India: Pegasus spyware used to target journalists — reports

High-profile journalists in India have been targeted with the invasive spyware Pegasus, according to a report published by Amnesty International on Thursday.

The civil rights watchdog carried out forensic investigations on the iPhones belonging to Siddharth Varadarajan, the founding editor of The Wire, and Anand Mangnale, the South Asia editor of The Organized Crime and Corruption Report Project (OCCRP).

"Our latest findings show that increasingly, journalists in India face the threat of unlawful surveillance simply for doing their jobs, alongside other tools of repression including imprisonment under draconian laws, smear campaigns, harassment, and intimidation," Donncha O Cearbhaill, the head of Amnesty's Security Lab, said.

What did Amnesty find?

In October 2023, Apple notified a number of iPhone users who the company suspected may have been targeted by the spyware. Among those notified were more than 20 journalists and opposition politicians in India.

Amnesty's investigation followed this news, with the Security Lab carrying out the forensic analysis.

They found that Mangnale's smartphone had been infected through a "zero-click" exploit after receiving a message on August 23, 2023. This allows the spyware to install itself without the need for the user to click on a link.

Amnesty was unable to ascertain whether his phone was successfully compromised, but the attack came while Mangnale was working on a story about alleged stock manipulation by a large multinational conglomerate in India.

The attack on Varadarajan took place on October 16, 2023, but he had also been targeted by the same spyware in 2018. The most recent attempt was determined to have come from the same source as the one against Mangnale.

India's attack on civil liberties

The Pegasus spyware was devised by Israeli company NSO Group and has been found to have been used on phones belonging to journalists and politicians worldwide — in both authoritarian regimes and democracies.

The initial discovery of the spyware sparked outrage. The NSO Group was also widely condemned.

In response to the latest findings, the company told The Washington Post that it could not comment on specific customers, but that they were all "vetted law enforcement and intelligence agencies that license our technologies for the sole purpose of fighting terror and major crime."

Amnesty said that India has not yet declared whether they are using the spyware. But the watchdog said the targeting of journalists comes at a time when civil society is seeing its freedoms curtailed in an unprecedented crackdown.

India has also drawn condemnation internationally after it was accused of being involved in the murder and attempted murder of Sikh activists in Canada and the US respectively.

"Targeting journalists solely for doing their work amounts to an unlawful attack on their privacy and violates their right to freedom of expression. All states, including India, have an obligation to protect human rights by protecting people from unlawful surveillance," Amnesty's O Cearbhaill said.

"Amnesty International is calling on all countries, including India, to ban the use and export of highly invasive spyware, which cannot be independently audited or limited in its functionality," he added.

Edited by: Richard Connor