The Indian government’s case against Rona Wilson, a jailed Indian activist and critic of Narendra Modi’s administration, is expected to face new scrutiny following allegations that his mobile phone was hacked using Israeli-made spyware just months before his controversial arrest.
A forensic analysis of Wilson’s phone by Amnesty International found evidence that it was infected with NSO Group spyware, called Pegasus, between July 2017 and March 2018, three months before his arrest on terror-related charges.
Wilson is part of a network of more than a dozen writers, lawyers and artists who advocated for the rights of indigenous communities and low-caste Indians and who have been detained since 2018.
Members have denied a range of terrorism offences including plotting to assassinate Modi.
Since then, evidence collected by digital researchers suggests that they have been subjected to intrusive digital weaponry. Activists and lawyers who have examined the cases have alleged they included serious “procedural irregularities” by Indian authorities.
Evidence cited against them had been planted on laptops used by the activists, including Wilson, according to research by US digital forensic science firm Arsenal Consulting.
The claim that Pegasus was deployed against Wilson by a government client of NSO is the most recent example of how digital surveillance tools appear to have been used against the campaigners.
The Guardian has previously reported that Wilson’s mobile number was included in a leaked database at the heart of the Pegasus Project, an investigation into NSO Group by the Guardian, the Washington Post and other media outlets.
The project was coordinated by the French non-profit group Forbidden Stories.
Once a phone is infected with Pegasus, operators of the spyware have total access, including the ability to intercept phone calls, read text messages, infiltrate encrypted apps and track an individual’s physical location. The spyware can also turn a mobile into a listening device by remotely controlling the mobile’s recorder.
The leaked database contained tens of thousands of phone numbers of human rights activists, lawyers, journalists and dissidents who are believed to have been selected as people of interest by government clients of NSO Group, which sells surveillance software.
While the data is an indication of intent, the presence of a number in the data does not reveal whether there was an attempt to infect the phone with spyware such as Pegasus, the company’s signature surveillance tool, or whether any attempt succeeded.
The database included not only Wilson’s number, but those of several members of an activist network who have been arrested over the past three years in India and charged with terrorism offences.
Amnesty International’s Security Lab, a partner on the Pegasus Project, reviewed two backups of Wilson’s iPhone shared by his defence team with Arsenal Consulting.
Etienne Maynier, technologist at Amnesty International’s Security Lab, said its analysis confirmed Arsenal’s findings that Wilson’s phone was compromised by Pegasus in July 2017, and again in February and March 2018.
In between these two periods, Amnesty found that Wilson’s phone was targeted with 15 SMS messages containing Pegasus attack links. Clicking on any one of these could also have compromised the phone.
“This case adds to the evidences revealed during the Pegasus Project about unlawful surveillance against human rights defenders in India using NSO Group’s products,” Maynier said.
“Amnesty International is calling for an independent, impartial and transparent investigation into the unlawful targeted surveillance against Rona Wilson and all other human rights defenders targeted by Pegasus in India.”
NSO has staunchly denied that the leaked database at the heart of the Pegasus Project is in any way connected to the company or its clients. NSO has also said that its government clients are only meant to use its surveillance tools to fight serious crime and terrorism and that it investigates credible allegations of misuse.
The Indian government has neither confirmed nor denied that it is a customer of NSO.
In a statement in response to questions about Wilson’s case, an NSO spokesperson said: “Without addressing specific countries and customers, the allegations raised in this inquiry are not clear.
“Once a democratic country lawfully, after due process, uses tools to investigate a person suspected in an attempt to overthrow a (democratically elected) government, this would not be considered a misuse of such tools by any means.”
NSO has been placed on a US blacklist by the Biden administration after it determined the Israeli spyware maker has acted “contrary to the foreign policy and national security interests of the US”.
India’s federal anti-terror body, the National Investigation Agency (NIA), has dismissed Arsenal’s findings, saying the company has “no locus standi to give opinion”, and noting that the Indian government’s own forensics lab discovered no malware on Wilson’s devices. Vijayanta Goyal Arya, a spokeswoman for the NIA, said the charging documents had been filed “based on prosecutable evidence”. She declined to comment on the new forensic findings.
Sanjay Kak, a film-maker and writer, who worked with Wilson on campaigns for the release of political prisoners, told the Washington Post that Wilson was a “quintessential self-effacing figure”.
“Ironically, he’s now at the other end of the very machine that he worked against,” said Kak.
India’s supreme court in October ordered an independent inquiry into whether the government used Pegasus to spy illegally on journalists, activists and political opponents.
The Pegasus Project, including evidence that an Indian opposition campaign manager was spied on during a heated state election contest, caused an ongoing uproar that has raised concerns over the shrinking space for dissent in the country.
