The Pegasus Spyware Scandal: Implications for Indian Journalists and Apple’s Warning

Introduction: A Clash of Interests

In late October, Apple’s unsettling warnings about state-sponsored cyber attacks on Indian journalists and opposition figures ignited a fierce controversy, setting the tech giant against Prime Minister Narendra Modi’s government. The subsequent investigation into device security escalated when Amnesty International revealed the presence of NSO Group‘s intrusive spyware, Pegasus, on the iPhones of prominent Indian journalists, adding credibility to Apple’s initial alerts.

Pegasus Unleashed: Journalists in the Crosshairs

Amnesty International‘s recent findings underscore a growing menace of unlawful surveillance faced by journalists in India, exposing a broader toolkit of repression that includes draconian laws, smear campaigns, harassment, and intimidation. The lack of accountability surrounding the use of Pegasus spyware intensifies concerns about human rights violations, prompting closed-door meetings and demands for alternative explanations from the Indian government.

Spyware’s Trail: Amnesty’s Forensic Analysis

Amnesty International’s forensic analysis unveiled that Anand Mangnale and Ravi Nair of the Organized Crime and Corruption Reporting Project (OCCRP) were targeted by Pegasus after investigating the financial dealings of Gautam Adani, the Adani Group’s founder. This report raises questions about the potential involvement of the Adani Group and the Indian government in hacking attempts against critics. Adani’s denial and counterclaims of a smear campaign add layers of complexity to the unfolding narrative. The OCCRP successfully appealed to the Indian Supreme Court to shield the journalists from potential arrest, but legal battles persist. In a surprising turn, Tushar Mehta, the Solicitor General of India, appeared as the lawyer arguing on behalf of the local police during their hearing on Dec. 1.

Business and Politics Collide: Apple’s Dilemma

Apple’s warnings posed a dilemma, caught between upholding user security and navigating the complexities of Indian politics. As Apple aims to expand its presence in India, the showdown highlighted the assertiveness of the Modi administration and its readiness to challenge even tech giants to protect its interests.

This episode is not the first time the Indian government has faced accusations of using spyware against critics. Previous instances, including findings by the Forbidden Stories consortium, exposed the presence of Pegasus and other spyware in the devices of journalists and political figures.

Global Controversy: Pegasus in the Spotlight

The Pegasus spyware, developed by the Israeli company NSO Group, has sparked global controversies. Nations worldwide have faced allegations of abusing the technology, raising ethical questions about the use of such powerful surveillance tools. NSO Group’s defense, emphasizing customer vetting for fighting terrorism and major crimes, clashes with evidence pointing to the targeting of journalists, lawyers, and human rights defenders. The international community, human rights organizations, and tech companies now face increasing pressure to address the misuse of spyware. Calls for transparency and accountability have grown louder as evidence mounts against governments and entities using Pegasus for purposes beyond its intended scope. Investigations by The Washington Post, in collaboration with Amnesty, contribute to the ongoing scrutiny.

Apple’s Role: Changing the Landscape

Apple’s warnings and subsequent investigations have fundamentally altered the landscape of spyware abuses. The alerts haven’t just exposed hacking activities but have led to the discovery of new hacking methods, empowering tech companies to enhance their defenses. Apple’s commitment to user safety, exemplified by features like Lockdown Mode, signifies a dedication to thwarting surveillance attempts. In 2018, researchers at the University of Toronto’s Citizen Lab found evidence suggesting NSO spyware servers embedded in Indian telecom networks. Two years later, Amnesty and Citizen Lab found that nine human rights advocates in India were targeted with commercial spyware on their Windows computers. Meta’s WhatsApp also sued NSO in 2019, alleging the exploitation of vulnerabilities in its chat software to hack around 1,400 individuals, including journalists and dissidents in India.

Amnesty revealed that individuals in India, such as Siddharth Varadarajan, co-founder of the digital media outlet The Wire, received warnings from Apple regarding hacking attempts using the Blastpass vulnerability. Varadarajan’s attempt failed due to timely fixes by Apple. The Modi administration’s response included pressuring Apple to retract the warnings, blaming an “algorithmic malfunction,” and suggesting the possibility of a “prank.”

Spyware Targets Sikh Separatists: iVerify’s Investigation

Apple found itself caught between upholding digital rights and protecting its business interests in India, a crucial market. The Modi administration, keen on fostering Apple’s presence in the country, was careful not to alienate the tech giant, resulting in a stalemate. Despite initial attempts by Apple India executives to provide the government with reasons to doubt the warnings, Apple ultimately stood firm, issuing no new statements after a meeting with Indian authorities in November. The company’s commitment to privacy and digital security remained a priority, aligning with its global stance against state-sponsored hacking, exemplified by the lawsuit against NSO.

In recent weeks, iVerify examined the phone belonging to Gurpatwant Singh Pannun, a Sikh separatist based in New York, who U.S. prosecutors claim was a target for assassination by an Indian official. iVerify engineers discovered severe crashes in Pannun’s encrypted messaging apps, potentially indicating hacking attempts, according to CEO Danny Rogers. Although the crashes weren’t conclusive proof, they raised concerns given other evidence suggesting Pannun had been targeted. In May, Pannun had a Telegram conversation with Hardeep Singh Nijjar, a Sikh separatist in Canada, who later denied using Telegram when questioned by Pannun. In June, Nijjar was fatally shot, with Canadian Prime Minister Justin Trudeau linking the killing to the Indian government in September.

Pannun disclosed that his phones had been hacked twice before. The U.S. State Department expressed general concern about the misuse of commercial spyware globally but did not directly address India’s alleged involvement. Reports indicate that Indian officials now acknowledge the legitimacy of Apple’s warnings about state-sponsored hacking but suspect Beijing as the culprit. However, China has not been publicly linked to the use of Pegasus, as Israeli defense ministry approval is required for all spyware sales.

Shifting the Power Balance

The Pegasus spyware scandal in India highlights the intricate challenges faced by tech giants operating in increasingly authoritarian regimes. Apple’s clash with the Indian government underscores the delicate balance between corporate interests and the protection of user rights. As the international community grapples with the ethical use of surveillance tools, the story of Pegasus in India serves as a stark reminder of the persistent threats faced by journalists and government critics in an era of increasing digital surveillance.

Donncha Ó Cearbhaill, who heads Amnesty International’s Security Lab, said in a statement that targeting journalists in the course of their work constitutes an illegal invasion of privacy, violating their fundamental right to freedom of expression. He asserted that all nations, including India, bear the responsibility of upholding human rights by safeguarding individuals from unauthorized surveillance.

Activists contend that press freedom in the world’s largest democracy has declined under Prime Minister Narendra Modi’s leadership. According to the World Press Freedom Index by Reporters Without Borders, India has plummeted 21 positions to 161 out of 180 countries since Modi assumed office in 2014.