Bhima Koregaon Case: Pegasus Spyware Used to Target Rona Wilson's iPhone, Says New Forensic Report

A new digital forensics report has revealed that Rona Wilson, a prisoners' rights activist and a Delhi-based academic, was subjected to "surveillance and incriminating document delivery for close to a year before his arrest on June 6, 2018," as reported by The Wire.

Wilson is among a group of 15 activists, lawyers and academics who have been arrested on alleged charges of 'Maoist' links in relation to the Bhima Koregaon violence case. The recent report comes from a Massachusetts-based digital forensics firm, Arsenal Consulting. The report concludes that "Wilson's phone, an Apple make, was not just selected for surveillance by a client of Israel's NSO Group but was also successfully compromised on many occasions."

The forensic firm, engaged by Wilson's defence lawyers to look into the electronic evidence submitted in the Elgar Parishad case, has said that it found "Pegasus indicators on the Windows volume of Wilson's computer in two iTunes backups from an iPhone 6S."

This revelation refutes public comments made by NSO Group in the past, reiterating on multiple occasions that Pegasus was sold only to "vetted governments". The Pegasus Project had earlier revealed that Wilson was among the initial targets of the software in India- attacked as early as mid-2017. The investigation found his number among the many rights activists potentially targeted using the software. The recent report confirms those findings as the timestamps associated with the Pegasus attacks span from July 5, 2017, to April 10, 2018.

"According to the Amnesty International article 'Forensic Methodology Report: How to catch NSO Group's Pegasus,' the indicators found by Arsenal reflect not only Pegasus attacks, but successful Pegasus 3 infection of Mr Wilson's iPhone 6s," Arsenal Consulting's report says.

An NSO Group's spokesperson said on the findings, "Without addressing specific countries and customers, the allegations raised in this inquiry are not clear. Once a democratic country lawfully, following due process, uses tools to investigate a person suspected in an attempt to overthrow a (democratically-elected) government, this would not be considered a misuse of such tools by any means."

In February this year, Arsenal Consulting had released a report highlighting that Wilson's laptop was infiltrated using malware, and at least 10 incrimination letters were deposited on his computer. The letters are all "a part of the chargesheet filed against Wilson and 15 others accused of spreading the banned "Maoist ideology" in the country. The chargesheet has termed the accused persons – all rights activists and lawyers from across different parts of the country – as "Urban Naxals". The investigation, first handled by the Pune police of Maharashtra, was handed over to the NIA in January 2020."