At least two dozen lawyers, activists and journalists in India were contacted and alerted by WhatsApp that their phones had been under surveillance
Facebook-owned platform WhatsApp came out with a shocking revelation that said journalists and human rights activists in India have been a victim of surveillance by anonymous operators using Israeli spyware Pegasus.
The Pegasus functioning
To monitor a target, a Pegasus operator convinces a target to click on a specially crafted ‘exploit link’. It allows the operator to penetrate security features on the phone and installs Pegasus without the user’s knowledge or permission.
Once Pegasus is installed, it begins contacting the operator’s command and control servers to receive and execute operator commands and send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps.
The operator can even turn on the phone’s camera and microphone to capture activity in the phone’s vicinity. In the latest vulnerability, the subject of the lawsuit, click the ‘exploit link’ may also not be required and a missed video call on WhatsApp will have enabled opening up the phone, without a response from the target at all.
Allegation against Pegasus
WhatsApp has alleged that the company NSO Group and Q Cyber Technologies has violated US and California laws as well as WhatsApp’s terms of service which prohibit this type of abuse. It claimed that smartphones were penetrated through missed calls alone.
“We believe this attack targeted at least 100 members of civil society which is an unmistakable pattern of abuse. This number may grow higher as more victims come forward,” it said.
NSO defends
The NSO Group, in a statement, said: “In the strongest possible terms, we dispute today’s allegations and will vigorously fight them. Our technology is not designed or licensed for use against human rights activists and journalists.” After doubts about this technology were first raised in May, the NSO Group said it put in place a ‘Human Rights Policy’ on September 19 which “further embeds human rights protections throughout our business and governance systems”.
The NSO Group clearing the air said Pegasus has been sold only to government agencies. “We license our product only to vetted and legitimate government agencies,” it said.
Journalists being targetted
A Canada based cybersecurity group Citizen Lab said, “We found suspected NSO Pegasus infections associated with 33 of the 36 Pegasus operators we identified in 45 countries” including India. The 2018 report goes on to point to an India link active from June 2017 to September 2018. “We identified five operators that we believe are focusing on Asia. One operator, Ganges, used a politically themed domain”.
Arab human rights activists approached Citizen Lab who suspected that they were under surveillance.
Incidentally, the NSO Group terminated its agreement with Saudi Arabia following the killing of journalist Jamal Khashoggi and emergence of links suggesting its spyware played a role in the tracking of Khashoggi before he was killed in his country’s consulate in Istanbul.
Sources at WhatsApp said while messages going to and fro on their platform are encrypted and secure, the problem starts when malware compromises the device itself, making it very vulnerable to breach of privacy, often endangering freedoms and sometimes lives.
Also Read: Facebook services back online after worldwide outage
Who are the Victims?
Many of the Victims in India were from Chhattisgarh and they were informed by sharing a message to their cell phone about their surveillance. Sharing their experience victims said, Shubhranshu Choudhary, who works in Chhattisgarh as a peace activist, said he was also first informed by Citizen Lab that he had been a target of surveillance over WhatsApp.
When Citizen Lab contacted him, he asked, “How do I trust you?” After verifying Citizen Lab’s credentials, he took the group’s advice on beefing up his digital security, he said. Choudhary said Citizen Lab told him the Israeli spyware had been sold only to governments, which suggested that the Indian government had used it against him. “During my days as a BBC journalist, there used to be phone surveillance,” he said. “Now I have been working on the new peace process in Bastar. This might be connected to that”.
The Another one, Ashish Gupta an activist with the People’s Union for Democratic Rights who lives in Delhi, said he received a call from a “Canada-based NGO” a possible reference to the Citizen Lab about a month ago. “They said, ‘Do you know your mobile phone has been hacked?” I replied, “Yes, it is possible”.
Gupta recalled that in July, he was forcibly thrown out of several WhatsApp groups, even those for which he was the administrator. “I dismissed it then as a technical issue but now I’m wondering if this was connected to the surveillance,” he said.
Indian government seeks WhatsApp replay after this matter came into light. A detail and brief explanation have to be put in front of Government is the request until 4th November.
(With inputs collected from several media reports)
As an independent media platform, we do not take advertisements from governments and corporate houses. It is you, our readers, who have supported us on our journey to do honest and unbiased journalism. Please contribute, so that we can continue to do the same in future.
