Pegasus is a malware and can be anywhere

The current controversy on Pegasus in India arises from  the petitions filed by various persons who all have one thing in common that they are known to be opponents of the current Government.

Just because all the petitioners are Anti Government, we cannot presume that Government of India used Pegasus to target all its opponents.

End of the day, Pegasus is a spyware and was commercially produced and sold by a company like many other encryption, decryption software or other security software. It was designed for use by security agencies to infect mobiles and conduct surveillance of various kinds.

It is feasible that many Governments across the globe could have bought this software for legitimate intelligence use. “Intelligence” is a necessary activity of a Government and cannot be wished away. Whether it is ISI or RAW, FBI or CBI, MI6 or KGB, or snooping on crime suspects is a reality. Considering the proliferation of terrorism in the world, such intelligence activity is the duty of a Government.

Whenever a terrorist activity is reported, the first thing every opposition party asks is why there is an “Intelligence Failure”. But when it comes to Pegasus, the same opposition asks “Why there is Intelligence”?.

The petition in the Supreme Court is built on a weak premise that

a) there is a possibility that the Indian Government could have officially bought Pegasus,

b) there are a few mobiles in India which have Pegasus infection and

c) few of those persons whose phones are affected are political opponents of the Government and

therefore the Indian Government is guilty of illegal surveillance… Q. E. D.

On the other hand, it is observed that

a) Petition is filed by known political opponents

b) Petitioners have a motive to run a smear campaign on the Government

c) There are many previous occasions when the same petitioners have filed irrelevant and false petitions for political gains

d) There is no evidence backing the allegation

e) Demand for investigation is based on journals which are known to be anti-India campaigners

e) The petition has come 2 years after they first surfaced and just a day before the Parliament session and was used primarily to disrupt the Parliament session.

Hence it is a fact that the petitioners have knocked at the doors of Supreme Court with unclean hands and the demand is that a fishing enquiry be ordered at the expense of the exchequer to satisfy the political opponents.

Pegasus Infection

I would like to draw the attention of the honourable Supreme Court that Pegasus is a malware. While the company which is selling the software claims that it sells it only to authorized Government agencies, there is no guarantee that any of these Government agencies may use it to spy on foreigners.

I.O.W. a foreign Government can snoop on Indian Journalists. We are aware that there are foreign news agencies like NewYork Times which are reported to be scouting to recruit journalists who can run smear campaigns against the Government of India. There is a possibility that such anti-India business interests may also want to spy on Indians both journalists or activists.

Further any State Government including the West Bengal Government or Kerala Government could have used the spyware for its own use. Political pundits like Mr Prashant Kishore could have advised parties like Congress which have earlier used Cambridge Analytica to use Pegasus .

A few years back there was a malware called Stuxnet produced again by an Israeli agency to target Iran nuclear facilities. This malware was supposed to spread only though a USB drive since the targeted Iranian facility was an air-gapped system and not connected to Internet. However, Stuxnet was found to have infected many systems world over and reported to have even affected Rare Earth Minerals near Mysore.

Malwares are often developed for a certain purpose but gets out of control and spreads like the Corona virus which could have escaped from the laboratory where it was developed as a research product. The world is struggling to hold Chinese Government or the agencies funding the Wuhan Laboratory responsible for the Corona Virus if not for malicious intentions, for at least negligence. But the Indian politicians are more concerned about Pegasus indicating that their intentions are not clean.

It is told that Pegasus is a “No Click infection”  and in case a person receives an incoming Whats App Call which he does not pick up the instrument may get infected.

The Supreme Court should ask the citizens of India, how many of them have in the past few years received WhatsApp calls which either they have not picked up or when they pick up does not receive any response from the other end.  All these phones might have been infected with Pegasus. Does it mean that all these phones were targeted by the Indian Government and are being surveilled?. If so then my phone should also come into this category.

Anti Virus companies are unable to confirm if they have a detection tool to find out whether a given phone is infected or not. Hence the Supreme Court should consider any person who has ever received a silent WhatsApp call from an unknown person is a potential target of the Indian Government using Pegasus.

Hence Pegasus infection may be found anywhere and if all the mobiles in India are checked (If there was a method of detection), then perhaps we would know that crores of mobiles may carry the infection.

If it is not the 20 odd persons who have filed the petition, not the 1400 persons in India who might have been affected as per some reports but hundreds of thousands of persons in India many of whom are pro-Government, then where is the presumption that the Government of India targeted only political opponents?

The very presence of a large number of pro-Government or neutral persons who could have been infected by Pegasus against a relatively fewer anti Government persons who have approached the Government, makes this petition a purely speculative judicial exercise even to issue a notice.

It is incumbent on the petitioners to find some evidence that a given infection in one of the phones was actually done at the instance of the Government and the snooped data was being received and analyzed by a Government agency.

We are aware that in Delhi several operators were selling “Off the air” mobile signal catchers which was also used by private detective agencies. The petitioners need to prove that Pegasus has not been accessed by such private operators either in India or elsewhere. If Off-the air mobile signal catchers costing Rs 1 core plus were in the market in India a few years back, a more powerful Pegasus could be acquired by private detective agencies for several crores more since it could be marketed to the opposition political parties themselves to spy on Government supporters.

The Supreme Court therefore has to look at the pros and cons of extending this investigation. Even assuming that some evidence is presented by the petitioners and an accusing finger may be pointed at the Government, it is impossible to find clinching evidence. Even if any clinching evidence is found,, it is not possible for the Court to issue an order “Prohibiting surveillance”. At best Court may question the process of authorization of such surveillance.

Hence this entire exercise is futile, unproductive and is a waste of time for the Court. It is just to satisfy ourselves that we value Privacy of citizens and go to any extent to fight for the right. All of us know this is not true and our politicians and businessmen are not interested in passing the Privacy law because we donot consider it a priority.

I hope the Supreme Court will also not fall prey to this political game and dismiss the petitions without wasting too much of its energies.

Naavi

Also refer: NDTV.COM

 

 

About Vijayashankar Na

Naavi is a veteran Cyber Law specialist in India and is presently working from Bangalore as an Information Assurance Consultant. Pioneered concepts such as ITA 2008 compliance, Naavi is also the founder of Cyber Law College, a virtual Cyber Law Education institution. He now has been focusing on the projects such as Secure Digital India and Cyber Insurance
This entry was posted in Cyber Law. Bookmark the permalink.

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.