Minister of Law and Justice, Ravi Shankar Prasad made a statement with respect to the “Reported Use of Spyware Pegasus to Compromise Phone Data of Some Persons through WhatsApp” as raised by the Minister of Parliament Digvijay Singh.
On 31-10-2019, there was news in Indian media reporting breach of data of few Indians via WhatsApp through spyware named Pegasus developed and marketed by an Israel based company namely NSO. The news also reported about a lawsuit filed by WhatsApp on 31-10-2019 in a Court at California, USA alleging that the Israeli NSO Group had targeted some 1,400 WhatsApp users globally with this spyware and had violated US and California laws as well as WhatsApp’s terms-of-service. The news report conveyed that more than 100 persons in India might have been affected by this Spyware. It has also been alleged by WhatsApp in their submission filed before the Court that the NSO Group has sold Pegasus spyware to government and private agencies.
In this matter, Ministry of Electronics & Information Technology (MeitY) took cognizance of the news reports and sought a report from the WhatsApp through an email sent to them on 1st November and seeking WhatsApp response by 4th November. WhatsApp sent a mail on 2nd November 2019 communicating the aspects relating to the exploitation of a vulnerability in their platform by spyware called Pegasus, developed by Israeli agency named NSO. As per WhatsApp, they had communicated this vulnerability to CERT-In on 20-05-2019 after it was detected and fixed in mid-May 2019.
As per WhatsApp, Pegasus was designed to be installed remotely on mobile devices using the Android, iOS, and BlackBerry operating systems. The NSO/Pegasus exploited vulnerabilities in operating systems and applications and used other malware delivery methods, like spear-phishing messages containing links to malicious code. According to media reports Pegasus could be surreptitiously installed on a victim’s phone without the victim taking any action.
“The Supreme Court has upheld privacy as a fundamental right. But the Supreme Court has also stated that a terrorist has no right to privacy; and the Supreme Court in the same judgment has also stated that a corrupt person has no right to privacy. Therefore, that is our Government’s commitment to the freedom of speech and expression on social media. Technology has brought empowerment. We need to understand that. But while technology creates opportunity, technology also creates challenges, and this privacy was the first challenge which the Supreme Court has already held. But, one thing we all need to understand. We all work under the overarching system of our Constitution where fundamental right freedoms are there, but, it is also subject to reasonable restrictions. Article 19(2) to (6) clearly says that in the interest of sovereignty and integrity of India, public order, friendly relations with foreign country, these can be reasonably controlled”.
“It is a coincidence that when the Government of India is pressing for traceability of offensive messages, America, Australia and England are joining that battle. Then suddenly a case is filed. We have not been given any name till date. We have given notice to CERT-In and sent a notice to them again. They have expressed their regret. We have said that we will audit your entire processes. We have also sent a notice to the NSO. A fight is going on in the US between The NSO and Whats App. It is their private battle where coincidentally names have come, including some of Indians.
The I.T. Act has a provision in which anyone can complain if he wants. Which has a fine of five lakh and a provision of three years’ imprisonment. Not even a single FIR has been filed till date. No complaint is made in the IT Ministry till date by anyone. But suddenly we find that the names come in the media and thereafter it becomes a political issue.
WhatsApp has not given us 121 names yet. Our view is very clear that whoever has a complaint, should file a case. The Government of India will help in that inquiry. But Government should not be involved into any phishing inquiry.
Rajya Sabha