the hacker as well as its nature. As a responsible democratic country, the central government has to facilitate an open discussion on the issue in the parliament and to conduct a free and fair investigation in the matter. Only a genuine probe, both at the national and global level, would reveal the true extent of use of Pegasus. If the government is clean, and have no involvement in this matter, why should they be being afraid of an enquiry? The well designed ‘national security’ is meaningless if there is no proper liberty and confidence to the citizens of the country. Such a credible and clear enquiry is mandatory to safeguard the core of democracy and human rights.