Pegasus spyware: Human rights concern in India amidst 'thriving' spyware industry

By Rashika Agarwal* 
Despite inflicting havoc on human rights around the world, the commercial spyware industry thrives. According to a Citizen Lab analysis, the market remains resilient, with a rising concentration on digital forensics, which pulls information from target individuals' digital devices.
The inventory assesses which governments have purchased commercial spyware, digital forensics tools, and the companies that developed them. It also explored how states use these technologies and where firms are based. As a result, it became clear that these invasive technologies were widely used against political dissidents, journalists, and civil society activists.

Rising concentration on digital forensics: Exploiting target Individuals' data

The current dataset comprised instances spanning the years 2011- 2023, and it included two types of targeted surveillance technologies: spyware and digital forensics. Citizen Lab representatives advised that democracies take steps to limit the export of these tools and improve the transparency of these sales. Companies should use ethical practises and human rights due diligence while developing and selling these products, they said.
As spyware and digital forensics tools are widely available around the world, it has become easier to look for flaws and exploit them for access purposes. This involves utilising fake news to persuade someone to click on a link that has a malware payload. The infection then grants the actors access to the user's digital gadgets.
Furthermore, by boosting connectivity across multiple platforms, the use of digital signage in public spaces, schools, and hospitals has opened the door to a larger attack surface. Therefore, the industry for digital forensics is subject to little oversight.

Exploitation and invasive use: Targeting political dissidents, journalists and activists

Citizen Lab's results show that over two thousand law enforcement agencies at the municipal, state, and federal levels in the United States alone purchased phone extraction technology to investigate cases involving not only severe crimes, but also lesser offences such as shoplifting and graffiti.
Municipal police departments, local sheriff's departments, state departments of public safety, and local and federal district attorneys are among these entities. While industry insiders claim that the digital forensics market aids in the tracking of criminal activity, it is reasonable to question law enforcement's responsibilities to respect individual privacy.
Individuals' location information, for example, may be freely accessible via GPS, which can be a worry in the event of information leaks or more intrusive monitoring activities. If merely two thousand law enforcement agencies in the United States have this phone extraction technology, it is safe to assume that the number of people affected will be large.
According to the research, the advent of digital forensics has offered greater options for governments to directly infringe on people's rights to privacy because information can be extracted in real-time and a device does not need to be in the hands of the government to access its data. 

Governments and law enforcement agencies have relied on phone extraction tools to crack the passcodes of targeted devices, and tools like Cellebrite and Grayshift have become household names among government agencies, granting them access to data that was previously thought to be impossible to obtain.

The Pegasus spyware scandal: Government surveillance exposed and global protests emerge

One such glaring example of the same in Indian context is the recent Pegasus spyware scandal. It generated worldwide protests and requests for transparency and accountability from governments. The story revolves around the NSO Group, an Israeli firm that sells spyware to governments. Pegasus is a sophisticated tool for hacking into smartphones and collecting data such as text messages, emails, call logs, and location data.
Pegasus was proven to have been used to target journalists, activists, and government officials of the nation in 2021. This disclosure has sparked worldwide indignation and calls for countries to examine Pegasus's use and take steps to protect their citizens' privacy.
The Pegasus controversy has sparked protests and rallies in various Indian cities. Protesters have asked that the government investigate Pegasus's use and punish those responsible accountable. They have also urged the government to be more transparent and accountable in its use of surveillance technology.

The Pegasus controversy has brought to light the hazards of government surveillance and the significance of safeguarding citizens' privacy. It has also demonstrated that governments are prepared to employ sophisticated surveillance techniques to target their own citizens. This is a concerning trend, and governments must be held accountable for their use of surveillance technology.

Lack of oversight: The unregulated industry of digital forensics

The Pegasus spyware incident should serve as a wake-up warning to governments all around the world. It has demonstrated that governments are willing to utilise formidable surveillance capabilities to target their own citizens, raising concerns about the possibility of governments abusing their power.
Citizens are no longer willing to tolerate government surveillance without control, as seen by the growing demand for transparency and accountability. Governments must respond to this demand by being more transparent about their surveillance activities and putting protections in place to preserve citizens' privacy.
Lawyers and human rights groups have warned that, despite their potential for misuse, these tools are frequently sold without sufficient monitoring and are not subject to any legal limits. As a result, cybersecurity professionals and human rights advocates have asked for commercial spyware sales and export to be regulated to better protect residents' privacy.

Protecting human rights: Demanding transparency, accountability and regulation

Democracies must take action to curb the commercial spyware technology sector if they truly want to protect human rights. The key recommendations include limiting the exports of these tools and requiring the corporations engaged to implement rigorous human rights due diligence practices. Furthermore, democracies must increase openness beyond spyware and digital forensics sales.
They also demand that lawmakers hold law enforcement agencies more accountable for the use of such technology. The authors conclude that if democracies do not act to curb the development of these activities, the market for these technologies will become more invasive, with major consequences for human rights and privacy.
In conclusion, despite its well-documented link to severe human rights breaches, the industry for commercial spyware and digital forensics remains resilient. The report by Citizen Lab reveals widespread exploitation of these surveillance tools against political dissidents, journalists, and civil society actors around the world.
At the moment, proper regulation is lacking, allowing governments and law enforcement organizations all over the world to easily invest in such technologies. As a result, democracies must set stringent legislative limits on the export of these technologies to authoritarian governments. This will offer the framework required to safeguard persons against violations of their basic human rights.
---
*Indian Institute of Management-Ahmedabad, PGP | 2022-24