The world's most dangerous

Laurent Richard and Sandrine Rigaud
Pegasus: The Story of the World’s Most Dangerous Spyware
Macmillan, 2023

Pegasus: The Chronicle of the World's Deadliest Spyware

The NSO Group, a privately held Israeli company, is the creator of the world's most dangerous surveillance technology. According to the company, law enforcement uses it to track drones, apprehend terrorists, drug dealers, pedophiles, and even locate people who are caught in falling debris from a building. But this malware, as well as its clones and imitations, like one named Predator, which is allegedly only made available to government law enforcement agencies after receiving the required authorization from the Israeli government, is also used by governments all over the world, especially authoritarian ones. Governments are the only organizations with the financial means to fund the concentrated application of Pegasus, with the possibility of a few major corporate conglomerates as well. Notwithstanding Tel Aviv's claims that

Given the current situation, the most important question that naturally emerges is why, in spite of having created the most sophisticated spyware, Israel's military forces were unable to predict Hamas' October 7 attack. There is still no response to this query.

Returning to Pegasus, the truth is that this spyware has been abused and most likely still is, to follow not just the political rivals of the powerful in several nations, but also individuals who are part of their own administrations and whom the rulers wish to monitor. Several heads of state have used Pegasus to read, see, and listen in on conversations, text and audio messages, videos sent over email, and text messages sent from their mobile phones. For instance, the spyware was used by Morocco's royal family to spy on dissidents and high-ranking officials in the French government. Pegasus is most commonly used to follow government officials, journalists, attorneys, judges, and politicians.

This is the main focus of the book. It was authored by two journalists who work for Forbidden Stories, a Paris-based organization that was the recipient of a data dump containing approximately 50,000 phone numbers that appeared to have been exploited by Pegasus. Initially, Amnesty International was enlisted as a partner. Following that, the numbers were distributed to over 80 journalists employed by 17 media outlets worldwide, including The Wire in India. After obtaining data from their own devices, those who agreed to have their phones' internal components forensically inspected saw their data being closely scrutinized by technical specialists in Europe and Canada (at the Citizen Lab). The book describes the complex process by which the worldwide inquiry was carried out over the course of more than three months and ultimately made

The 318-page book is written in a risqué style and is jam-packed with personal experiences and tales, which makes it incredibly readable. These include numerous heartbreaking true accounts of people who died, leaving their families in ruins, and how innocent people faced harassment, abuse of power, and incarceration simply for carrying out their official duties – that is, disclosing high-level corruption, power abuses, and the connections between powerful criminals and influential government figures. The book's stories feature incredible bravery and perseverance in addition to death and tragedy. The detailed account of the methodology employed by the researchers and technical professionals to uncover the truth about Pegasus is compelling.

I should probably start with a personal disclaimer before continuing. This reviewer is among those whose phones were forensically examined and who are mentioned numerous times in the book, in addition to the founding editors of The Wire, Siddharth Varadarajan and M.K. Venu. In this regard, I am one of the petitioners who have approached the Indian Supreme Court. While numerous governments across the globe have opened investigations into claims of spyware abuse, the Indian government has shamelessly obstructed any efforts to reveal whether it has utilized Pegasus, even in the face of intervention from the nation's top court. The Supreme Court hasn't exactly buried itself in glory due to the tardy rulings, and the government's position also suggests that it has a lot to hide.

On October 27, 2021, the Supreme Court formed the committee, chaired by retired Justice R.V. Raveendran. Alok Joshi, an Indian Police Service officer from the 1976 batch and a former director of the government's external intelligence agency, Research and Analysis Wing (RAW) in the Cabinet Secretariat, will be supported by Sundeep Oberoi, the chairman of the International Organization of Standardization, International Electro-Technical Commission, and Joint Technical Committee subcommittee. Another panel of three technical experts included Naveen Chaudhary, a professor of digital forensics and cyber security at the National Forensic Sciences University, Prabaharan P., a professor at Amrita Vishwa Vidyapeetham in Kerala and an expert in cyber security, and Ashwin Anil Gumaste, a professor in the Indian Institute of Technology's department of computer sciences and engineering

One day before he retired on August 26, 2022, former Chief Justice of India N.V. Ramana said in court that the government had not worked with the committee he had appointed. "We'll just say one thing," he continued, "the government did not assist the technical committee in checking the devices for Pegasus spyware."

