National Security Agency (NSA) whistleblower Edward Snowden in his initial reaction on the Pegasus project said, “They are not security products, they are not providing any protection. They don't make vaccines, the only thing they sell is the virus,” The Guardian reported.
He went on to claim the revelations in the Pegasus project could just be the tip of the iceberg. A sneak peek into what has been happening domestically in India will make for a compelling argument that Snowden could be right in claiming the worse is yet to come.
Parental Control Softwares: Sneak Peek Into a Spyware’s Dashboard
Have you ever come across advertisements of parental control softwares?
At the outset, the software seems to be providing a platform where parents can monitor, safe to assume without consent, their children's online activity.
As per the experts, the picture gets murkier because the services are now becoming available at a price to private detective agencies, people suspicious of their partner and the latest addition — law enforcement agencies.
At a nominal price, you are offered a host of services that basically enables you to "own" the phone of the person being snooped upon. From call logs, text message logs, browsing history, recording and listening to incoming and outgoing calls, to remotely gaining MIC and camera control to record surround videos and voices — all the activities can be monitored remotely.
While the "lite" edition of this particular spyware for Android is available for $75 yearly, one will have to cough up double for the premium edition — $150. Two separate columns list out services that will be available under these editions. Once you choose to buy, you are routed to the online billing desk.
Difference Between Pegasus and Domestic Spywares
The major difference between Pegasus and domestically available spyware is that the former can be used to plant the malware remotely while it is not possible in the latter. One needs to have physical access to the device to plant the bug in the case of the domestic spywares being sold in the market as parental control apps.
While NSO Group, the Israeli cyberarms firm, which has developed Pegasus claims it provides its services only to "vetted" governments, there seems to be no checks and balances in place in the accessibility of domestic spywares, which can be made available to any individual.
Abuse in the Name of Parental Control?
Experts believe parental control is basically a front to give snooping access to clients. "In the name of parental control, these spywares are being used to snoop in cases of relationship discord, business and corporate rivalry etc. They are mostly exploited by detective agencies, who earlier used manual surveillance but bank a lot on these spywares now," Rakshit Tandon, a cyber security expert said.
An informed source inside a law enforcement agency told The Quint, that such spywares are being unofficially used in the department in surveilling suspects who are a person of interest in a case being investigated.
"We try to get physical access to the mobile when the suspect is called for questioning. Once the bug is planted, we can monitor their mobile activity remotely," a source said.
The source also admitted that information harvested from such means can only be used to gather actionable intelligence or anticipate the next move of a suspect, but can't be used as evidence in the court of law.
Hard to Track Developers
Unlike Pegasus, which is known to be developed by NSO, experts believe that though the use of domestic spyware is rampant, their developers largely remain anonymous. "There is no firm in India that claims it is developing spyware to snoop. These things don't come out in the public domain unless there is a whistleblower who takes it upon himself to expose it," Tandon said.
"There are two terms in hacking — offensive and defensive hacking. These spywares, part of the offensive hacking, are next-gen tools in cyber warfare. It is hard to trace the agency or firm behind it and where it is deploying," he added.
Online websites of most of these parental control softwares that provide a comprehensive idea about the features of the product barely have any information on the developers or whereabouts of the parent company behind it.
What Does Privacy Law in India Say?
In a landmark verdict in 2017, the apex court had held that the right to privacy is a fundamental right because it is intrinsic to the right to life. "Right to Privacy is an integral part of Right to Life and Personal Liberty guaranteed in Article 21 of the Constitution," the SC's nine-judge bench ruled unanimously.
Surveillance by government agencies is legal in India. The Indian Telegraph Act, 1885, deals with interception of calls, and the Information Technology (IT) Act, 2000, deals with interception of data.
Under Section 5(2) of the Indian Telegraph Act, agencies at the Centre and states or any officer specially authorised in this behalf by the Centre or state are permitted to intercept electronic communication “on the occurrence of any public emergency, or in the interest of the public safety”.
(At The Quint, we question everything. Play an active role in shaping our journalism by becoming a member today.)