Pegasus hacked WhatsApp, but Galileo was not far behind.

Emails from the Wikileaks stash can establish several years of interactions between an Italian spyware company called the Hacking Team and Indian brokers who explicitly stated that the clients they were speaking for were police forces of different states and the cabinet secretariat.

The spyware that the Hacking Team made was at various times called Galileo, Da Vinci and the Remote Control System Intelligence module.

The Wikileaks emails date back to 2011, when the UPA II government was in power, and stretch to 2015, when the BJP-led government of Narendra Modi had already taken charge in New Delhi.

The emails, many of which were exchanged between an east Delhi-based company called the Semco Group, and the Hacking Team based in Milan, demolishes the secrecy that governments try to maintain on spyware. In their defence, government representatives and spyware makers say such software is used to track rogue elements working against the state such as terror outfits, which is why the secrecy is required.

But the hacking of WhatsApp accounts by NSO Group's Pegasus has shown that ordinary citizens were targeted. Citizen Lab, which investigated the hacking along with Facebook, has said that such software is generally bought by governments, not individuals.

The current Indian government has not spoken with any clarity on how the Israeli spyware Pegasus was used to hack into accounts of several rights activists, journalists and lawyers.

Two things are unclear from the exchange of mails. First, whether the Indian government, either under the UPA or the NDA, actually bought the Galileo spyware from the Hacking Team. Second, if the spyware was used to target ordinary civilians.

This website contacted Semco for details. Its director Neeraj Kumar Singhal accepted that the company had 'several clients including some government agencies' who were interested in Galileo. 'But there was no deal,” he said.

Among the many mails exchanged between Semco and the Hacking Team was one in which the Italian company had shared details about Galileo's efficacy. The mail, dated July 17, 2014, was written by a Hacking Team representative David Maglietta and sent to four email IDs in Semco.

The mail from Semco to the Hacking Team that listed the clients. Source: Wikileaks

While the mails do not reflect the conclusion of a deal, they do reflect the Indian government's and its police forces' keenness for spyware shopping, ostensibly to track terrorists and extremists.

During negotiations, the Hacking Team was asked by government agencies for a demonstration of their product. In one such chat within the firm, a Hacking Team official spoke of a “webinar” where the demonstration “went well” with the Intelligence Bureau. The same chat revealed that the IB had requested the Italian firm for a “schematic diagram about how and to install the Injector at the telecom service providers end or where in the cable connection of the target”.

The target would be the device being hacked into.

In another mail, a police officer from Bengal wrote to the Hacking Team asking about Galileo and expressed interest in buying it. The officer, Ranendra Nath Banerjee, wrote he was a deputy commissioner. He sent the mail from the account ats.bdncp@policewb.gov.in.

In another mail, Semco listed the clients it was speaking to for selling the spyware. These were the the Cabinet Secretariat, Andhra police's special intelligence branch, Gujarat and Karnataka police's intelligence branches, Delhi police's special branch and economic offences wing and Mumbai police's anti-terrorist squad.

The July 17, 2014, mail from the Hacking Team to Semco. Source: Wikileaks

According to the emails, the government agencies did not communicate with the Hacking Team officials directly but through several private firms at different times. Semco India was one of them. The others were Titan Overseas Corporation Limited and Sunworks India, based in Maharashtra and Gurgaon as well as Nice Limited, an Israeli consultancy firm that has a branch in Pune.

The mail that was sent by the Bengal police officer to the Hacking Team Source: Wikileaks