Mumbai: Several Indian opposition leaders and journalists received notifications from Apple late on Monday or early on Tuesday warning them that their phones could have been targeted by “state-sponsored attackers”. The message read: “Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID.”
Following the alert, at least 20 people – including Congress leaders Shahi Tharoor and Supriya Shrinate, Trinamool Congress’s Mahua Moitra, Priyanka Chaturvedi of Shiv Sena (UBT), and Asaduddin Owaisi of AIMIM – said that they had received this alert.
While Apple’s alert doesn’t mention the nature of the attack, it warns iPhone users of possible theft of their data, and communication and also the possible compromise of their camera and microphone. The nature of this attack has an uncanny resemblance to the Pegasus military-grade spyware, developed by the Israeli cybersecurity company NSO Group. This spyware, which NSO claims is only used to target terrorist and organised crime groups, was allegedly misused against human rights defenders, politicians and journalists from as early as 2017.
In 2021, The Wire – in collaboration with 16 other media organisations – revealed the names of people, including many Indians, who were either persons of interest or were forensically identified as targets of clients of the NSO Group’s Pegasus spyware.
This investigation had prompted a three-judge bench of the Supreme Court, led by then Chief Justice of India (CJI) N.V. Ramana, to appoint an Expert Committee headed by Justice (Retired) R.V. Raveendran to look into the allegations in the Pegasus spyware case, “taking into account the public importance and the alleged scope and nature of the large-scale violation of the fundamental rights of the citizens of the country”. Interestingly, the government neither admitted nor denied the use of the malware. Finally, the committee, noting that the Union government did not cooperate with the panel, concluded that while there was a definite presence of malware on five handsets that it examined, there was “no conclusive evidence for the use of the NSO Group’s Pegasus spyware”.
Apple’s latest alert has once again kickstarted the conversation that had died down following the expert committee’s report and the subsequent Supreme Court’s order on August 25, 2022. But this is not the first alert where the government’s involvement has been explicitly alleged by a tech company. The language is identical to what the phone manufacturer has used on several occasions in the past to alert the victims of spyware around the world.
Additionally, both Yahoo and Google have sent similar alerts in past years. In November 2019, just a few days after the story about the use of the insidious spyware Pegasus in India broke, The Wire had first reported about a message sent out by Yahoo to a user about the attack by “government-backed actors”. In the message, Yahoo stated: “We believe your Yahoo account may have been the target of government-backed actors, which means that they could gain access to the information in your account.” Yahoo, however, had not clarified who this “government-backed actor” is or indeed what government they work for.
Similarly, Google too, that same year, had warned up to 500 India-based targets that they may have been the victims of a snooping attempt by “government-backed actors”.
A statement issued by Apple provided some clues about why tech companies do not provide additional information about the alleged attacks. “We are unable to provide information about what causes us to issue threat notifications, as that may help state-sponsored attackers adapt their behaviour to evade detection in the future,” the US tech company said.
When a tech company puts out an alert, it is also taking a huge risk of alienating its service users. Every time such an alert is sent out, leading to a public furore, the government has opted to stay silent, respond in vague terms or accuse those seeking an independent probe into allegations of misuse of malware as attempts to “malign Indian democracy”. As the government continues to refuse to come out with a clear denial that it does not allow the misuse of spyware, probable victims of data theft and snooping have no scope for resolution.
In light of the latest Apple alert, Union minister for electronics and IT Ashwini Vaishnaw was compelled to order a probe. “The government is concerned about this issue and it will get to the bottom of it. We have already ordered [an] investigation into it,” Vaishnaw noted.