Explained: NSO, Pegasus and their tryst with 'state-sponsored spying'

An investigation by a global media consortium based on leaked targeting data has put the Central government on the defensive. The report says that more than 300 verified mobile phone numbers, including of two serving ministers, over 40 journalists, three opposition leaders, and one sitting judge besides scores of business persons and activists in India could have been targeted for hacking through an Israeli spyware called Pegasus sold only to government agencies, an international media consortium, including The Wire from India, reported on Sunday.

What's NSO and its product Pegasus?

At the centre of the controversy is an Israeli cybersecurity firm named NSO and its product Pegasus. The company, founded by Halev Hulio and Omri Lavie in 2008, soon got attention from the who's who of the Western spy world after it developed a technology that allowed cellphone makers gain remote access to their customers’ devices for maintenance—a pure commercial purpose.

The advent of social media and encrypted messages posed a fresh challenge of "going dark" to track terrorist organisations. However, Pegasus, the mobile surveillance tool bypassed the hurdle by infiltrating phones to vacuum up personal and location data and surreptitiously control the smartphone's microphones and cameras. In the case of journalists, that lets hackers spy on reporters' communications with sources. The programme is designed to bypass detection and mask its activity. NSO Group's methods to infect its victims have grown so sophisticated that researchers say it can now do so without any user interaction, the so-called zero-click' option.

Pegasus infects individuals’ phones by sending them text messages that tempt them to click an attached link. If the target clicks on the link, the company gains full control over the phone, including its contents and history, and the ability to activate its microphone and camera at will.

Almost a decade after its inception, NSO offers solutions to "governments on every continent except Antarctica." 

Not a strangers to controversies 

However, this is not the first time that NSO and Pegasus has found itself hogging limelight for unscrupulous spying. The NSO Group came to prominence in 2016 when researchers accused it of helping spy on an activist in the United Arab Emirates.

The Herzelia-headquartered company shot to instant infamy after it was linked to the assassination of journalist Jamal Khashoggi. It was alleged that Saudi Arabia (read Crown Prince Mohammed bin Salman or MBS) used NSO tools to spy on Khashoggi and his closest contacts, before the Washington Post columnist was murdered inside the Saudi consulate in Istanbul. It is to be noted that without access to Khashoggi’s devices, researchers have not been able to confirm the allegations of NSO surveillance. NSO, for its part, was quick to deny the charges.

In October 2019, WhatsApp sued the NSO Group, accusing it of using the Facebook-owned messaging service to conduct cyberespionage on journalists, human rights activists and others. The suit filed in a California federal court contended that NSO Group tried to infect approximately 1,400 "target devices" with malicious software to steal valuable information from those using the messaging app.

Just months later, reports again linked it to MBS accusing him of targeting Amazon boss Jeff Bezos in May 2018 during a meeting with the Saudi Crown Prince. The forensic analysis cited by the UN experts showed that the Crown Prince, Saudi Arabia's de facto ruler, sent WhatsApp messages to Bezos in November 2018 and February 2019 in which he revealed information about Bezos's personal life not available from public sources. 

The Israeli company was sued the previous year in Israel and Cyprus, both countries from which it exports products. The plaintiffs include Al-Jazeera journalists, as well as other Qatari, Mexican and Saudi journalists and activists who say the company's spyware was used to hack them.

Several of the suits draw heavily on leaked material provided to Abdullah Al-Athbah, editor of the Qatari newspaper Al-Arab and one of the alleged victims. The material appears to show officials in the United Arab Emirates discussing whether to hack into the phones of senior figures in Saudi Arabia and Qatar, including members of the Qatari royal family.

NSO Group does not disclose its clients and says it sells its technology to Israeli-approved governments to help them target terrorists and break up pedophile rings and sex- and drug-trafficking rings. It says its spyware is neither designed nor licensed for use against human rights activists or journalists. It says it has helped save thousands of lives in recent years. It denies its technology was in any way associated with Khashoggi's murder.

What is the latest investigation's significance?

"Stop what you're doing and read this. This leak is going to be the story of the year," Snowden tweeted Sunday, referencing the consortium's findings. The latest explosive report looks into an investigation conducted by Paris-based media non-profit organisation Forbidden Stories and rights group Amnesty International into a leaked list of more than 50,000 phone numbers from across the world that are believed to have been the target of surveillance through Pegasus software. The Wire reported that forensic tests conducted as part of the media investigation project on a small cross-section of phones associated with these numbers revealed clear signs of targeting by Pegasus spyware in 37 phones, of which 10 are Indian.

The government, however, dismissed allegations of any kind of surveillance on its part on specific people, saying it "has no concrete basis or truth associated with it whatsoever".

However, as usual, NSO has denied the claims. " After checking their claims, we firmly deny the false allegations made in their report. Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims. In fact, these allegations are so outrageous and far from reality, that NSO is considering a defamation lawsuit," it said, before highlighting, "We would like to emphasize that NSO sells it technologies solely to law enforcement and intelligence agencies of vetted governments for the sole purpose of saving lives through preventing crime and terror acts."