In a startling revelation, Amnesty International, in collaboration with The Washington Post, has disclosed the continuous exploitation of Israel-based NSO Group’s Pegasus spyware against prominent Indian journalists. These incidents, with the most recent identified in October 2023, underscore suppression of free speech and assembly in India, profoundly impacting journalists, activists, and civil society organizations.
“Our latest findings show that increasingly, journalists in India face the threat of unlawful surveillance simply for doing their jobs, alongside other tools of repression including imprisonment under draconian laws, smear campaigns, harassment, and intimidation,” Donncha Ó Cearbhaill, Head of Amnesty International’s Security Lab said. “Despite repeated revelations, there has been a shameful lack of accountability about the use of Pegasus spyware in India which only intensifies the sense of impunity over these human rights violations,” he added.
In a blog on Thursday, Amnesty International’s Security Lab confirmed the targeting of Siddharth Varadarajan, Founding Editor of The Wire, and Anand Mangnale, South Asia Editor at The Organised Crime and Corruption Report Project (OCCRP), through the Pegasus spyware.
The Security Lab initially observed signs of renewed Pegasus threats in India around June 2023, following reports of the Indian government’s intent to acquire new commercial spyware. Subsequent to Apple’s global threat notifications to potential state-sponsored attack victims in October 2023, the Lab conducted forensic analyses on the phones of notified individuals, including Varadarajan and Mangnale. These analyses revealed traces of Pegasus activity on their devices.
Anand Mangnale’s phone displayed evidence of a zero-click exploit, a sophisticated type of attack requiring no user interaction, which occurred in August 2023. This exploit, part of the NSO Group’s BLASTPASS, was later patched by Apple. It remains unclear whether this attack led to a successful compromise of Mangnale’s device.
Amnesty International has previously documented Siddharth Varadarajan’s targeting with Pegasus in 2018, further investigated by a Supreme Court-appointed technical committee in 2021. However, the findings of this report are said to not been disclosed publicly, and the Indian authorities reportedly did not cooperate with the investigation.
In response to Amnesty International’s latest findings, NSO Group reiterated that its clients are vetted law enforcement and intelligence agencies, claiming mechanisms in place to prevent the targeting of journalists and human rights defenders. However, the Indian government has not clarified whether it has procured or used Pegasus spyware.
Meanwhile, Amnesty International has urged all countries, including India, to ban the use and export of highly invasive spyware like Pegasus. The organization also demands the immediate release of the Supreme Court Technical Committee Report on Pegasus use in India. It calls for an independent, transparent, and impartial investigation into all cases of targeted surveillance, alongside public disclosure of contracts with private surveillance companies, including NSO Group.
Pegasus, a highly sophisticated spyware developed by an Israeli technology firm NSO Group, is designed for surveillance and intelligence gathering, often used by government agencies. Pegasus has gained notoriety for its ability to infiltrate mobile devices and access a wide range of personal data, effectively invading the privacy of individuals. It can be covertly installed on smartphones without the user’s knowledge. Earlier versions required the target to click on a malicious link, but more advanced iterations, like the zero-click exploits, do not require any interaction from the target. Once installed, Pegasus can access messages, emails, photos, and contacts. It can also record calls, track the device’s location, and activate the microphone and camera for real-time surveillance.