He presided over a three-judge bench on that particular day, which also included Justices Hima Kohli and Surya Kant. The long report, which he had divided into three sections in court, was quickly read by the judges. The CJI reported that the technical committee had examined 29 phones and found malware in five of them; the malware could not be identified as Pegasus. As per his statement, the Raveendran Committee's report

The Raveendran committee, according to CJI Ramana, had proposed amending the current surveillance law and enhancing privacy protection "alongside the cyber secrecy of the nation." The CJI stated that the committee's findings and suggestions might be released to the public.

The bench declared: "It is not acceptable for the Respondent Union of India to pursue such a course of action, particularly in proceedings of this kind that involve the fundamental rights of the nation's citizens.The Court does not become silent just because the State invokes national security.

Earlier, CJI Ramana had asked the government's lawyer, Solicitor General of India Tushar Mehta, to respond directly to a direct question: "Has any Indian agency purchased and used Pegasus?" The lawyer declined to say "yes" or "no," claiming that doing so would negatively impact "national security interests." The government's response was that blatant. However, worse was to come.

Late on August 25, 2022, the Supreme Court made the decision to "re-seal" the Raveendran committee report and place it in the "safe custody" of the court's secretary general following the technical committee and Raveendran committee submission of their reports in a sealed cover and in spite of CJI Ramana's observations in court. "The decision to keep the two reports under wraps, despite the CJI's oral commitment to upload them on the Supreme Court's website, disappointed those who expected some degree of transparency from the highest court," the legal website The Leaflet said in a statement.

In four weeks, the case was scheduled to be heard. However, more than 13 months have passed with no action taken. Curiously, in the interim, it is currently not possible to access the depositions that were videotaped (of multiple people, including Varadarajan and myself) and posted on the website that the inquiry committee made accessible to the public.

Referring back to the book by Ricard and Rigaud, the particularly compelling stories go beyond the story of Jamal Khashoggi, the Washington Post columnist and occasional critic of the Saudi royal family, particularly Mohammed bin Salman, or MBS, who was allegedly involved in the hiring of certain individuals who dismembered Khashoggi's body inside the Saudi consulate in Istanbul, Turkey, in October 2018. It appears that Pegasus was sent to follow his fiancé and legal representatives as soon as he arrived at the consulate.

The accounts of Mexican journalists, some of whom have passed away, are equally compelling. Both Regina Martinez of Prosco's untimely death and the murder of 39-year-old journalist Cecilio Pineda are still unsolved. Both revealed how the drug mafia's members conspired and bribed with local law enforcement and government officials. Even as he continued to look into the circumstances surrounding the deaths of his fellow journalists, Pegasus appears to have compromised the phone of another investigative journalist, Jorge Carrasco.

The book painstakingly records the horrifying effects of governmental surveillance on people while also contrasting these with inspiring tales of bravery and resistance. There are rays of hope amid the black clouds of authoritarianism and dictatorship, thanks to the courageous journalism of people like Bastian and Frederik Obermaier of Hungary and Khadija Ismayilova of Azerbaijan.

Almost 1,000 phone numbers in about 50 countries were discovered to have been purportedly infected by Pegasus after verification with multiple sources, out of the 50,000 odd phone numbers that were "leaked" to Forbidden Stories (possibly by an NSO insider). These numbers included those belonging to at least 600 politicians and government officials, 192 journalists, 85 human rights activists and lawyers, one king, three presidents, ten prime ministers, and two Emirati princesses (you can probably guess their names).

I'll bet that those who are associated with the right-wing ecosystem and the BJP will respond to this review with "whataboutery." In the event that Pegasus has been abused globally, what makes the current situation in India novel? Merely a small comfort then?

Nevertheless, a significant portion of the book describes how the global operation to guarantee that 80 journalists employed by 17 media organizations worldwide were convinced to conceal the full scope of the investigation for several months, that is, prior to the e-mailing of comprehensive questionnaires to NSO in Israel. The stories were released in a coordinated fashion over the course of more than a week in July 2021, which is when the book comes to an end. It's probably time for Ricard and Rigaud to release an expanded and revised version of the book. Take a look at the several dozen Indians whose identities were revealed in The Wire's series of articles that same month.

One final point. Why did I use the word "allegedly" so much in this review article? The reason is straightforward: it is extremely difficult to locate any evidence of Pegasus. Read the book to gain an understanding of the difficulty of this process.

Journalist Paranjoy Guha Thakurta works in Delhi. He is the publisher of Flying Lies? and co-author of The Rafale Deal with Ravi Nair. The Role of Prime Minister Narendra Modi in India’s Biggest Defence Scandal.