WhatsApp Told Centre About Breach of 121 Indians in May: Report

WhatsApp had informed the CERT-In team that 121 Indians were compromised by the NSO-owned spyware, a report said.

Pegasus spyware affects both Android and iOS devices.

(Photo: The Quint)

Besides notifying the Indian government about the breach of security in WhatsApp after the Pegasus attack, the Facebook-owned messaging platform also informed the Ministry of Information Technology about 121 Indians whose privacy was compromised by the Israeli spyware, The Indian Express reported.

This response from WhatsApp came after the Indian government sought an explanation from WhatsApp about 1,400 journalists and activists around the world, including a dozen Indian citizens being targeted by a surveillance through Pegasus.

Quoting sources, the report said that WhatsApp had attached the note it issued alerting users of the security breach in May and a separate letter was sent informing the CERT-In or the Indian Computer Emergency Response team that 121 Indians were compromised by the NSO-owned spyware.

The Centre had denied having any information of the spyware and was reportedly upset with WhatsApp for not bringing up the issue during the high-level meetings with WhatsApp CEO Chris Daniels and Facebook VP Nick Clegg held earlier this year.

Some also pointed out that the note filed with Cert -In (CIVN-2019-0080) on May 17 had apparently disappeared from its site for sometime.

Sources in the government told The Indian Express that its note in May expressing a “buffer overflow condition error” vulnerability in its app was “too technical a jargon”. Moreover, the note didn’t have any mentions of Indian targeted users being compromised.

In a different report, The Indian Express quoted government sources questioning the timing of the WhatsApp’s case against the Tel Aviv-based NSO group that owns this spyware.

“The timing is full of suspicion and a lot of suspicious circumstances are there. How is it that they have picked up those elements who are most hostile to the government — Elgar Parishad, Bastar, Kabir Manch. How has WhatsApp picked them up selectively from some school in Canada? This is all too much of a coincidence. Select people who are anti-Modi government,” The Indian Express quoted the source as saying.

On 1 November, in a response to The Quint’s queries, the NSO group said that while “it is not able to disclose who is or is not a client”, the company sells its software products only to government entities.

Former home secretary GK Pillai told The Quint on Friday, 1 November, that he is aware that Israeli tech firm NSO had been operating in India – and that it had sold spying software to private firms and individuals in the country.

He also confirmed that Indian government agencies have bought spyware in the past from private foreign tech firms like NSO. In fact, he said, “it is quite common.”