More than 300 Indian phone numbers were among nearly 50,000 selected worldwide as being of possible interest to clients of the Israel-based NSO Group, maker of the Pegasus spyware. The leaked database was shared with Le Monde, The Guardian, Washington Post, Die Zeit, Suddeutsche Zeitung and 10 other global news organizations as part of the investigation known as the Pegasus Project. A majority of the numbers identified in the list were geographically concentrated in 10 countries — India, Azerbaijan, Bahrain, Hungary, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia and the United Arab Emirates.
In India, it included politicians, dozens of journalists, activists, businessmen, a Supreme Court judge and even two ministers in Narendra Modi’s government as shared by news website The Wire, which was part of the global investigation. So far, forensic analyses performed on 22 Indian smartphones, whose numbers appeared on the list, showed that at least 10 were targeted with Pegasus spyware, seven of them successfully.
Soon after the report came to light, pandemonium broke out in parliament, with proceedings disrupted and opposition parties demanding that an independent inquiry be set up. The government went on the defensive, calling it a “fishing expedition,” and refused to set up an independent investigation after claiming that it was not involved in the surveillance. Home Affairs Minister Amit Shah released a statement in which he attacked Congress and various international organizations, calling them “obstructers” and “disrupters” whose only aim was to humiliate India on the world stage.
Pegasus is a spyware that can be covertly installed on smartphones, allowing operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras. The spyware is capable of surveillance on three levels: initial data extraction, passive monitoring and active collection. Once installed, the spyware leaves no trace on the device, consumes minimal battery, memory and data consumption, and comes with a self-destruct option that can be used at any time.