Crime is terribly revealing,” says Agatha Christie. “Try and vary your methods as you will, your tastes, your habits, your attitude of mind, and your soul is revealed by your actions.
Last month, the Pegasus Project – an international media consortium of which The Wire is a part – detailed how world leaders, opposition politicians, journalists and human rights defenders around the world appear to have been targeted for surveillance by governments using the military-grade Israeli spyware known as Pegasus.
The actual and probable targets were spread across four continents but it is worth focussing on just two countries in order to contrast their official responses – and see what is revealed by their actions.
The French names published in Le Monde came in two categories: a short list of 13 individuals whose phones were found infected with, or targeted by, Pegasus. And a longer list of individuals whose phones could not be examined forensically but who were probable targets, given that their numbers were found on the same list as those whose phones were actually hacked.
The most prominent name in this larger category is Emmanuel Macron, president of France. Alongside him were more than a dozen cabinet ministers. The French targets were all apparently selected by an as yet unidentified Moroccan client of the Israeli spyware company, NSO Group.
In India, The Wire also had two categories. It found, initially, that 10 phones were either infected with Pegasus – including that of Prashant Kishor, political advisor to opposition leader Mamata Banerjee – or showed signs of an attempt having been made to infect them. Thanks to additional forensics, that number is now 13.
The second category of probable targets comprised around 300 verified numbers (out of more than 1,400), and included Congress leader Rahul Gandhi and seven of his aides and friends, two ministers in the Modi government, former election commissioner Ashok Lavasa, Supreme Court registrars, the former head of the Central Bureau of Investigation, and a young woman who had accused a sitting chief justice of the Supreme Court in 2019 of sexual harassment.
All of these numbers appear to have been selected by an unidentified client of NSO Group. The same client, incidentally, also selected the numbers of scores of foreign diplomats in Delhi and more than 800 Pakistani numbers. Since these were likely linked to espionage or counter-terrorism, The Wire chose not to investigate or report on them. But their presence in the same database as the Indian numbers is an important pointer to the country to which this unidentified client belongs.
France points finger at Israel, India bats for NSO
Now let us compare the Indian and French government’s responses to these revelations.
As soon as Macron’s name was flashed, France did not say, ‘Where is the proof?’ Instead, it immediately announced multiple investigations. The issue was a sensitive one because Morocco is a close strategic partner and Paris needs Rabat’s cooperation on the counter-terrorism front. Nevertheless, Macron telephoned Israeli Prime Minister Naftali Bennet to demand answers. Bennet set up a high-level committee to probe NSO’s actions and even “raided” the company. He also sent his defence minister to Paris to assure France that it would help to get to the bottom of the matter. ANNSI, the French national cybersecurity agency conducted a forensic evaluation of three journalists’ phones in the target list and confirmed the findings of the Pegasus Project: they were indeed infected with the spyware.
In other words, not only did the French government take the “unverified media reports” seriously but it acted independently to fix accountability and protect the interests of its citizens who had, or might have, been subjected to illegal surveillance.
In contrast, Ashwini Vaishnaw, India’s electronics and information technology minister, told parliament the “highly sensational” revelations were “an attempt to malign the Indian democracy and its well established institutions”. He then cited The Wire‘s own cautious claim about the leaked database to say that “the publisher of the report states that it cannot say if the numbers in the published list were under surveillance,” and added that “NSO has rubbished the claims in the report”.
Thought Vaishnaw’s ministry issued a separate unsigned statement in response to queries from the Pegasus Project in which it said, “The allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever,” the minister was careful not to provide a similar assurance to parliament. After all, statements made on the floor of the house have legal consequences.
Since the Modi government denied having anything to do with the list of names or the phones which were found infected, and Pegasus is sold only to sovereign entities, its reaction ought to have mirrored that of France – which was quick to announce a probe into the targeting of its nationals by a foreign power.
Unlike France, however, Prime Minister Modi did not pick up the phone to call up his Israeli counterpart. Far from seeking a probe into NSO and its clients, Modi’s minister actually quoted the Israeli company’s statement to “rubbish” the very revelations that have created a crisis for NSO and Israel in France. His government will not allow a debate in parliament on Pegasus and has done everything it can to avoid answering a basic question: Has any official agency in India acquired or used Pegasus?
