It was a high-seas drama involving an Arabian princess and Indian commandos. But now there’s a new twist to the tale: Princess Latifa who was fleeing her father, the billionaire ruler of Dubai, may have been located and violently captured in the Indian Ocean thanks to a phone infiltrated with Pegasus spyware.

That’s one of the latest revelations from the mushrooming scandal involving mobile numbers selected as targets or potential targets of surveillance software supplied by Israel’s NSO Group. Once again, India has a starring role. Let’s be clear: India is only one of 40 countries that allegedly bought Pegasus spyware. But India and Mexico are the only democracies alongside a motley crew of dictators and royals who are almost absolute rulers. Inevitably, a considerable amount of press coverage has been focused on us.

Make no mistake about it. Pegasus has global ramifications and questions surrounding it are being asked around the world. For instance, was it India or another country that attempted to install Pegasus software on Pakistan Prime Minister Imran Khan’s phone? And which countries sought to eavesdrop on the phones of three presidents including France’s Emmanuel Macron, seven prime ministers and Morocco’s King Mohammad VI? Human rights group Amnesty International has called for international regulation to rein in “an unchecked surveillance industry”.

The Guardian, one of the media consortia that have uncovered the stories around Pegasus, clearly believes Prime Minister Narendra Modi has played a key role in the bugging of leading political figures, journalists and even a virologist in India. Alongside a large photo of Modi, The Guardian carried a headline that blared: “Attack on democracy”. On a similar note, The Washington Post said: “The confirmed infections of seven phones represent a tiny fraction of what may be a vast surveillance net in Modi’s India.”

NSO, which licenses the Pegasus spy software to what it says are “vetted governments” with good human rights records, insists that Princess Latifa’s friends’ phones appearing on a database of numbers that may have been infiltrated or selected for infiltration have nothing to do with the company. NSO, incidentally, ended its business dealings in Dubai last year. (It’s impossible to say what role the spyware may have had in Latifa’s capture without being able to analyse the devices).

Concern in France

The greatest consternation about the spyware scandal appears to be in France where the numbers of President Macron, his former prime minister and 14 cabinet members appear on the leaked database of 50,000 numbers. There are suspicions – which are hotly denied – that the Moroccan government may be behind efforts to listen in to French government ministers.

Among the French government numbers are several said to have been infiltrated or sought to have been infiltrated by Pegasus spyware – though NSO denies this. French government spokespersons said multiple investigations are being launched into potential leaks. Macron’s spokespersons said the president used his mobile phones only occasionally and was careful to use only scrambler phones for government business.

In Britain, too, several numbers including Lady Uddin, an influential member of the House of Lords, appear on the database of numbers that may have been infiltrated. Another target appears to be the current Financial Times editor Roula Khalaf. Also in the UK, there are indications that lawyers representing Haya, a former wife of Dubai’s Sheikh Mohammad, may have been tapped. Said The Guardian: “The principal government responsible for selecting the UK numbers appears to be the United Arab Emirates, according to the analysis of the data.” Incidentally, NSO insists it does not allow the tapping of US +1 code phones. However, phones in European countries have clearly been targeted. Also, a friend of murdered Saudi dissident Jamal Khashoggi was targeted in Canada.

Blow to communications systems

On an entirely different level, the Pegasus scandal has been a gigantic blow to what were said to be secure communications systems like WhatsApp, Telegram and Signal. What’s especially galling is that Telegram founder, the low-profile Pavel Durov, may also have had his phone spied on. Says one security expert: “It appears these systems are almost defenceless against Pegasus.”

In Israel, the debate has been entirely different and inward-looking. The country’s having a self-questioning moment, looking at the way its government, particularly former military and security personnel, are tied up with companies like NSO, the Pegasus maker. An Israeli court, for instance, recently ruled that defence export issues couldn’t be looked into by the courts. This was in a case relating to the sales of hi-tech software to Russia. The Israeli government is, however, clearly desperate that the Pegasus scandal should not affect its highly lucrative defence export business.

NSO initially reacted with a mix of defensiveness and insistence that it could not monitor what its clients did with the Pegasus software. NSO Chief Executive Shalev Hulio said: “Every allegation about the misuse of the system is concerning me. It violates the trust we have given customers. I believe we need to check every allegation." Pegasus is only supposed to be used to counter terrorism or serious crime.

NSO: no comment from now on

However, on Wednesday, NSO said it would not be answering any further questions about the spyware scandal.

The global investigation began after Forbidden Stories, a Paris-based journalism non-profit and Amnesty International gained access to a leaked database with 50,000 phone numbers worldwide. An investigation was supervised by Forbidden Stories and shared with news outlets worldwide.

And what of Princess Latifa? After her daring flight from Dubai in February 2018, she boarded a chartered yacht captained by an ex-French spy, planning to seek US asylum. Her escape failed as Indian commandos stormed the yacht 50 kilometres off India’s coast. Latifa was dragged off the boat and handed over to Emirati forces who returned her to Dubai. It seems the mobile numbers for Latifa and her friends in Dubai were tracked by Pegasus, allowing for her capture.

After the UN appealed to Dubai to show “proof of life” of Latifa, the princess, who had accused her father of inhumane treatment including beatings, recently appeared in a photograph allegedly taken at Madrid airport with a friend. Dubai’s royal family said she was “being cared for.”