Pegasus, the subversion of Indian Democracy

Pegasus, the subversion of Indian Democracy 

Suresh Kodoor

The explosive revelations by a consortium of news publications about citizens, including politicians, journalists, judges, activists, election commission and businessmen, being under illegal surveillance via a spyware called Pegasus is yet another eye-opener on how we are rapidly slipping into a banana surveillance republic. The enormity of the danger is not lost on anyone as the Indian democracy is staring down the barrel. Pegasus is the latest and most severe thus far in a series of attempts by this govt to subvert democracy. Pegasus symbolizes everything of a surveillance State and the tyranny spares none. Pegasus is not just a surveillance tool, but a cyber weapon unleashed on Indian democracy. None in their right minds would have even an iota of doubt on who did it. Just look at the target list and one would know who the beneficiary is and what the purpose of surveillance could be. This regime has clamped an undeclared emergency in the country where the institutions one after the other, the key pillars and watch guards of democracy, are being irrevocably destroyed forever. Pegasus no doubt is India’s Watergate, but the vast difference in responses tells a lot about how flimsy the Indian democracy yet is. No wonder the world has downgraded us as only ‘Partly Free’ and as a ‘Flawed Democracy’! The fall from being the ‘world’s largest democracy’ to a ‘flawed democracy’ has been sharp, rapid, dangerous and most disgraceful, especially under the current lot in power! The Pegasus snooping will only accelerate the degeneration with a devastating effect on democratic processes and institutions in our country. Pegasus spyware has been another weapon used by the govt to silence political opponents and others who dare to question those in power. It is very chilling to know that the surveillance software was used not only to track but even to plant fake digital evidences as found in the cases of the activists arrested in the elgar parishad case. Pegasus will be a litmus test for Indian Democracy as the response to it will decide whether we leave democracy to its demise or we want to defend it to the last drop.

What is Pegasus?

Pegasus is a spyware developed by an Israel Cyber intelligence and security firm called NSO Group. Pegasus enables the remote surveillance of mobile phones and makes the phone itself into a surveillance device. The Pegasus spyware is also known by names like Q-Suite and Trident. Pegasus is one of the most sophisticated among similar spyware products and it can infect both iOS and Android devices. Once infected, a phone becomes a digital spy under the attacker’s command and full control.

How it works?

WhatsApp had confirmed sometime in 2019 that some 1,400 of its users in 20 countries, including Indian journalists and activists, had been targeted by Pegasus in May that year. WhatsApp revealed that the spyware exploited its video calling system and a specific vulnerability called ‘zero-click zero-day’ to send malware to the mobile devices (WA fixed this vulnerability later).

Fake WhatsApp accounts are created and used for making video calls to the targeted phones. When the phone rings, the attacker would transmit the spyware to the device which would get auto-installed even if the user don't answer the call. The attacker will then take over the phone via Pegasus app, gaining access to the user's WhatsApp messages and calls (even the end-to-end encrypted calls and messages), regular live voice calls, text messages, passwords, contact lists, calendar events, location etc. The attacker can even control phone's microphone and the camera. The spyware can evade forensic analysis, anti-virus software etc. The attacker can even deactivate or remove the spyware completely whenever he wants (either because his mission is over or if he fears detection) without leaving any trace behind. It is designed to use very minimal bandwidth or charge so that the user never suspects anything unusual.

Earlier, at least until 2018, NSO Group employed methods relying on SMS and WhatsApp messages which will have fake or malicious links luring the users to open these links. Clicking on these links would lead to infection of their mobile devices. Such messages, in NSO’s parlance, are termed as ESEM Messages (Enhanced Social Engineering Messages) (eg. “Your IT returns rejected. Please check” or “You have won a prize. Confirm your mobile number clicking on the link”). When user clicks on a link contained in the ESEM messages, the device is connected to a server that will check the phone and install the malware. With people growing increasingly suspicious of such malicious links, NSO started employing new technologies called ‘network injections’. This method enables the attackers to install the spyware app without the target user doing any interactions (not clicking any links or accepting any calls). The Pegasus software gets installed through such zero-click installation on the devices. As per Pegasus’s brochure, all that is required is a target phone number for the ‘network injection’ and ‘the rest is done automatically by the system’. The spyware gets installed without anyone ever knowing. Once Pegasus gets installed, the infected phone is pretty much a ‘digital spy’ acting under the full control of the attacker.

