The massive snooping scandal using Pegasus has burst open many hidden secrets!
SHARE:
The controversy of Pegasus spyware
- The story: It first came into public limelight in 2019, and then screamed back into centrestage in July 2021. It was reported that Pegasus, a dangerously malicious software, was being used to secretly monitor and spy on an extensive host of public figures in India (and across the world).
- Points to note: Pegasus is a malware (malicious software) classified as a spyware. It is designed to gain access to devices, without the knowledge of users, and gather personal information and relay it back to whoever it is that is using the software to spy. It does not even need the user to click on any link, but just lodges itself onto the machine (device) and begins snooping.
- Pegasus has been developed by the Israeli firm NSO Group that was set up in 2010.
- The earliest version of Pegasus discovered, which was captured by researchers in 2016, infected phones through what is called spear-phishing – text messages or emails that trick a target into clicking on a malicious link.
- Now, NSO’s attack capabilities are more advanced. Pegasus infections are achieved through so-called “zero-click” attacks, which do not require any interaction from the phone’s owner in order to succeed.
- These often use “zero-day” vulnerabilities, which are flaws or bugs in an operating system that the mobile phone’s manufacturer does not yet know about and so has not been able to fix.
- Once Pegasus is on a phone, it can spy completely and thoroughly, even the encrypted chats like the ones made through WhatsApp! Researchers have found that Pegasus can read messages, track calls, track user activity within apps, gather location data, access video cameras in a phone, or listen through their microphones.
- Pegasus hides itself really hard. It self-destructs if it is not able to communicate with its command-and-control (C&C) server for more than 60 days, or if it detects that it was installed on the wrong device with the wrong SIM card.
- Vulnerable targets: Across the world, autocratic governments have targeted human rights activists, journalists and lawyers with phone malware. Various Indian ministers, government officials and opposition leaders also figured in the list of people whose phones may have been compromised by the spyware.
- Twists and turns: Pegasus spyware first came to the limelight in 2016, when an Arab activist got suspicious after receiving a shady message. It was believed that Pegasus was targeting iPhone users. Then, Apple released an updated version of iOS, which patched the security loophole that Pegasus was using to hack phones. By 2017, security researchers found that Pegasus was capable of infecting Android phones. More security patches came.
- Then, in 2019, FB's WhatsApp filed a lawsuit in the US court against Israel's NSO Group, alleging that the firm was incorporating cyber-attacks on the application by infecting mobile devices with malicious software. That is how the world came to know of the modus operandi behind this extremely costly software, that NSO says it sells only to governments and no one else. So the snooping must have been sanctioned officially. Then in July 2021,
- On 18th July 2021, many prominent news websites, including the Guardian and the Washington Post, published details of what they called global surveillance operations using Pegasus. It targetted journalists, including over 40 journalists in India, activists and other key public figures.
- The latest reports claimed that over 10 governments, including India, are involved in surveillance of people using Pegasus spyware.
- NSO Group called this report — titled "The Pegasus Project" — an attempt to discredit NSO Group on false grounds. It said that it does not own any data captured or created using its surveillance software by any government.
- Official stand: India, in a statement, called the Guardian report "fishing expedition, based on conjectures and exaggerations to malign the Indian democracy and its institutions." But the government did not categorically deny using Pegasus! But in a dark revelation, journalists on Twitter posted excerpts of the Washington Post expose, claiming that the woman who had alleged harassment at the hands of ex-CJI of India Ranjan Gogoi, was also on surveillance (and her entire family too)! Ex CJI Gogoi had later given a string of government-friendly verdicts, and then went to the Rajya Sabha as an MP. More names included Rahul Gandhi, Prashant Kishore, Ashok Lavasa (Election Commissioner), Ranjan Gogoi, and Gagandeep Kang (epidemiologist)!
- Official schemes: Indian government runs programmes on cyber-security.
- Cyber Surakshit Bharat Initiative - Launched in 2018 with an aim to spread awareness about cybercrime and building capacity for safety measures for Chief Information Security Officers (CISOs) and frontline IT staff across all government departments.
- National Cyber security Coordination Centre (NCCC) - In 2017, the NCCC was developed to scan internet traffic and communication metadata (which are little snippets of information hidden inside each communication) coming into the country to detect real-time cyber threats.
- Indian Cyber Crime Coordination Centre (I4C) - I4C was recently inaugurated by the government. The National Cyber Crime Reporting Portal has also been launched pan India.
- Computer Emergency Response Team - India (CERT-IN) - It is the nodal agency which deals with cybersecurity threats like hacking and phishing.
- International mechanisms: The International Telecommunication Union (ITU) is a specialized agency within the United Nations which plays a leading role in the standardization and development of telecommunications and cyber security issues. The Budapest Convention on Cybercrime is an international treaty that seeks to address Internet and computer crime (cybercrime) by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. It came into force on 1st July 2004. India is not a signatory to this convention.
- Summary: Clearly, there are hundreds of Indian under active surveillance using Pegasus, as reports have indicated. This is a breach of their right to privacy, and carries serious consequences for the individuals. Time will tell how the story evolves.
COMMENTS