Karan Thapar | Pegasus expose: Will the govt order a real probe?

How should we judge the Narendra Modi government’s response to the Pegasus expose which is the most important and most shocking news of the month? Is it the thoughtful stand we would expect of a democratic government firmly committed to defending its citizens’ constitutional rights? Or does it amount to prevarication, denial and what I politely call utter nonsense?

Let’s start with the brutal facts. At least 1,000 Indian phone numbers are on the list of potential targets. Of these, 300 have been verified and 22 have been subjected to forensic analysis by Amnesty International and then double-checked by the University of Toronto’s Citizen Lab. In the case of 10, it was clearly established they had been targeted by Pegasus. In a further eight, the results were inconclusive. One of the confirmed 10 is Prashant Kishor. His phone was hacked as recently as July 14.

Three things stand out. In 10 cases we have confirmation of hacking. Second, the people whose phones were hacked or were potential targets are not national security risks or terrorists. They are Opposition leaders, scientists, secretaries of ministers, friends of Rahul Gandhi, a former election commissioner, journalists and activists. Third, this has to have been done by an official government agency -- either Indian or foreign. NSO has confirmed that it only sells to “vetted governments” and their agencies. A total of 60 in 40 countries. So, if the Indian government is not responsible, some other foreign government clearly is. But there’s no way you can claim that nothing happened. There’s been no hacking. This is all made up.

Let’s now come to the government’s response. First, former information technology minister Ravi Shankar Prasad says there isn’t a shred of evidence connecting the government to Pegasus. But given that Pegasus hacks phones and hacking is explicitly illegal in India and cannot be authorised by the government, can the government admit to buying Pegasus? If it does, it will incriminate itself. So, this defence doesn’t hold water.

For those who want a bit of detail, leading Supreme Court lawyer Shadan Farasat tells me that Section 43 read with Section 66 of the IT Act makes it clear the government cannot hack phones, even on grounds of national security. It’s quite simply a cybercrime. This is reinforced by Sections 66C, 66D, 66E and 66F.
However, the New York Times reports “a person familiar with NSO contracts” has told the newspaper that Pegasus was sold to India along with six other countries. Now the NYT is not only highly regarded but meticulous for checking what it publishes. Many might believe the paper rather than Mr Prasad.

However, for argument’s sake let’s accept that the government hasn’t bought Pegasus and see where that takes us. Since hacking has clearly been done, this would mean either a foreign government or its agencies are involved. Isn’t that still a matter of grave concern? At the very least, a democratic government committed to defending the rights of its citizens would immediately order a full inquiry. France has already done so.

At this point, let’s return to three other government responses. Ravi Shankar Prasad claims the Pegasus expose has been done in revenge for the government’s handling of Covid-19. I’m not sure what he means. For a start, does he believe the handling was good or bad? He did not say. But either way, why would this be grounds for revenge? And by whom? Frankly, this is utter nonsense.

Then there’s the argument put forward by the home minister. “Chronology samajhiye”, he says. He claims the fact the story broke on the eve of the Indian Parliament’s Monsoon Session proves it’s designed to target India and is a report “by disruptors and obstructors”. But why on earth would 16 other media organisations consider the eve of India’s Monsoon Session the right time for them? In fact, Le Monde, the Washington Post and the Guardian often decided the publication date. And remember, the biggest revelation is the claim the French President, Prime Minister and 14 members of the country’s Cabinet were targeted. That clearly overshadows the Indian side of the story. Does the home minister really believe French journalists would time this to coincide with the start of the Indian Parliament?

Finally, there’s what the new IT minister said in Parliament. He claims NSO has said some of the countries listed in the Pegasus expose as its clients are incorrect. Perhaps. Even, very possibly. But so what? That doesn’t mean India is not a client. And if he thinks it does, then he has to face the reality of foreign governments and agencies hacking the phones of Indian citizens.

Now, let’s approach this differently. Let’s ask: Does the list of actual or potential targets suggest a foreign government or agency would be interested in hacking their phones or does it corroborate the belief this is the work of our government or one of its agencies? The list includes Rahul Gandhi and his friends, a former election commissioner, private secretaries of former chief ministers and Union ministers, a top virologist, an election analyst, a woman who accused a former Chief Justice of India of sexual harassment and several members of her family, a director of the Bill and Melinda Gates Foundation, Mamata Banerjee’s nephew, industrialists and Kashmiri and Naga separatists. Could anyone really believe a foreign government or agency would want to hack their phones? To ask is to answer the question.

Frankly, there’s only one thing the government should do and as quickly as it can: take the chief executive of NSO, Shalev Hulio, at his word and demand an immediate investigation. He’s told the Washington Post he’s “very concerned”.  His company statement says it will “investigate all credible claims of misuse and take appropriate action”. To the Post, Mr Hulio said two clients have earlier been suspended for misuse. Other newspapers report the number is five. All of this is an excellent basis for insisting that Mr Hulio and NSO thoroughly investigate the Indian side of the story, reveal the full truth and take effective action.

But will the Narendra Modi government do this? I doubt it. In 2019, when the IT ministry confirmed to Shashi Tharoor’s parliamentary standing committee that 121 people were affected by Pegasus, including it seems members of the department of atomic energy and the Kudankulam nuclear plant, it did nothing. I expect a very similar response this time.