What is Pegasus Project?

A Paris based non-profit journalism organization called ‘Forbidden Stories’ and the human-rights organization Amnesty International got access to a leaked list that contained tens of thousands of phone numbers across the world that were targeted by Pegasus Spyware. Forbidden Stories initiated and oversaw an investigation and Amnesty International’s Security Lab did all the forensic analyses and provided technology support for the probe (It is yet to be revealed who put the numbers on the list and why).

They shared the list after their investigation with a consortium of 17 media organizations world-wide that included ‘The Wire’ in India and the likes of ‘The Washington Post’, ‘The Guardian’ etc.

The consortium released the list on 19/Jul/21. The list contains 50,000 telephone numbers of people identified as potential targets for Pegasus during the period 2016 to 2021. Over 300 verified Indian phone numbers are in the list which included many Indian politicians (including Rahul Gandhi), activists (many of them currently in jail in the bhima koregaon/ershad parishad case, where the forensic analysis showed that materials were planted in their devices), business persons, journalists (mainly who are critical of the Modi government policies and governance). Ministers, election commissioner Mr.Ashok Lavasa (who has faulted the Prime Minister for election code violation), supreme court judges, former CBI chief, the women who complained against the former CJI for sexual harassment etc

Forensic test confirmation

While the presence of a number in the list does not necessarily mean it was hacked, investigators were able to confirm with forensic analysis that many phones were indeed hacked. A small sample of 37 phones, including 10 Indian phones, were subjected to forensic analysis by Amnesty International and found to show signs of Pegasus infection. None of these phones belonged to any criminals or terrorists, but they are all journalists, activists, businessmen or politicians. Independent verification done by Citizen Lab, a forensic lab setup at University of Toronto, has also confirmed Amnesty International's findings.

Democracy in danger

Such illegal and unconstitutional surveillance of political opponents and independent democratic institutions and custodians are nothing but subversion of democracy. NSO group's clients are all sovereign governments and are all autocracies such as Saudi Arabia or illiberal rightists governments like in Hungary. India finds herself in the list speaks volume about the state of democracy and citizen rights in our country. Right to privacy is a fundamental right of a citizen guaranteed by the constitution. Spying on citizens without their permission or even knowledge is illegal and govt is committing a cyber crime by doing so.

If even the constitutional institutions that are responsible for conducting free and fair elections are threatened through invasive surveillance, what hope do we have of protecting even the basic democratic rights of the citizens? If the political parties and leaders are spied on using Spywares by the govt in power (Rahul Gandhi’s phone was targeted between 2018 and mid-2019 during the Parliament election), even using it to topple elected state governments as seen in the case of Karnataka, what democracy are we talking about? Free media is the back-bone of a healthy democracy and if journalists who criticize govt are blackmailed and threatened and are spied on, such a system doesn't even deserve to be called 'democracy'!

An independent judiciary is the lifeblood of a democracy as it provides the most vital checks and balances. What is revealed now is that Pegasus has been used to spy on the women and her family who had raised sexual harassment complaint against the former CJI. It raises grave questions on whether the integrity of the CJI in question was compromised and whether the cases he presided over while being under suspicion, including cases like ayodhya,electoral bonds, Rafale and Kashmir, should be subjected to review.

Lack of response from the BJP govt on the Pegasus issue is appalling. While other countries are going for systematic enquiries, Indian govt is in strong denial and is hiding its head like an ostrich. Govt is charged with as serious a crime as political espionage and they are still not ready for even a discussion in the Parliament. Pegasus has clearly exposed the fault line in Indian democracy and it is becoming increasingly clear that India is rapidly degenerating into a full-fledged tyrannical dictatorship, especially since the current govt has assumed power.

- Suresh Kodoor 

sureshkodoor@gmail.com