Spyware scandal shakes trust in India’s democracy – again

When Indian journalist Rohini Singh learned that her mobile phone had been targeted by the cyberspying software Pegasus, she was upset by the apparent breach of her personal privacy. But she was even angrier about the threat she believes the hacking scandal poses to Indian democracy.

“In a democracy there is a free media … asking questions isn’t treated as an attack on the nation,” says Ms. Singh, a journalist working with The Wire, a prominent Indian news website. “A paranoid, authoritarian state spies on journalists, not a strong, confident democracy.”

But the scandal has also prompted renewed moves to strengthen privacy protection laws in India, following the Supreme Court’s landmark 2017 decision recognizing privacy as a fundamental right.

Ms. Singh’s mobile phone number was one of 300 Indian numbers targeted by an Indian client of the Israel-based NSO group, which says it sells state-of-the-art spyware only to selected governments to help them combat organized crime.

Last week a consortium of international media published findings by Amnesty International and French investigative group Forbidden Stories that the software had been used to hack phones belonging to politicians, lawyers, human rights activists, journalists, and businesspeople around the world.

In India, Prime Minister Narendra Modi’s main rival, opposition Congress party leader Rahul Gandhi, was among those whose phone number appeared on the target list. So too were those belonging to independent journalists, Pakistani diplomats, representatives of the Bill and Melinda Gates Foundation, and India’s elections commissioner.

This has fed suspicions that the Indian government was behind the hacks, seeking not only to listen in on phone conversations but to spy on all the information stored in the target phones, which the Pegasus software is capable of doing.

The government has denied this, telling researchers at the Pegasus Project that “the allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.” 

Mr. Modi’s de facto deputy, Home Minister Amit Shah, said the reports were designed to “humiliate India on the world stage, peddle the same old narratives about our nation and derail India’s development trajectory.”

A chilling effect

Since the Bharatiya Janata Party (BJP) government took office in 2014, however, local and international democracy activists have decried what they call a slide toward an authoritarian state in India, which long boasted of being the world’s most populous democracy.

In its latest annual report, “Democracy Under Siege,” U.S. democracy watchdog Freedom House downgraded India to the status of “partly free.” It said that “rather than serving as a champion of democratic practice and a counterweight to authoritarian influence from countries such as China, Modi and his party are tragically driving India itself toward authoritarianism.”

The government and allies “continued to crack down on critics during the year [2020], and their response to COVID-19 … encouraged the scapegoating of Muslims, who were disproportionately blamed for the spread of the virus and faced attacks by vigilante mobs,” the report found.

The Pegasus snooping, and suspicions that the government is behind it, have a chilling effect on democratic processes and institutions, worries Rohini Lakshané, a technologist and policy researcher.

The spyware, which NSO insists it sells for the purpose of tracking terrorists and international criminals – and only to governments it has vetted – takes on a darker significance when it is used against political opponents and civil society, Ms. Lakshané says.

In such cases, “the surveillance serves the interests of the ruling political party, not that of the state in terms of national security or law and order. It signals to political dissidents that they will be similarly targeted if they continue to dissent,” she warns.  

Among the political targets was a prominent politician and fierce critic of the BJP, Mehbooba Mufti, the last chief minister of Jammu and Kashmir before the government revoked the state’s special autonomous status in 2019. Two of her family members were found on the Pegasus target list, though she herself was not.

“Pegasus spyware is just one more weapon that has been used to deal with political opponents and others who dare to raise their voice against [the government’s] draconian policies,” says Ms. Mufti.

Democracy at stake?

This is not the first time that the use of Pegasus spyware has come to light in India. In 2018, Canada-based cybersecurity group Citizen Lab named India as one of 45 countries where it said Pegasus was being used to spy on citizens. A year later, WhatsApp reported that a number of Indian journalists and human rights activists had been the target of Pegasus surveillance.

The BJP government at the time deplored what it called misleading attempts “to malign the Government of India for the reported breach” and said it was “committed to protect the fundamental rights of citizens, including the right to privacy.” 

The new scandal has provoked a flurry of moves to investigate its origins and boost online protections.

The chairperson of India’s parliamentary Standing Committee on Information Technology, Shashi Tharoor, has summoned government officials to testify this Wednesday and demanded a “Supreme Court judge-led judicial probe” into the matter.

The Pegasus affair “reveals a need for urgent surveillance reform to protect citizens against the use of such invasive technologies,” declared the Internet Freedom Foundation, which works to defend digital liberties. The group urged legislation to give teeth to the Supreme Court’s decision in 2017 that privacy was a fundamental right.

The stakes are high, says Mishi Choudhary, legal director of the Software Freedom Law Center. “If we fail to safeguard our future by legislating now,” she warns, “we will be responsible for losing our democracy.”