By Neeraj Mishra

The Chhattisgarh government wants to pin down Israeli spyware firm NSO as five Chhattisgarh activists were among the 1,400 individuals spied on by it but that will be easier said than done

By Neeraj Mishra in Raipur

In August 2017, a nine-judge bench which included SA Bobde, the new chief justice of India, decided that the right to privacy was an integral part of the Fundamental Rights as enshrined in the Constitution. Since then, a lot of water has flowed under the bridge but it appears that its absolute limits can only be determined on a case-to-case basis.

While we are still in the dark over the crucial linking of various data—Aadhaar, PAN, personal biometrics—most telecom companies have already benefited from the grey areas in governance. Whatever was left has been mined by smart international data mining companies such as NSO of Israel, Facebook and WhatsApp as also various banks. The state is clear in its objective—it wants all data and information on all citizens.

Matters came to a head recently when Congress General Secretary Priyanka Gandhi revealed that her mobile phone had been sabotaged and NSO had successfully planted the Pegasus software. It appears that more than 1,400 individuals from 45 countries had suffered the same fate. This is now part of Facebook’s case against NSO in US courts under the Computer Fraud and Abuse Act.

As five of these 1,400 individuals are activists from Chhattisgarh, Chief Minister Bhupesh Baghel announced an investigation into the matter. Taran Sinha, an IAS officer, Subrata Sahu, former CEC of Chhattisgarh, and Anand Chhabra, IGP, Raipur, were asked to investigate how the world’s biggest spyware company operates in India. But the trio doesn’t know where to begin. It has also been asked to investigate if the state government ever bought technology which is being sold for $55 million a year. Only Saudi Arabia, Panama and Mexico have so far revealed that they bought the spyware from NSO. In fact, in 2011, Mexico had publicly announced its $20-million deal with NSO and later acknowledged that it had been able to eliminate dissident activist Joaquim Guzman, known as El Chapo, because of the surveillance tech provided by it.

A Sunday newspaper from Delhi recently claimed that some people from Pegasus had visited Raipur and met police department officials in 2017. There is no official record of the vendor visit or discussion but if it did happen, someone in the police headquarters (PHQ) has to know. No one is saying anything, but if Pegasus vendors did meet anyone in the PHQ, then those officers have not yet retired. A company like NSO will do its groundwork before approaching any government and its stated objective is also “to provide governments with technology to fight ultras”.

It is ironic that Chhattisgarh wants to investigate a case where it is itself a respondent. The case was filed by suspended Additional Director General (ADG) of Police Mukesh Gupta in the Supreme Court wherein he alleged interception of the phones of his two daughters by the state. Justice Arun Mishra came down heavily on this saying it was needless invasion of privacy and asked the state government to explain. The state, in turn, is now investigating who leaked the letter of authority from the home department sanctioning the interceptions.

The joke doesn’t end there. Gupta was suspended for exceeding his brief as ADG, Economic Offences Wing, for exactly the same crime he now accuses the state of using against him. It is alleged that he had been tapping the phones of bureaucrats, politicians and journalists. The Pegasus inquiry may ultimately reach his doorstep, rounding off the circle of spyware investigations in the state. Phone tapping can be done only on the orders of the home secretary on a request by an officer of the rank of IG and above with a legitimate cause and only for a week at a time. For this, formal orders are issued by the home department to the DGP. For cases involving multi-state or longer terms, the Union home ministry has to authorise it.

Five Chhattisgarh citizens, including farm activist Degree Prasad Chouhan and lawyer Bela Bhatia, had claimed that their WhatsApp was under surveillance by Pegasus. Pegasus, of course, can provide more crucial data on everything an individual does with the mobile, including locations and every word and voice message transmitted. This came to light only when Citizen Lab of Toronto informed some of the activists under Pegasus surveillance in Maharashtra in September. “Vendors may have come to Raipur from NSO but there is no record of it and at any rate, the state does not have money to invest such amounts. It may come to some Rs 30 crore even for a month’s surveillance on select numbers,” said a senior police officer in PHQ.

NSO is an Israeli software firm owned by former Mossad agent Shalev Hulio. It has been active since 2009. It was briefly bought by an American equity fund for about $20 million around 2013 before it came back to Hulio at an increased price of about $60 million. Its most successful attempts at phone tapping and spyware planting have been in South America. It is now valued at over $1 billion. It may also have been behind the cyber stalking of Saudi journalist Jamal Khashoggi who was murdered. Many activists believe that the Indian government may have engaged NSO for surveillance and information gathering. Priyanka Gandhi’s claim points to a larger conspiracy. “My own feeling is that it will eventually come down to finding out who was dealing with NSO vendors in PHQ,” said a senior officer.

WikiLeaks has revealed it was the Indian government which first wrote to a firm called Hacking Team in 2006, asking for a meeting and inquiring about their tools of intrusion. It wasn’t just the central government but state police departments who were in touch with them to procure surveillance technologies. Emails reveal that the Andhra Pradesh Police Intelligence wanted to procure phone interception tools right after N Chandrababu Naidu’s phone calls were leaked to the press in July 2015.

A sensible approach to the whole Pegasus intrusion is offered by a retired police officer. “Only the Union home ministry has funds large enough to engage NSO. It is not about to reveal anything. Not now. Not ever. Whatever comes in the public domain will most likely be through the Facebook case in the US.”

What it may do is spawn Indian IT experts to collude and build billion-dollar spyware firms. The future is all digital and insecure and courts can do little as technology will always beat the next firewall.