The Pegasus plot is getting thicker with the Supreme Court-appointed technical committee examining the possibility of more than one spyware used to carry out the spyware attack. Next week, another round of collection of devices will take place which is expected to put the probe on the fast track. So far, only a couple of devices submitted to the panel have provided some insight to the cyber experts of the possibility of the devices being infected. Apart from investigating the presence of spyware on the devices, the big question before the committee is how such a large set of phone numbers got collated in one place and who was behind it.
Out of the nearly 50,000 phone numbers selected worldwide, at least 400 were targeted in India and were said to be of possible interest to clients of Israel-based NSO group which is the maker of the Pegasus spyware.
But questions like how this data got collated, whether more than one spyware was used and who was behind it remain a matter of investigation before the committee for now.
“When more people come forward and submit devices, there will be more clarity on the allegations and what kind of spywares were used for what purpose,” said a security government .
Meanwhile, around five individuals, including two senior journalists, have met the SC-appointed panel to give statements and share their concerns about the security breaches. The panel had thrown its door open to anyone who wanted to share any kind of information with them.
In the last one month, it has been an uphill task for the panel asking the affected journalists, activists and others to give their devices for technical examination. Those who have been invited to hand over their devices for examination next week are being told that they can remain present while the digital copy is being made, they can delete any data before submitting their phones and that they can be given back their device soon after.
The Toronto-based Citizens Lab and Amnesty international had claimed several devices were the targets of attack. The technical experts will examine the origin of the spywares on phones and other devices and whether they were used to access stored data, eavesdrop on conversations or intercept information for any other purposes.
“Unless and until the committee examines itself, we will not know the truth. We are still in the process of collecting evidence,” said an official.
The Pegasus probe is just one part and the second part is to prepare for the future. The SC panel realises that existing laws like the Indian Telegraph Act and the Information Technology Act, which define the rules and regulations for lawful surveillance and use of surveillance technology, do not mention that the government needs to disclose the “means” by which it is doing it.
“In both laws, the Home Secretary-led committee gives clearances on a case to case basis but nowhere does the law mention that it needs to disclose the means by which it is doing so, either to the government or to Parliament,” said a senior security official.
The laws may need an urgent relook today with the Pegasus scandal raising a big question on whether the surveillance technologies have been misused by government agencies to snoop on their citizens. To avoid such incidents in future, the SC-appointed panel will spell the need for safeguards and explain the different levels of security to be put in place, bolstering the cyber security laws immediately and a possible relook at old laws like the Telegraph Act. Until then, the gaps in the system leaves the outcome of the Pegasus probe open ended on whether it was Pegasus or not.
In October 2021, the Supreme Court appointed an expert committee headed by Justice R.V. Raveendran. He is assisted by Alok Joshi, former chief of the National Technical Research Organisation and R&AW and Dr. Sundeep Oberoi, a cyber security expert and chairman of the International Organisation of Standardisation and International Electro-Technical Commission.
The top court also formed a technical committee consisting of Dr. Naveen Kumar Chaudhary, Professor (CyberSecurity and Digital Forensics) and Dean, National Forensic Sciences University in Gandhinagar in Gujarat; Dr. Prabaharan P., Professor (School of Engineering) Amrita Vishwa Vidyapeetham in Amritapuri in Kerala and Dr. Ashwin Anil Gumaste, Institute Chair Associate Professor (Computer Science and Engineering), Indian Institute of Technology, Bombay to probe if any governmental agency was found using Pegasus and which law, rule, guideline, protocol or lawful procedure made such deployment possible for them.
The committee has also been asked to examine steps taken by the government after reports were published in 2019 about hacking of WhatsApp accounts of Indian citizens using Pegasus. The issue has been of primary concern for citizens but kept the government tight-lipped even in Parliament.
