Intelligence Bureau imported hardware from Pegasus maker NSO Group in 2017

On Thursday, the Organized Crime and Corruption Reporting Project reported that the Intelligence Bureau imported hardware from NSO Group, the firm behind the powerful Pegasus spyware in 2017. Entrackr has been able to corroborate OCCRP’s findings through another source of Indian trade data, and was able to do so independently, without ever being in contact with the OCCRP or the authors of the report.

The Indian government has consistently sidestepped the question of whether it has purchased access to Pegasus. OCCRP’s report says that the hardware imported into India matches specifications of the spyware that were previously uncovered. While this particular analysis is not something Entrackr can currently corroborate, we know for certain that the shipper of these goods was NSO Group, and their recipient was the Intelligence Bureau.

We have reached out to the Ministry of Home Affairs for comment. A spokesperson was unavailable for immediate comment.

Pegasus is capable of extracting a phone’s contents and sending them to whichever agency purchased it, including WhatsApp messages, files in storage, and so on. The spyware takes advantage of so-called zero-day exploits, vulnerabilities that have never been disclosed to a phone’s manufacturer or widely known publicly, and are hence unpatched. This includes zero-click attacks, where a device can be compromised without the user needing to be tricked into clicking a malicious link or downloading a virus-laden file.

Government officials have not testified in front of a Supreme Court-ordered committee to investigate the Pegasus allegations. Several activists, journalists, diplomats and others in India were reportedly targeted by this spyware.

The New York Times reported in January that India purchased Pegasus as a part of a wider defence deal with Israel in 2017. The NSO Group sent hardware to the Indian Intelligence Bureau in April of that year, two months before Prime Minister Narendra Modi made a state visit to Israel. 

In parliament, the Indian government has issued carefully worded statements that never outright deny that it purchased or uses Pegasus.