Petitions before the Supreme Court
It is against this backdrop that the Supreme Court held an hour-long hearing last week on a clutch of petitions demanding answers from the government about the use of Pegasus spyware against journalists, opposition politicians, human rights defenders and others.
Among those who have moved the court are six individuals who appear in the leaked database of phone numbers accessed by the Pegasus Project. Two of the six – journalists Paranjoy Guha Thakurta and SNM Abdi – have forensic confirmation that Pegasus has infected their phones.
The bench, headed by Chief Justice of India N.V. Ramana, questioned the petitioners about the timing of their petitions, given that word had first emerged in 2019 of Pegasus being used against 121 persons in India. The judges also wanted to know what other evidence they had besides media reports, and why none of the alleged victims had so far filed an FIR, i.e. a criminal complaint, with the cyber wing of the police.
These are all valid questions, even if one would have assumed the answers are obvious.
The main reason the present petitions have been filed now rather than in 2019 is because some of the persons who have moved court discovered they had been targeted only after the Pegasus Project stories were published last month. Besides, unlike in 2019, the scale of the targeting and the proof of the use of Pegasus (via forensic tests) have made this surveillance a matter of urgent public interest.
As for evidence, besides media reports, at least two of the persons who have themselves approached the court have forensic reports prepared by Amnesty International’s tech lab which confirm the presence of Pegasus on their phones. In all, there are 13 such phones in India and more than 40 worldwide, including three smartphones in France that the French government has tested. Even before these phones were officially examined, France had gone ahead and announced a probe and demanded an explanation from Israel.
The chimera of an FIR
On the issue of FIRs, we need to remind ourselves that 19 individuals in India wrote to the government in November 2019 complaining about the use of Pegasus against them. This was after they had been informed by WhatsApp about the fact that their phones had been compromised. Their complaint does not even appear to have been acknowledged. Nor did the government, which had the power and the duty to order an investigation into phone hacking, show any interest in probing the matter.
When dozens of people fall sick because of taking spurious drugs, does the government wait for each of them to file an individual complaint in a police station? Or does the police immediately swing into action against the manufacturer? Yet, the official response to the hacking of 19 phones was remarkably laid back – and the reason for this is not hard to guess.
NSO Group, which makes Pegasus, has told a California court (where WhatsApp has filed a suit against it) that it only sells its spyware to governments. Given this undertaking, it is reasonable to assume the Pegasus targets in India have been selected by a government agency. Against this backdrop, and given the scale on which individuals in civil society appear to have been targeted, it is futile to imagine the ‘ordinary’ process of law can provide victims any answers, let alone justice.
Simply put, there is enough verifiable information, besides news reports, to indicate that what we are dealing with is the large-scale deployment of an illegal method of surveillance against individuals who cannot possibly be considered threats to national security or public order. There is
- the government’s 2019 acknowledgement in Parliament of WhatsApp’s letter informing it of 121 Indian Pegasus targets,
- the government’s refusal to say whether or not it has bought and used Pegasus,
- the Pegasus Project’s forensic results, and
- the French government’s own forensic tests,
- NSO Group’s decision to “suspend” Pegasus operations following the reports of abuse, in some countries pending inquiry.
What the petitioners before the Supreme Court are contending is that there has been a systematic violation of fundamental rights by an official agency over a long period of time. In fact, the forensic examination of the phones of Prashant Kishor and journalists M.K. Venu and Sushant Singh showed that Pegasus has been used against them as recently as June and July 2021. Which is why the Supreme Court has said the charge are serious and the truth must come out.
Any legitimate national security concerns the government has can easily be excluded from the judicial inquiry the petitioners seek. But no democracy or society governed by the rule of law can countenance the use by a government of intrusive surveillance against political opponents, journalists, lawyers, court officials, rights activists, victims of sexual harassment and others. That too, to generate private political benefits using spyware paid for out of public funds. The name for that is not ‘defending national security’. It is corruption, plain and simple.
The Pegasus Project is a collaborative investigation that involves more than 80 journalists from 17 news organisations in 10 countries coordinated by Forbidden Stories with the technical support of Amnesty International’s Security Lab. Read all our coverage here.
