RISING INDIA, TOXIC TECH
By Gerry Shih
and
Joseph Menn
December 27, 2023 at 7:00 p.m. EST
(Illustration by Shubhadeep Mukherjee for The Washington Post; Lisa Maree Williams/Getty Images; Mensent Photography/Getty Images; Anna Lefkowitz/The Washington Post)
NEW DELHI — A day after Apple warned independent Indian journalists and opposition party politicians in October that government hackers may have tried to break into their iPhones, officials under Prime Minister Narendra Modi promptly took action — against Apple.
Officials from the ruling Bharatiya Janata Party (BJP) publicly questioned whether the Silicon Valley company’s internal threat algorithms were faulty and announced an investigation into the security of Apple devices.
In private, according to three people with knowledge of the matter, senior Modi administration officials called Apple’s India representatives to demand that the company help soften the political impact of the warnings. They also summoned an Apple security expert from outside the country to a meeting in New Delhi, where government representatives pressed the Apple official to come up with alternative explanations for the warnings to users, the people said. They spoke on the condition of anonymity to discuss sensitive matters.
“They were really angry,” one of those people said.
The visiting Apple official stood by the company’s warnings. But the intensity of the Indian government effort to discredit and strong-arm Apple disturbed executives at the company’s headquarters, in Cupertino, Calif., and illustrated how even Silicon Valley’s most powerful tech companies can face pressure from the increasingly assertive leadership of the world’s most populous country — and one of the most critical technology markets of the coming decade.
Skip to end of carousel
India’s Prime Minister Narendra Modi swept into power nearly a decade ago. Since then, he has repeatedly rallied voters in this vast democracy and entrenched his party’s power by exploiting differences between the Hindu majority and Muslim minority.
Religious tensions have existed in India since independence in 1947, and Modi’s right-wing followers in his Bharatiya Janata Party and beyond turned to inflammatory rhetoric and violence against Muslims to secure support from Hindus.
The BJP and affiliated Hindu nationalist groups have been in the global vanguard of using technology to advance political aims, tightening their grip with an ideology that imperils India’s traditional secularism and equality among religious faiths. Disinformation and divisive, often bigoted online posts and videos are rampant.
Government censorship of critical views has been on the rise. Social media platforms and other Big Tech firms, protective of their position in one of the world’s largest markets, have often given Modi and his allies what they want.
Despite concerns over repression and accelerating autocracy, the Biden administration has been actively courting Modi, hoping that India can help contain Chinese expansionism in the Indo-Pacific region.
Canada’s explosive announcement on Sept. 18 that Indian government agents may have assassinated a Sikh separatist leader on Canadian soil underscores the uncomfortable choices the United States and other Western countries face in moving closer to Modi’s India.
1/6
End of carousel
The recent episode also exemplified the dangers facing government critics in India and the lengths to which the Modi administration will go to deflect suspicions that it has engaged in hacking against its perceived enemies, according to digital rights groups, industry workers and Indian journalists.
Many of the more than 20 people who received Apple’s warnings at the end of October have been publicly critical of Modi or his longtime ally, Gautam Adani, an Indian energy and infrastructure tyc00n. They included a firebrand politician from West Bengal state, a Communist leader from southern India and a New Delhi-based spokesman for the nation’s largest opposition party.
Indian billionaire Gautam Adani, above, is a longtime ally of Prime Minister Narendra Modi. Journalists investigating their ties are among the more than 20 people who received recent warnings from Apple that government hackers probably tried to break into their iPhones. (Kobi Wolf/Bloomberg News)
Of the journalists who received notifications, two stood out: Anand Mangnale and Ravi Nair of the Organized Crime and Corruption Reporting Project, a nonprofit alliance of dozens of independent, investigative newsrooms from around the world.
On Aug. 23, the OCCRP emailed Adani seeking comment for a story it would publish a week later alleging that his brother was part of a group that had secretly traded hundreds of millions of dollars worth of the Adani Group conglomerate’s public stock, possibly in violation of Indian securities law. A forensic analysis of Mangnale’s phone, conducted by Amnesty International and shared with The Washington Post, found that within 24 hours of that inquiry, an attacker infiltrated the device and planted Pegasus, the notorious spyware that was developed by Israeli company NSO Group and that NSO says is sold only to governments.
A spokeswoman for Adani denied that the magnate was involved in any hacking effort and accused OCCRP of conducting a “smear campaign” against the Adani Group. She also criticized The Post for asking whether the Adani Group was involved in, or had knowledge of, the hacking attempts against OCCRP. “While categorically denying and rejecting this insinuation, we find it disturbing and inappropriate that you would make an attempt to draw our name into this specious construct,” Varsha Chainani, the Adani Group’s head of corporate communications, said in an emailed response to written questions. “The Adani Group operates with the highest level of integrity and ethical standards.”
