More than a week after the Pegasus surveillance scandal broke, the shockwaves it set in motion are still lashing India’s political establishment.

A 17-member global media collective, led by the Paris-based non-profit journalism group Forbidden Stories, had been studying leaked data on the use of Israeli cyber firm NSO’s highly intrusive Pegasus software for many months with the help of Amnesty International’s technical team. On July 18, the group released the first lot of its findings. It revealed that a few hundred Indians, mostly politicians, activists and media persons, were targeted for hacking using Pegasus.

All through last week the group came out with more findings of its Pegasus project. It said that before the 2019 parliamentary elections in which Prime Minister Narendra Modi won a second five-year term, then Congress President Rahul Gandhi was targeted in a surveillance operation. Some of his personal friends were also targeted.

Others in the watch list included Ashok Lavasa, a member of the Election Commission of India, and Prashant Kishor, an election strategist whose services are sought by multiple parties. Ahead of the crackdown in Jammu and Kashmir and abrogation of Article 370, which gave the state a special status, about 25 state leaders were targeted. Tibetan Buddhist leader Dalai Lama, who has been living in exile in India for more than six decades, also figured in the list. He was targeted before his US visit for talks with President Barack Obama.

A woman staffer of the Supreme Court, her husband and his brother, both of them Delhi cops, were also on the list of targets. They came on it after the woman, in an affidavit sent to all judges of the court, alleged sexual harassment by then Chief Justice Ranjan Gogoi.

Eleven phones belonging to her family formed the largest cluster in the India-leg of the media collective’s Pegasus project.

The Wire, the Indian member of the collective, said it sent to the Prime Minister’s office a detailed query about this cluster of phones. It received a reply from the Information Technology Ministry, saying allegations regarding government surveillance on specific people had “no concrete basis or truth associated with it whatsoever.”

The apex court exonerated Gogoi through an in-house process. Thereafter the legal and administrative measures initiated against her and her relatives ended.

The Wire said the presence of 11 linked numbers in the list of targets raises troubling questions about privacy, gender justice and the integrity of the legal process she had set in motion with her affidavit. That entire process now stands vitiated by the possibility that the phones of the woman and her family might have been monitored on instructions from officials, it added.

The media collective advisedly used the term ‘targeted’ in its reports as it could not say a phone had been hacked until it was forensically examined at a cyber lab. The Wire said it could get 10 phones examined, and they had all been hacked.

The telephones of Rahul Gandhi and the Supreme Court staffer’s family were not among them.

France, Mexico and Morocco were among the other Pegasus-infected countries that figured in the study.  President Emmanuel Macron was one of the French targets.

“Whodunnit?” is a question that naturally arises when a scandal of this kind comes to light. The makers of Pegasus have repeatedly affirmed that they supply the spyware only to governments and their security and law enforcement agencies. This rule out private players using its ware. The French newspaper Le Monde reported that Morocco was behind the tapping of Macron’s phone.

Indian government or media did not implicate any foreign government or agency in the Pegasus infection in the country. In its first reaction to the media disclosures, the government said the release of the report a day before Parliament began a new session was proof of a conspiracy to malign Indian democracy.

IT Minister Ashvini Vaishnaw, who responded on behalf of the government, dismissed the Pegasus project reports as sensationalism with no substance behind it. He pointed out that NSO had denied the reports.

Incidentally, the NSO statement he referred to had tried to deflect attention away from Pegasus, and possibly also the Indian government, by saying such spyware were available “to anyone, anywhere and anytime.”

When Vaishnaw, who is a bureaucrat, issued the denial he could not have known that within hours the media collective’s next report will reveal that he and his wife, too, had been targeted. That was in 2017, before he joined the Bharatiya Janata Party. He became IT Minister only a few days ago.

Prahlad Patel, a Minister of State, was also targeted at that time, the Wire said. The Opposition parties have been crying hoarse, demanding that the government state categorically if it has bought Pegasus ware. They are barking up the wrong tree.

The Pegasus issue first came up in 2019, following reports that several Indian politicians, activists and journalists were among 1,400 WhatsApp users worldwide, whose phones had been infected by it.

Ravi Shankar Prasad, then IT Minister, told Parliament there was no “unauthorised use” of Pegasus by government agencies in India. Did that statement not involve a tacit admission that there was authorised use of the spyware?

Indian law permits Central and state governments to tap telephones in the interests of national security. It provides for an oversight mechanism, which is under bureaucratic control. The government appears to use the law without sufficient concern for citizens’ rights.

Pegasus is a malware that can infect a phone with a missed WhatsApp call and not leave a trace behind. In a suit filed against its Israeli makers in a US court, WhatsApp says it is like a cyber weapon.

The Opposition parties must ask the government to stop using this lethal weapon against citizens. They must also demand an immediate end to wanton misuse of the legal provision that permits phone tapping.

The Constitution envisages a system of mutual checks and balances. It is for Parliament and the Judiciary to step in and restrain the Executive from using a power, granted to it in the interests of national security, to snoop on the government’s critics.

Parliament’s Committee on Information Technology, headed by Shashi Tharoor of the Congress, has scheduled a meeting this week to discuss the Pegasus issue.

When it took up the matter in 2019 the BJP members had blocked effective scrutiny of misuse of the legal provision. One of the items to be considered at this week’s meeting is “Pegasus spyware supplied to several governments worldwide.” This may be a red herring across the trail.

Most of the suspected snooping cases mentioned in the media collective’s Pegasus project reports are far more likely to involve Indian agencies than foreign agencies.

Some concerned citizens have raised the Pegasus matter before the Supreme Court. It must take up the issue at the earliest and ensure that the citizen’s rights are protected.