Photo by Novikov Aleksey / Shutterstock.com
India’s Intelligence Bureau, the country’s domestic intelligence agency, received hardware equipment from the NSO Group on April 18, 2017, according to import documents obtained through a global trade data platform.
The documents, reviewed by OCCRP, show that the Indian agency imported hardware, including Dell servers, Cisco networking equipment and uninterruptible power supply batteries. This is all hardware that matches the description of equipment required to run Pegasus.
The shipment was delivered by air, unloaded in Delhi and marked for defence and military use, costing around $315,000. The description, pricing and timing of delivery all match The New York Times’ report from January, which reported that Pegasus and a missile system were integral pieces of an arms deal between India and Isreal in 2017.
While this is not conclusive evidence that the Indian government has used the Pegasus spyware, the contents of the shipment do match those laid out in a Pegasus brochure submitted in a US court in a lawsuit filed against the NSO Group by Meta, parent company of Facebook, Whatsapp and Instagram back in 2019. The documents in the lawsuit show similar shipments to Ghana, another NSO customer.
The brochure states the need for two computer racks, servers, network equipment, cables and batteries to keep the system running. These specifications were also seen in a contract between a Mexican company and the NSO Group, first reported by Aristegui Noticias and obtained by OCCRP.
Additionally, two intelligent officers — one senior officer and a contractor also told OCCRP on the condition of anonymity that the Indian government did in fact, purchase Pegasus in 2017.
The Pegasus Project, a collaborative investigation about the use of spyware in the country, had already revealed that several phones, including those of journalists and opposing party leaders, had potentially been infected.
So far, the Indian government has stayed silent on the Pegasus issue, neither confirming nor denying the purchase. Ashwini Vaishnaw, India’s IT minister claimed in July last year that these claims are “sensationalism” and are only an attempt “to malign Indian democracy and its well-established institutions.”
The Indian Supreme court did launch an enquiry into the Pegasus Project’s claims by forming a committee of experts in October last year. The investigation ended in August with the committee not finding any conclusive evidence that Pegasus was deployed. Although it did point out that several of the phones under investigation were infected with malware and that the Indian Government was not cooperative.
In the News: Iranian hacking group updates Android malware to target citizens
