Dirty Tricks by State

SC-Appointed Pegasus Probe Committee Seeks Responses from Public on 11 Queries  https://thewire.in/law/sc-appointed-pegasus-probe-committee-seeks-responses-from-public-on-11-queries  The queries pertain to the safeguards in place to check state surveillance, the extent to which state surveillance is justified and seek suggestions on how to strengthen cyber security and balance individual rights with national security interests. 

https://pegasus-india-investigation.in/invitation-to-comment/  Link to on-line form to be filed. Questions are

1.Whether the existing boundaries of State surveillance  for the purposes of national security, defence of India, maintenance of public order, and prevention and investigation of offences, are well defined and understood?  any other purposes? 

2.  Whether the procedures and rules .. surveillance  are sufficient to effectively prevent unwarranted excessive routine use/misuse;

3. What substantive and procedural safeguards – would you suggest? 

3b) How can existing procedures be improved? 

4. What should be the grievance redressal mechanism

5: Should there be special safeguards, in what form,  for certain categories of persons?

 6: contexts and  extent of State immunity/access for acts of hacking,  unauthorised access etc

6 b)  legal mandates to share data with (IT)  intermediaries. Data Protection? 

7 Should the State be obliged to record or disclose surveillance technology/access ? To whom? What form? 
Should these records be accessible ?

8. Practicality and Feaseability  under the Indian federal constitutional framework,

9. steps  to improve  cyber security of the Nation and its assets?
Is there a need for a separate authority or organisation to (i) investigate cyber security vulnerabilities for threat assessment relating to cyber-attacks and (ii) to ensure cybersecurity of public and private digital infrastructure?

10. What laws and safeguards should be put in place by the State to protect its citizens from targeted surveillance by non-State/private entities and foreign agencies?

11 Any other suggestion

Second Israeli company exploited Apple flaw to hack into iPhones – report https://www.timesofisrael.com/second-israeli-company-exploited-apple-flaw-to-hack-into-iphones-report/ 3 February 2022,
Quadream’s REIGN spyware said to have used same exploit as NSO Group’s Pegasus, before being patched in September; clients also include Saudi Arabia

Bill Marczak, a security researcher with Citizen Lab, told Reuters that the company’s so-called “zero-click” abilities appeared to be “on par” with NSO’s. Three of the sources said NSO and Quadream’s exploits were similar because they leveraged many of the same vulnerabilities hidden deep inside Apple’s instant messaging platform and used a comparable approach to plant malicious software on targeted devices, in order to gain unauthorized access to data.

"India Bought Pegasus": Spying Scandal Resurfaces After New York Times Report |  Reality Check Feb 3, 2022   https://www.youtube.com/watch?v=vdpSfiKkzw8  

Pegasus Snooping Scandal: The New York Times reported that the Indian government bought the Pegasus spyware in 2017 as part of a multi-billion-dollar defence deal, reigniting the spying scandal. The opposition is on the warpath, with Congress' Rahul Gandhi accusing the government of treason.

< https://youtu.be/wuK1r7IWwzE  >

Transcript India's 2017 Pegasus Deal With Israel Involved Top Intel Leaders    https://thewire.in/rights/transcript-india-israel-2017-pegasus-deal-siddharth-varadarajan-ronen-bergman-interview  Israeli investigative reporter Ronen Bergman speaks at length about the explosive story he co-authored in the New York Times on the sale of Pegasus spyware around the world, including to India.

Sukla Sen highlights Three takeaways:

I. From the Israeli side the clinching of the contact (for sale of Pegasus) requires direct involvement of the Prime Minister. That's a strong clue as to what is the level of representation on the Indian side.

II. A The system sold to India enables it to monitor a number of phones -  the maximum number lies somewhere between 10 and 50, concurrently.
    B. The capacity is determined/fixed at the time of initial purchase itself and cannot be scaled up later.
    C The contact is renewable (every year or at the end of the term).
    D. In the Indian case, it's a multi-year contact.

III. The system has to be installed (onsite) by the NSO engineers. They're to provide periodic maintenance services (onsite). Maybe also assistance to operate in some selected cases.

Extracts: by s sen

(on cost to India) I would say it’s a few dozens of millions… of the $2 billion, the [cost of purchasing] Pegasus in terms of [the] real number is not the majority whatsoever, this is, they were like missiles that are far, far more expensive...

The NSO engineers need to be physically present on-site to install the system, test it, and then from time to time come and do the maintenance. In this case, Indian intelligence service, which was the entity that purchased the Pegasus – the overall connection is also with the involvement of the agency in Israel that is in charge of running secret intelligence and political relationships, which is the Mossad.

It’s not [a] license given by the ministry of defence. The MOD is giving a license to sell Pegasus according to some kind of a breakdown of details and capabilities. But besides that, in the commercial negotiation between NSO and Indian entities or Indian agencies, it’s very important to, and this has a significant impact on the pricing, different kinds of capabilities of the Pegasus, one of them – and most important per bandwidth capability, power and price – is how many licenses are sold. License is the ability to monitor one phone at the concurrent time. And this is … as far as I know, those [which] were sold to India, were I think between – I don’t remember what was the exact number – but it’s between 10 and 50. So each one can, it depends on what was decided, can monitor between 10 phones up to 50 phones.

Other comments:

Ronen Bergman asserted that NSO is now on the verge of extinction.. hinting that the tech is out there or that some other entity corporate, State, or perhaps rogue entity could make use of this. So the horse's shit would hit the fan, and so some serious work needs to be done to outlaw and prevent this kind of disruption. Nuremberg3.0 is called for. It also became quite clear that it was not a software which could be sold and distributed on a disk. It is engineered from perhaps some base tools and custom-made for each client, contract by contract. 

He said that the NSO has perhaps deliberately engineered things in such a way that they don't know the content of the invasion.. mainly because their clients themselves would not want it and also because of deniability.. true they have a log of the numbers and the attempts to hack.. and they have a front door access based on dual-both sides concurrence for maintenance.

Ronen Bergman No client of NSO would want a back door, because then they can be a backdoor to a back door. I was impressed that he was following the story right from the inception of NSO and is clear that NSO is near extinction.. but the tech lives on.. perhaps large chunks of the tech has already been sold or new corporations setup .. perhaps some hackers are already on the job