WhatsApp told govt about Pegasus spyware 2nd time in September, said 121 people spied on: Reports
Responding to a notice by the IT ministry on the WhatsApp spying issue, the Facebook-owned company attached both the vulnerability notes it filed in May as well as the letter it sent to the government in September.
After the government claimed that instant messaging application WhatsApp had not informed government agencies about a privacy breach targetting many Indian activists, lawyers and journalists, the messaging platforms has now responded by saying that it had alerted the government on two occasions -- once in May and for the second time in September.
Responding to a notice by the IT ministry on the WhatsApp spying issue, the Facebook-owned company attached both the vulnerability notes it filed in May as well as the letter it sent to the government in September.
While the government has now confirmed that it did receive the September intimation from WhatsApp informing about spyware called Pegasus targetting 121 Indians, the IT ministry claimed the letter was "still too vague" to be alarming, as reported by the Indian Express.
WhatsApp's response came in the wake of the Government claiming that they were not informed about the possible breach of privacy by the company in their last two meetings.
Elaborating on how "vague" the letter was, a source in the IT minister told the Indian Express, "The letter says that it appears that some 121 people may have been affected but doesn't specifically say what the impact was. It doesn't tell who, what, where the identities which have now come out in the media. They have been trying to reach out to (those affected) through a Canadian group. Nowhere has the Indian government been involved."
"The government took up the issue of traceability with their international vice-president (Nick Clegg) and CEO (Chris Daniels) during formal structured meetings at the highest level of the ministry. They objected to it, suggesting their platform was safe. Not for once did they inform us about this privacy breach during those meetings at the highest levels," he added.
Another source told Indian Express that WhatsApp kept them the Indian Government in the loop on all the developments in the matter.
Govt claims WhatsApp shared technical jargon
In a statement on Friday, Facebook-owned WhatsApp said it agreed with the demand made by the Indian government to explain the kind of breach to safeguard the privacy of millions of citizens. It also claimed to have informed the Indian government about the 'security issue' in May.
"Our highest priority is the privacy and security of WhatsApp users. In May, we resolved a security issue and notified relevant Indian and international government authorities," the WhatsApp statement said.
But the government countered the WhatsApp's claims saying the information provided was "pure technical jargon".
Government sources said WhatsApp had given information to CERT-IN, a government agency, in May, but without any mention of Pegasus or the extent of the breach.
It also insisted that the information shared was only about a technical vulnerability and had nothing to do with the fact that the privacy of Indian users had been compromised. To back its claim, a screenshot of the information shared with CERT-IN by WhatsApp was circulated by government sources. However, the link on information relayed by WhatsApp in May has disappeared from the CERT-IN website.
Spying snowballs into political controversy
WhatsApp, the Facebook-owned mobile messaging service in October-end informed a few Indian journalists and human rights activists that they were among the 1,400 people globally who were spied upon by unnamed entities using Israeli spyware dubbed Pegasus.
Pegasus allegedly exploited WhatsApp's video calling system by installing the spyware via missed calls to snoop on 1,400 select users globally, including nearly 30-40 in India.
The owner of Pegasus, Israel-based NSO Group, limits the sale of the spyware to state intelligence agencies and others as it has the ability to collect intimate data from a target device. Pegasus software can be installed on devices as "exploit links".
The Indian government has denied purchasing or plans to buy Pegasus software from NSO Group.
The government has also come under fire from journalists as they demanded clarification from WhatsApp and questioned why it had kept the information about spying on Indian citizens hidden from the authorities despite recent meetings with the company CEO.
ALSO READ: Snooping on activists, scribes illegal, shameful: Sonia Gandhi
ALSO WATCH: Who hacked WhatsApp accounts in India?