Spyware: New Weapon Against Democracy

The chorus is getting louder now. It is increasingly clear that for the powers-that-be, just innuendos, a hunt for international conspiracies or even local distractions is not enough. The use of spyware, evidently by ruling dispensations, in various countries against journalists, activists and politicians is the next level of oppression that regimes favour.

India is now bracketed with Saudi Arabia, Hungary, Kazakhstan, Rwanda and other places where allegations of the use of government might for wrong reasons are rampant and there are no attempts to probe wrongdoings. Due to its claims of being the world's largest democracy and a Vishwa Guru in the making, India will be carefully watched by the world.

There is no longer a conspiracy of silence in the mainstream media, as when shocking exposes were made in the Bhima-Koregaon case. There was hardly a flutter in the media after it turned out that spyware was allegedly used to plant incriminating documents on the computers of activists, scholars, poets, and others lodged in prison under draconian laws.

A Massachusetts-based digital forensics firm, Arsenal Consulting, had shared its analysis of the forensic images of the digital devices of Rona Wilson, one of the accused in the Bhima-Koregaon case, that says a cyber attacker had gained access to his computer and planted the files, which became a basis for this arrest.

Less than five months later, in July, another expose by the same firm has revealed that the electronic device of one more accused in the case—well-known human rights activist and advocate Surendra Gadling—was also infected. This revelation, too, was immediately forgotten by the media.

All of us are vulnerable to such spyware attacks on our electronic devices. This means individual liberty and privacy are at risk like never before. An attack can land an individual in jail, force them to face a trial for criminal or terrorist activities, and stigmatise them for life. Yet the news of those hackings did not generate anger.

The high-profile killing of a Saudi Arabian journalist, a critic of the establishment, Jamal Khashoggi, inside the Saudi consulate in Istanbul two years ago also had a spyware connection.

The Citizen Lab at the University of Toronto, which has researched surveillance techniques and spyware for years, has found dozens of journalists, human rights activists and others stand compromised around the world. Even then, when it came to the instances of spying and planting malware discovered in India, there was a conspiracy of silence. That is, until the Pegasus Project, things will not be the same again.

The new exposures in this case which involved a joint operation of more than 80 journalists from 17 media organisations in ten countries, who, coordinated by a non-profit, Forbidden Stories, and with technical support of Amnesty International, conducted forensic tests on mobile phones to identify traces of spyware, have shaken the powers-that-be the world over.

Fourteen world leaders are on the leaked database, including French President Emmanuel Macron, the President of South Africa Cyril Ramaphosa, the Prime Minister of Pakistan Imran Khan, and India's Congress party leader Rahul Gandhi and his close associates were found on the leaked database accessed by the Pegasus project.

The numbers of the Dalai Lama’s key advisers and prominent Buddhist clergy are also on what has come to be known as the Pegasus snoop list, along with the National Socialist Council of Nagalim leaders. This last is especially odd, as they are engaged in ongoing negotiations with the government.

Complex legal questions have also arisen in this case which involves outsourcing of surveillance to private entities. It is the claim of the NSO Group—which operates from Israel and is said to have close connections with the ruling dispensation there—that it only provides access to Pegasus, its software, to “vetted governments”. The right to surveillance, though only in exceptional circumstances, is considered a right of the State, so the question arises, how can a private entity be involved in this case, that too, from a foreign country. The ramifications of this expose involving a private firm that develops spyware, are yet to be fully fathomed. A report published in Israel’s Haaretz last week, helps understand some of the connections between the spyware developer and the Israeli state. The Israeli government, under tremendous international pressure, has ordered an enquiry into allegations that the Pegasus spyware was misused by customers to target journalists and human rights activists. It will also examine whether the rules regarding the export of such cyber weapons need to be tighter.

It is no good to expect much from any such enquiry because the NSO is not the only manufacturer of “smart” spyware in Israel. Quite a few others are engaged in developing dangerous digital weapons for sale around the world. This “dark side” of Israeli high-tech has been known for a while. Further, at least 500 private companies all over the world operate, largely unregulated, in the market for intrusive software. Much of this winds up with oppressive regimes that spy on and harass their critics.

The Indian government has neither confirmed nor rejected the charge that it used the Pegasus software (despite the indication that it may well have). The NSO has repeatedly said that it sells the software only to countries to fight “crime and terrorism”. Secondly, Pegasus is classified as a cyber-weapon and any such export has to be approved by the Israeli Defence Ministry. The activities of Pegasus spyware on smartphones here were first noted in 2017, the same year Prime Minister Narendra Modi visited Israel officially. The world media had reported then that the then Israeli Prime Minister, Benjamin Netanyahu, had granted NSO an export licence to sell software to countries that use it to suppress dissent.

To say, against the background of such developments, that a conspiracy is at work to defame India is too glib an argument. As reported, many countries affected by these revelations, where the numbers of citizens are on the Pegasus “snoop list”, have ordered enquiries or are contemplating action. France ordered multiple enquiries when Macron and his cabinet associates appeared in the leaked database. The Indian government should do the same. It is the only way to discover who ordered the snooping or marked (at least the non-criminals) as persons of interest. If not the government or any of its agencies, then it becomes even more urgent to understand the alleged “international conspiracy” at play. It would be naive to presuppose that international actors are interested in the movements of the relatives and friends of the woman who alleged sexual harassment against the former Chief Justice of India, to cite just one of the multiple instances. It also defies the imagination that international actors are interested in monitoring the activities of a journalist in Jharkhand who had been writing about violence on tribals by security forces and of his wife and sister-in-law. The journalist has decided to approach the Supreme Court for alleged breach of privacy.

The demand for an enquiry is being raised by Opposition politicians, journalists, activists and other concerned citizens. Several press bodies have said, “It is for the first time in the history of this country that all pillars of our democracy—judiciary, parliamentarians, media, executives and ministers—have been spied upon, which is unprecedented and need to be condemned unequivocally.”

There is also a proposal to probe the affair by a Special Investigative Team monitored by the Supreme Court to look into this operation. There are calls to form a Joint Parliamentary Committee or JPC and the Standing Committee on Information Technology, chaired by Congress MP Shashi Tharoor has called representatives of the Ministry of Electronics and Information Technology, Ministry of Home Affairs and Department of Telecommunications on 28 July to discuss citizens’ data security and privacy. According to Tharoor, there was no need to set up a JPC since the standing committee follows the same rules.

Perhaps the Supreme Court will take up this case suo moto, for it involves a violation of the right to privacy of many Indian citizens. The spyware no less than puts citizens’ lives in danger. In the last seven years, democracy has deteriorated in India and South Asia as a whole. Concerns that India is being reduced to an electoral democracy are quite valid in the light of the fresh revelations from the Pegasus Project. The ruling dispensation seems to be accelerating, not decelerating, India's slide on global measurements of democracy. It is for all those concerned with democracy to gather their voices and stall a further fall.

The author is an independent journalist. The views are personal.