The Congress on Sunday cited a US court verdict holding Israel’s NSO Group liable for the intrusive use of its Pegasus spyware and asked whether the Supreme Court would further probe the alleged hacking of 300 Indian WhatsApp users, including Opposition
politicians.

Media reports had said in 2021 that the Pegasus spyware — sold only to governments — had been used to snoop on three Opposition politicians, at least two serving BJP Union ministers, a judge and several journalists, activists and businesspeople in India. The Narendra Modi government and the NSO Group had dismissed the charges.

The US District Court for the Northern District of California on Friday found the NSO Group liable for the hacking of the devices of 1,400 WhatsApp users in 2019.

Congress leader Randeep Surjewala seized on this verdict on Sunday to allege that these 1,400 users included 300 Indians and posed several questions to the Modi government.

“The #PegasusSpyware case verdict proves how 300 WhatsApp numbers of Indians were targeted in the illegal spyware racket,” he said in a long post on X.

“Time for Modi Govt to answer: Who are the 300 names targeted! Who are the two Union Ministers? Who are the three Opposition leaders? Who is the Constitutional Authority? Who are the Journalists? Who are the business persons?”

Surjewala added: “What information was retrieved by the BJP Govt and agencies? How was it used — misused and to what consequence? Will appropriate criminal cases be now lodged against political executive/ officers in the present Govt and company owning NSO?”

The Supreme Court had in 2021 formed a technical committee to probe the Pegasus snooping allegations, as sought by several petitions. The committee handed in its report in 2022 saying it had found no conclusive evidence of illegal surveillance through Pegasus. The full report was never made public.

However, the Supreme Court did say that the technical committee had complained that the “government has not cooperated fully” with its investigations.

“One thing the committee had said is that the government has not cooperated fully with the task to examine the phones for malware or spyware,” a bench headed by then Chief Justice of India N.V. Ramana said.

Surjewala said: “Will Supreme Court take note of the judgement of US Court in Meta V/S NSO? Will the Supreme Court proceed to make public the report of Committee of Technical Experts on Pegasus Spyware, submitted to it in 2021-22?

“Will the Supreme Court now conduct further inquiry in view of the judgement affirming targeting of 1,400 WhatsApp numbers, including 300 from India? Will the Supreme Court now ask Meta to submit to itself the 300 names to meet the ends of justice in the Pegasus case?”

In the US, Meta-owned WhatsApp had filed the lawsuit accusing the NSO Group of exploiting a flaw in WhatsApp to enable the installation of the Pegasus spyware on users’ devices. The case will now head for trial to determine the damages the NSO Group must pay.

Surjewala said Meta was now “duty” bound to release the names of the Indians who were allegedly targeted with the spyware.

“Shouldn’t Facebook (now Meta) now have responsibility to release the names of 300 Indians targeted by Pegasus, considering what’sapp and facebook have the biggest subscriber base in India and they have ‘duty of care & disclosure’ to its clients in India?” he wrote.

“The nation wants to know,” Surjewala wrote in block letters in conclusion.

When media reports in 2021 alleged illegal surveillance using Pegasus, then information technology minister Ashwini Vaishnaw had said in a statement in Parliament that the allegations of phone hacking had “no substance”.

Some media reports, however, claimed that the IT minister may himself have been targeted via Pegasus, purportedly by his own government.

A 2022 study by the Boston-based firm, Arsenal Consulting, suggested the 84-year-old priest and tribal rights defender Stan Swamy, who died in custody in 2021 after his arrest in the Elgar Parishad-Maoist links case, was a victim of spyware.

It said fabricated “evidence” had been planted on the priest’s computer – as well as the devices of some of his co-accused — using spyware. It did not identify the spyware.

In December 2023, a joint investigation by human rights group Amnesty International and US newspaper The Washington Post suggested that Pegasus had been used to hack the mobiles of two Indian journalists in August and October that year.

The Post’s report quoted unnamed sources at Apple as claiming that the Modi government had pressured the company to play down its alert to customers that their iPhones had been targeted by “State-sponsored attackers”.

In October 2023, several Opposition politicians, journalists and at least one academic had received such alerts from Apple. Apple didn’t reveal who these attackers were or which State they worked for.

In the US court, the NSO Group had argued that the Pegasus software was legitimately used by law enforcement and intelligence agencies to fight terrorism and organised crime. The court, however, dismissed the firm’s “conduct-based immunity” claim.