Gopal Krishna Agarwal, a national spokesman for the BJP, said any evidence of hacking should be presented to the Indian government for investigation. Hiren Joshi, the top communications official in the prime minister’s office, did not respond to requests seeking comment. Apple declined to comment in response to written questions.
The Modi government has never confirmed or denied using spyware, and it has refused to cooperate with a committee appointed by India’s Supreme Court to investigate whether it had. But two years ago, the Forbidden Stories journalism consortium, which included The Post, found that phones belonging to Indian journalists and political figures were infected with Pegasus, which grants attackers access to a device’s encrypted messages, camera and microphone.
In recent weeks, The Post, in collaboration with Amnesty, found fresh cases of infections among Indian journalists. Additional work by The Post and New York security firm iVerify found that opposition politicians had been targeted, adding to the evidence suggesting the Indian government’s use of powerful surveillance tools.
In addition, Amnesty showed The Post evidence it found in June that suggested a Pegasus customer was preparing to hack people in India. Amnesty asked that the evidence not be detailed to avoid teaching Pegasus users how to cover their tracks.
“These findings show that spyware abuse continues unabated in India,” said Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab. “Journalists, activists and opposition politicians in India can neither protect themselves against being targeted by highly invasive spyware nor expect meaningful accountability.”
NSO spokesperson Liron Bruck said that the company does not know who is targeted by its customers but investigates complaints that are accompanied by details of the suspected hack.
“While NSO cannot comment on specific customers, we stress again that all of them are vetted law enforcement and intelligence agencies that license our technologies for the sole purpose of fighting terror and major crime,” Bruck said. “The company’s policies and contracts provide mechanisms to avoid targeting of journalists, lawyers and human rights defenders or political dissidents that are not involved in terror or serious crimes.”
David Kaye, a former United Nations special rapporteur on free expression who has testified before an Indian Supreme Court committee probing the government’s suspected use of Pegasus, said the recent reporting by The Post and its partners “further shifts the burden onto the Indian government to disprove the allegations that it uses these kinds of tools.”
“Especially after this information, the government absolutely has to be honest and transparent,” Kaye said. "But the accretion of evidence suggests this is not divorced from the broader assault by the Modi government on the freedom of expression and the right to protest.”
Customers outside an Apple store in Mumbai. India is on track to account for 10 percent of Apple sales in 2025, up from 4 percent now, an analyst said. (Dhiraj Singh/Bloomberg News/Getty Images)
India targets Apple over its phone hacking notifications
By Gerry Shih
and
Joseph Menn
December 27, 2023 at 7:00 p.m. EST
NEW DELHI — A day after Apple warned independent Indian journalists and opposition party politicians in October that government hackers may have tried to break into their iPhones, officials under Prime Minister Narendra Modi promptly took action — against Apple.
Officials from the ruling Bharatiya Janata Party (BJP) publicly questioned whether the Silicon Valley company’s internal threat algorithms were faulty and announced an investigation into the security of Apple devices.
In private, according to three people with knowledge of the matter, senior Modi administration officials called Apple’s India representatives to demand that the company help soften the political impact of the warnings. They also summoned an Apple security expert from outside the country to a meeting in New Delhi, where government representatives pressed the Apple official to come up with alternative explanations for the warnings to users, the people said. They spoke on the condition of anonymity to discuss sensitive matters.
“They were really angry,” one of those people said.
The visiting Apple official stood by the company’s warnings. But the intensity of the Indian government effort to discredit and strong-arm Apple disturbed executives at the company’s headquarters, in Cupertino, Calif., and illustrated how even Silicon Valley’s most powerful tech companies can face pressure from the increasingly assertive leadership of the world’s most populous country — and one of the most critical technology markets of the coming decade.
Skip to end of carousel
The rise of Modi and his Hindu-first state
India’s Prime Minister Narendra Modi swept into power nearly a decade ago. Since then, he has repeatedly rallied voters in this vast democracy and entrenched his party’s power by exploiting differences between the Hindu majority and Muslim minority.
Religious tensions have existed in India since independence in 1947, and Modi’s right-wing followers in his Bharatiya Janata Party and beyond turned to inflammatory rhetoric and violence against Muslims to secure support from Hindus.
The BJP and affiliated Hindu nationalist groups have been in the global vanguard of using technology to advance political aims, tightening their grip with an ideology that imperils India’s traditional secularism and equality among religious faiths. Disinformation and divisive, often bigoted online posts and videos are rampant.
