Pegasus: Phones of 40 journalists from Indian Express, Hindu, HT & Wire tapped, says report

India is among the countries that used Israeli company NSO Group's Pegasus phone hacking software to potentially target politicians, journalists and activists, an international collaborative investigation involving 17 media organisations including The Guardian, The Washington Post, and Die Zeit said. India's news website The Wire was one of the 17.

The first part of the multi-part investigation, released late on Sunday night, said that 38 Indian journalists (according to The Guardian), including those from mainstream publications (three current Hindustan Times journalists are named, as is one from sister publication Mint), and websites, apart from freelancers were targeted. The 38 are among 180 journalists the report said were targeted worldwide, including the editor of the Financial Times Roula Khalaf, and journalists from the Wall Street Journal, CNN, New York Times, and Le Monte.

In its response published by The Guardian, the Indian government termed the investigation a "fishing expedition" , that there is "no concrete basis out truth associated with the claim that there was government surveillance on specific people", and referred to a 2019 controversy surrounding Pegasus when a vulnerability in WhatsApp was used to deliver the malware to at least 20 Indian citizens, including journalists, lawyers and activists.

"Government of India's response to a right to information application about the use of Pegasus has been prominently reported by media and is in itself sufficient to counter any malicious claims about the alleged association between the government of India and Pegasus," India said in its response.

"It is important to note that government agencies have a well-established protocol for interception, which includes sanction and supervision from highly ranked officials in central and state governments, for clear stated reasons only in national interest," it added.

The investigation was based on a data leak of around 50,000 numbers obtained by Amnesty International and Paris-based Forbidden Stories, a non-profit. To be sure, as the methodology of the investigation explains, the presence of a number does not indicate the individual's phone was hacked — just that it was of interest. Amnesty International subsequently forensically investigated 67 of these phones, and found 23 hacked and 14 showing signs of attempted penetration.

The Wire reported that 10 of the phones forensically examined in India showed they had either been hacked or signs of an attempted hacking.

NSO Group, in a response to Forbidden Stories and its media partners, said the interpretations from the leaked dataset were misleading. "The alleged amount of 'leaked data of more than 50,000 phone numbers,' cannot be a list of numbers targeted by governments using Pegasus," it said, and added that it "does not have insight into the specific intelligence activities of its customers".

The Wire also said that three leaders of opposition parties in India, two ministers, many businesspeople, and one constitutional authority were among those targeted. These names are expected to emerge over the next few days in subsequent installments of the investigation. The website also said relatives of activists accused in the Elgar Parishad case were also targeted.

Pegasus makes it possible for those using the software to intercept all communications on their targets' device, including stored files as well as messages. The malware also allows for the device's microphone and camera to be turned on, and its location logs accessed.

According to the Guardian report, the list of governments believed to be NSO customers, and who entered the numbers that were part of the leaked database are: Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the UAE.

The report is likely to see some heated exchanges in India's Parliament, set to convene on Monday for the monsoon session, especially once names of the opposition politicians are released.

On Sunday, in anticipation of the release — there was buzz that an investigative report of this nature was being published — several opposition parties met. Later on Sunday, after the names of the journalists targeted came out one opposition leader said "we will wait to see what data is available on political leaders," before deciding a course of action.

"GoI has denied resorting to unauthorised surveillance. The question this raises is, if Pegasus is only sold to governments, which other govts (China/Pak?) are using it to snoop on prominent Indian citizens? Shouldn't the authorities call for an independent investigation?" said Congress MP Shashi Tharoor in a tweet on Sunday evening.