Who Deployed Pegasus Spyware? Decoding Govt’s Baffling Replies

In response to a question in Lok Sabha, Minister Ravi Shankar Prasad’s answer said that the NSO Group deployed it.

In the wake of the WhatsApp-Pegasus controversy, where the phones of at least 121 Indian citizens were found to have been affected by the spyware, the Centre has resisted from seeking an answer to one fundamental question - who did it?

(Photo: Aroop Mishra/ The Quint)

Video Editor: Purnendu Pritam
Cameraperson: Sumit Badola

Kya aap ke toothpaste mein namak hain? (Does your toothpaste contain salt?)
Kya aap ne kabhi online hotel book kiya hai? (Have you ever booked a hotel online?)

While these questions may or may not warrant an answer, one that does is – Kya aap ke smartphone mein spyware hai? (Does your smartphone contain spyware?)

In the wake of the Pegasus controversy, where the phones of at least 121 Indian citizens were found to have been affected by the spyware, the Centre has expressed concern and sought answers.

It, however, has resisted from seeking an answer to one fundamental question – who did it?

The brazen act of surveillance, that many cyber security experts have deemed illegal, has elicited responses from Minister for Electronics & IT Ravi Shankar Prasad on Twitter as well as in Parliament. Curiously enough, each response has carefully skirted any response to who may have been behind it.

But why is it so important to find out who bought the spyware and deployed it in the phones of Indian citizens?

Two important reasons:

1. The NSO Group, an Israeli company that developed the spyware, had told The Quint, and has consistently maintained, that it sells the license to its products only to governments and no one else.
2. Those who were targeted by the spyware are mostly human rights activists fighting for Dalit, Adivasi rights, anti-caste activists, lawyers engaged in the Bhima Koregaon case and journalists.

What Has the Govt Said So Far?

On 19 and 20 November, IT Minister Prasad and MoS in the Ministry of Home G Kishan Reddy, both responded separately to questions on the spyware by MPs Asaduddin Owaisi, Imtiyaz Jaleel and Dayanidhi Maran, respectively.

So, what all has the government said so far about the surveillance spyware?

1. We have asked WhatsApp to clarify: However, it was WhatsApp that notified the government and has also taken The NSO Group to court in the US for exploiting a vulnerability in the messaging app to deploy the software.

2.Section 69 of the Information Technology Act: If we wanted to, we could’ve deployed it because there are provisions in the law. Both, Prasad and Reddy, cited section 69 of the IT Act to justify the legality of such a brazen act of a brazen act of surveillance.

3. NSO Did It: Prasad’s written reply to Owaisi and Jaleel’s question had a rather bizarre allegation couched within it. While the reply appears to clearly say that the NSO Group deployed the spyware, it does not offer any justification or evidence for the same.

“According to WhatsApp, this spyware was developed by an Israel based company, NSO Group, and that it had developed and used Pegasus spyware to attempt to reach mobile phones of a possible number of 1400 users globally that includes 121 users from India,” Prasad’s reply stated.

4. We Are bringing a Data Protection Bill: The draft bill, which was handed over by the Justice Srikrishna Committee to IT Minister Prasad on 27 July 2018, has been roundly criticised precisely for not doing anything to usher in surveillance reforms by way of mandating judicial oversight.