Government censorship of critical views has been on the rise. Social media platforms and other Big Tech firms, protective of their position in one of the world’s largest markets, have often given Modi and his allies what they want.
Despite concerns over repression and accelerating autocracy, the Biden administration has been actively courting Modi, hoping that India can help contain Chinese expansionism in the Indo-Pacific region.
Canada’s explosive announcement on Sept. 18 that Indian government agents may have assassinated a Sikh separatist leader on Canadian soil underscores the uncomfortable choices the United States and other Western countries face in moving closer to Modi’s India.
1/6
End of carousel
The recent episode also exemplified the dangers facing government critics in India and the lengths to which the Modi administration will go to deflect suspicions that it has engaged in hacking against its perceived enemies, according to digital rights groups, industry workers and Indian journalists.
Many of the more than 20 people who received Apple’s warnings at the end of October have been publicly critical of Modi or his longtime ally, Gautam Adani, an Indian energy and infrastructure tyc00n. They included a firebrand politician from West Bengal state, a Communist leader from southern India and a New Delhi-based spokesman for the nation’s largest opposition party.
Of the journalists who received notifications, two stood out: Anand Mangnale and Ravi Nair of the Organized Crime and Corruption Reporting Project, a nonprofit alliance of dozens of independent, investigative newsrooms from around the world.
On Aug. 23, the OCCRP emailed Adani seeking comment for a story it would publish a week later alleging that his brother was part of a group that had secretly traded hundreds of millions of dollars worth of the Adani Group conglomerate’s public stock, possibly in violation of Indian securities law. A forensic analysis of Mangnale’s phone, conducted by Amnesty International and shared with The Washington Post, found that within 24 hours of that inquiry, an attacker infiltrated the device and planted Pegasus, the notorious spyware that was developed by Israeli company NSO Group and that NSO says is sold only to governments.
A spokeswoman for Adani denied that the magnate was involved in any hacking effort and accused OCCRP of conducting a “smear campaign” against the Adani Group. She also criticized The Post for asking whether the Adani Group was involved in, or had knowledge of, the hacking attempts against OCCRP. “While categorically denying and rejecting this insinuation, we find it disturbing and inappropriate that you would make an attempt to draw our name into this specious construct,” Varsha Chainani, the Adani Group’s head of corporate communications, said in an emailed response to written questions. “The Adani Group operates with the highest level of integrity and ethical standards.”
Gopal Krishna Agarwal, a national spokesman for the BJP, said any evidence of hacking should be presented to the Indian government for investigation. Hiren Joshi, the top communications official in the prime minister’s office, did not respond to requests seeking comment. Apple declined to comment in response to written questions.
The Modi government has never confirmed or denied using spyware, and it has refused to cooperate with a committee appointed by India’s Supreme Court to investigate whether it had. But two years ago, the Forbidden Stories journalism consortium, which included The Post, found that phones belonging to Indian journalists and political figures were infected with Pegasus, which grants attackers access to a device’s encrypted messages, camera and microphone.
In recent weeks, The Post, in collaboration with Amnesty, found fresh cases of infections among Indian journalists. Additional work by The Post and New York security firm iVerify found that opposition politicians had been targeted, adding to the evidence suggesting the Indian government’s use of powerful surveillance tools.
In addition, Amnesty showed The Post evidence it found in June that suggested a Pegasus customer was preparing to hack people in India. Amnesty asked that the evidence not be detailed to avoid teaching Pegasus users how to cover their tracks.
“These findings show that spyware abuse continues unabated in India,” said Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab. “Journalists, activists and opposition politicians in India can neither protect themselves against being targeted by highly invasive spyware nor expect meaningful accountability.”
NSO spokesperson Liron Bruck said that the company does not know who is targeted by its customers but investigates complaints that are accompanied by details of the suspected hack.
“While NSO cannot comment on specific customers, we stress again that all of them are vetted law enforcement and intelligence agencies that license our technologies for the sole purpose of fighting terror and major crime,” Bruck said. “The company’s policies and contracts provide mechanisms to avoid targeting of journalists, lawyers and human rights defenders or political dissidents that are not involved in terror or serious crimes.”
David Kaye, a former United Nations special rapporteur on free expression who has testified before an Indian Supreme Court committee probing the government’s suspected use of Pegasus, said the recent reporting by The Post and its partners “further shifts the burden onto the Indian government to disprove the allegations that it uses these kinds of tools.”
“Especially after this information, the government absolutely has to be honest and transparent,” Kaye said. "But the accretion of evidence suggests this is not divorced from the broader assault by the Modi government on the freedom of expression and the right to protest.”
