Government as hacker: Democracy undone

The rules that permit surveillance by the government under the IT Act do not allow hacking. Hacking remains illegal under Section 43 of the IT Act with no exceptions.

Investigative journalists Ronen Bergman and Mark Mazzetti of the New York Times (NYT) have revealed that the cyber-weapon Pegasus was part of a $2 billion defence package the Narendra Modi government purchased from Israel in 2017. A government minister has sought to dismiss it as a motivated conspiracy by calling the highly respected NYT, “supari” media, a colloquial term for contract killing in the Mumbai underworld.

Described as the “largest defence contract” ever signed by Israel, the deal for medium-range surface-to-air missiles, launchers and communications technology was awarded in April 2017 ahead of the first visit by an Indian head of government to Israel (July 4-6, 2017). The NYT report claims Pegasus was a “diplomatic sweetener” Israel used to win international support from recalcitrant countries and to “knit together right-wing nationalist governments around the world”.

A retired Indian diplomat has denied allegations in the NYT report that the deal involved a quid-pro vote by India in the UN against a pro-Palestine NGO. Despite this India’s deep strategic embrace of Israel is undeniable. The Modi government makes no bones of its admiration for Israel’s muscular militaristic ethos and sees it as a role model for its own majoritarian project of India-as-Hindu-homeland.

However, the ouster and marginalisation of right-wing nationalist regimes around the world has brought the Modi government’s chickens home to roost. The diplomatic cushion he enjoyed because of Benjamin Netanyahu and Donald Trump’s support has been punctured after their political defeat and legal prosecution in their respective countries.

Netanyahu’s negotiations for a plea bargain with a nominal sentence may not succeed. Israel’s Attorney General Avichai Mandelblit appears insistent on pressing stronger charges that would bar Netanyahu from politics for 7 years. He has ordered an investigation into the illegal use of Pegasus technology by Israeli police for monitoring leaders of a protest movement against Netanyahu.

The democratic administration in the US has put NSO on its “entity list” – effectively black listing it and preventing it from accessing American technology, including Dell computers and Amazon cloud storage services critical for its functioning. The Biden administration has clarified that these measures are directed towards “reining in a dangerous company and nothing to do with America’s relationship with Israel.” The US knows what Pegasus is capable of as its Federal Bureau of Investigations had acquired and tested Pegasus for two years before deciding against its use.

Following the momentous political reversals in the US and Israel the Modi government has since recalibrated its public stance on Pegasus. Instead of the earlier flat denials its spokespersons began to give ambiguous responses and speak half-truths. In November 2019, then Information Technology Minister, Ravishankar Prasad told Parliament, “No unauthorised interception has been done”, leaving open the option of authorised use. His successor Ashwini Vaishnav told Parliament in July 2021 that, “Any form of illegal surveillance is not possible with the checks and balances in our laws and robust institutions.” This suggested the possibility of reading existing laws in a manner making its use ‘legal’. Minister of State for Defence Ajay Bhatt replied to a Rajya Sabha question in August 2021, stating that “Ministry of Defence has not had any transaction with NSO Group Technologies.” This did not foreclose the possibility that the cyber-weapon was purchased by a separate government entity.

On August 16, 2021, when the Supreme Court was hearing a clutch of PILs on the misuse of Pegasus, citing “national security”, Solicitor General Tushar Mehta said the government “cannot let terrorists know which software is used” and refused to reveal whether Pegasus was purchased and used against Indian citizens. A month later on 13 September, Mehta once more refused to file a categorical denial before the Supreme Court. This was the closest the government came to signalling that it may have used Pegasus but would not say so under oath.

Mehta further suggested that there was a legal framework for surveillance and interception of communications in the statutory provisions of the IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. However can the Attorney General’s claim of a legal umbrella for surveillance stretch to activities amounting to hacking?

The rules that permit surveillance by the government under the IT Act do not allow hacking. Hacking enables remote tampering with communication devices, switching their features on and off, compromising apps and most perniciously, it permits implanting files on the device under attack. Hacking remains illegal under Section 43 of the IT Act with no exceptions. “State sponsored illegal hacking” is the complaint made by the PILs before the Supreme Court.

The government’s offer to set up an expert committee to examine the issue provided the information disclosed by the government was not made public was not agreed to by the Supreme Court. It set up its own committee in October 2021. This technical committee’s mandate has become redundant in the public mind after the NYT report’s claim that India did purchase Pegasus in 2017. The Supreme Court should now ask the government for a fresh affidavit in view of the recent media disclosures. It must seek clarifications on who purchased Pegasus, which agency used it, who authorised its use, which individuals were put on the hacking list and why.

If the government does not comply the Court should question the chiefs of government agencies who held office from April 2017 onwards (when the Pegasus deal was allegedly executed). The agencies which would necessarily come under suspicion include the Intelligence Bureau, Research and Analysis Wing (RAW), National Technical Research Organisation (NTRO), Defence Intelligence Organisation (DIA), Military Intelligence (MI), and any other special agency created for the purpose. The then home secretary, who would have been empowered to give permission for surveillance under the Telegraph Act, must also answer to the court.

The Opposition must haul up the Modi government for misleading Parliament. The prime minister will find it difficult to ignore the latest revelations since they strengthen accusations that his government has hacked into phones belonging to the Opposition, the judiciary, an election commissioner, the media and civil society critics -- in effect illegally subverting every institution of democracy.