More evidence crops up to link Intelligence Bureau (IB) to Pegasus spyware

The Organised Crime And Corruption Reporting Project (OCCRP), an international group of investigative journalists and experts, on Thursday reported that India’s Intelligence Bureau, had received a consignment from NSO by air in April, 2017. The details of the hardware mentioned in the invoice matches similar hardware supplied by NSO to other countries for deployment of the Pegasus spyware. The hardware details in turn figured in a brochure submitted by NSO to a court in the United States.

While the OCCRP report, which can be accessed at occrp.org, is cautious in saying that the invoice alone cannot conclusively prove the deployment of the military grade spyware by the IB, the Pegasus project, another consortium of investigative journalists, with assistance from Citizens Lab in Canada had accused India’s government agencies of deploying the spyware to snoop on opposition politicians and journalists.

A Supreme Court-appointed technical committee too, while confirming the presence of malware in some of the smart phones submitted to it, stated that it was not able to conclusively prove the use of Pegasus. Government of India, which has merely denied any ‘unauthorised’ surveillance in Parliament and outside, refused to confirm or deny if it had bought the spyware, citing security concerns.

These are some of the points made by OCCRP in its report:

• Import data reviewed by Organised Crime and Corruption Reporting Project (OCCRP), a global network of investigative journalists, shows that in April 2017 the New Delhi-based Intelligence Bureau (IB) received a shipment of hardware from NSO in Israel matching the description of equipment used elsewhere to run Pegasus software.

• The consignment included Dell computer servers, Cisco network equipment, and “uninterruptible power supply” batteries, which provide power in case of outages, according to a bill of lading obtained through a global trade data platform that draws on national customs documents.

• The shipment, delivered by air, was marked “for Defence and Military Use” and cost $315,000. That description — and the timing of the shipment — appeared to match the account given in January by the New York Times, which reported that Pegasus and a missile system had been “centerpieces” of a major 2017 arms deal between Israel and India.

• The conclusion of that deal was announced on April 6 that year by Israel Aerospace Industries, which was contracted to supply missile defence systems, a week and a half before the customs documents show the shipment took place.

• It is not possible to say conclusively whether the imported hardware was used for Pegasus. But the specifications resemble those laid out in a brochure for Pegasus spyware submitted to a US court in a lawsuit filed against NSO Group by Meta, the parent company of Facebook and WhatsApp, in 2019.

• The NSO Group and the Intelligence Bureau did not respond to questions about the shipments sent by OCCRP.

• The brochure — which notes that “necessary hardware is supplied with the system upon deployment” — outlines the need for two computer racks, network equipment, servers, network cables, and batteries to keep the servers running in case of outages. This hardware is needed to run the Pegasus platform and store data extracted from mobile phones.

• Two intelligence officials — a senior officer and a contractor — also told OCCRP that Pegasus had been purchased by the government in 2017. Both spoke on condition of anonymity because their jobs prohibited them from speaking publicly.

• There is no formal law to regulate the Intelligence Bureau, and its constitutionality has been challenged repeatedly in recent years.