The Pegasus Project is an international media consortium that launched a collaborative investigation into spying on thousands of individuals across the world being done through the spyware developed and sold by the Israeli technology firm NSO Group.
Some facts:
• Who did the investigation? Multiple global media houses were involved. Media from 17 countries across the globe are part of the consortium, including some of the biggest media houses in the world – Washington Post, Le Monde etc.
• Scope of the investigation? Investigation was not India specific; it covered at least 45 countries. The most number of targets of the Pegasus spyware were from Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates (UAE).
• How many victims of snooping? 50,000 individuals in all globally have been identified as potential targets. This includes 1000 Indians, 300 of whom we know for sure through forensic evidence have been snooped on. This includes journalists, human rights defenders, civil society members, lawyers, diplomats (most of them based in New Delhi, including heads of diplomatic missions of Pakistan, China, Afghanistan, Iran, Saudi Arabia, Nepal). The Indian list includes 49 Indian journalists, 3 opposition leaders, 2 Union Ministers. The global list includes 3 Presidents, 10 Prime Ministers and 1 King.
What does Pegasus do?
• 24x7 surveillance: Allows remote and complete access to electronic devices (phones, laptops) – call records, messages, audio and video, all apps being used. All personal and intimate details of one’s life is laid bare to those controlling the spyware. In other words, the mobile phone purchased by an individual essentially allows entire private life to be accessed by someone else, with no consequences.
• Is planting of evidence possible? The Bhima Koregaon episode tells us that Pegasus can be used to plant evidence too (at least on laptops). We are not yet sure if Pegasus allows planting of evidence (say sending emails on behalf of the tracked person) on mobile phone. It does not look improbable, given the nature of the software.
• Who owns and develops Pegasus? It is sold by an Israeli tech firm, NSO. It is the sole product of the company.
• What is the role of governments? Pegasus is sold to a client only with the permission of the Israeli government’s Defense department and only to national governments and security agencies working under the aegis of national governments.
• Is this snooping Illegal? Surveillance can be done by governments under certain (very stringent) conditions. According to India’s Telegraph Act:
In the landmark PUCL [People’s Union for Civil Liberties] verdict of 1997, the Supreme Court set restrictions on the scope of the Indian Telegraph Act that permits phone taps. The concerned section S.5(2) of the Telegraph Act reads:
“ On the occurrence of any public emergency, or in the interest of public safety, the Central Government or a State Government or any Officer specially authorised in this behalf by the Central Govt. or a State Government may, if satisfied that it is necessary or expedient so to do in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of and offence, for reasons to be recorded in writing, by order, direct that any message clear of messages to or from any person or class of persons, relating to any particular subject, brought for transmission by or transmitted or received by any telegraph, shall not be transmitted, or shall be intercepted or detailed, or shall be disclosed to the Government making the order or an officer thereof mentioned in the order.”.
The PUCL verdict introduced a number of rigorous procedural safeguards, among them,
“1. An order for telephone-tapping in terms of Section 5(2) of the Act shall not be issued except by the Home Secretary, Government of India (Central Government) and Home Secretaries of the State Governments. In an urgent case the power may be delegated to an officer of the Home Department of the Government of India and the State Governments not below the rank of Joint Secretary. Copy of the order shall be sent to the Review Committee concerned within one week of the passing of the order.”
• What is the government saying? Essentially, denial, obfuscation and lying.
o Has the Modi government purchased the Pegasus spyware? The Government has not categorically admitted or denied that it has the Pegasus spyware. It is indulging in obfuscation and diversion (for example, saying that several other countries have been named so why target India and so on). An RTI reply to an request filed by Saket Gokhale says that the government, through the Integrated Finance Division, had indeed allocated a budget for purchase of Pegasus spyware.
o Is the snooping by the Modi government legal and authorized? Government says “no illegal, unauthorized snooping”. So does that mean the snooping is legal, and authorized by a government agency? Which one and why? Surveillance has to be okayed under Section 5(2) of Indian Telegraph Act,1885 and section 69 of the IT (Procedure and Safeguards for Interception, monitoring and Decryption of Information) Rules, 2009 by the Home Secretary of Union or State government, or authorities designated to do so by them. There is also an oversight mechanism in the form of a review committee headed by a Cabinet Secretary, which allows for adjudication process for those affected. So was this done? No clear answers as of now. The adjudication process has certainly not taken place.
o Official justification (or not) for the snooping: The spyware is supposed to be used only to detect and stop acts of terror. It is clear from the list of targets that ‘terror’ and ‘national’ security’ have nothing to do with the use of Pegasus. Rohini Singh, who was following up on scams related to Jay Shah, Amit Shah’s son, was tracked; women journalists covering the education and election commission, as well as the home ministry beats were tracked; the woman complainant who accused Ranjan Gogoi of sexual harassment and her entire family were put under surveillance after the complaint was filed; Ministers and leaders from the Karnataka Congress and JD(S) were tracked just when the BJP was trying to topple the coalition government in Karnataka; a sitting Election Commissioner known to have been tough on Narendra Modi and the BJP was put under surveillance; the CBI chief that the Modi regime ousted in a midnight coup was added to the list along with seven members of his family. Such snooping could potentially obtain information through any means possible on political opposition and dissenters; information that could then be used to blackmail individuals, sabotage opposition campaigns, sabotage institutions and democratic processes, and even steal elections.
o Lying: The government is also simply lying. We are being told for instance that WhatsApp denies any infiltration via Pegasus, whereas WhatsApp said exactly the opposite. It informed MeiTY in September 2019 that 121 Indians were targeted by Pegasus via its platform.
o Is this a global conspiracy to defame India? The government says this is a grand conspiracy to defame India. As mentioned earlier, this is an international effort conducting investigations across the globe. India is not a specific target.
o Is the timing of release of Project Pegasus suspicious? The government claims that the Pegasus report has been released only to derail the Monsoon session of the parliament. This does not make any sense, as multiple media outlets (from 17 countries) are involved. It is highly unlikely that that India’s parliamentary procedures would have figured in any decisions regarding date of release of the report.
o We Surrender Digital Privacy To Facebook, Google etc, So Why Object At Pegasus Hacking? This argument peddled by pro-Modi propagandists, is like saying, we wear swimsuits in swimming pools, so why object if our boss secretly peeps into our window to see us in our underwear? Companies like Facebook and Google nominally ask our permission to take our data; their collection of our data is impersonal (i.e it targets everyone, not a specific individual); and the data is used for commercial purposes (to track our consumption preferences for example). All this, while very objectionable, is still a far cry from the Government secretly hacking into the personal phones of specific individuals to spy on their every action, including their most private moments.
