Amnesty has not ‘backtracked’ on the Pegasus list; media, BJP make false claims

The BJP, which is at the heart of the controversy in India, attempted to completely discredit the Pegasus Project

India Today has claimed that Amnesty International, one of the coordinators of the Pegasus Project, has backtracked on its initial reportage into the Israeli spyware used to target journalists, activists and politicians.

“Amnesty backtracks on snooping list,” wrote India Today while tweeting a broadcast where news tickers flashing on the screen read, “Snoopgate list was never real?”, “Big Amnesty U-turn” and “Amnesty pulls back of ‘list’ claims”.

The channel was referring to the list of 50,000 potential surveillance targets that Paris-based Forbidden Stories first accessed. India Today suggested that Amnesty had reported that all numbers on the leaked list were snooped on but the non-for-profit has ‘now’ clarified that the list was of the persons of interest selected by clients of the NSO Group that owns Pegasus.

“Is Pegasus spygate call database fake?” asked Times Now during a show anchored by Rahul Shivshankar. He claimed that a new ‘twist’ has been reported in the Pegasus Project and that Amnesty never linked the data to NSO.

The BJP, which is at the heart of the controversy in India as the NSO Group has said that it sells the advanced software to only “vetted governments”, attempted to completely discredit the Pegasus Project. “Amnesty International has denied this list,” the party claimed.

Has Amnesty backtracked on its initial reportage?

No.

Amnesty International’s Security Lab in partnership with Forbidden Stories accessed a leaked list of 50,000 numbers that were potential surveillance targets of NSO clients. In its first report on July 18, Amnesty clearly stated, “NSO Group’s spyware has been used to facilitate human rights violations around the world on a massive scale, according to a major investigation into the leak of 50,000 phone numbers of potential surveillance targets.”

Forbidden Stories also never said that 50,000 phones were infected with Pegasus. The outlet wrote these were the numbers NSO clients “selected for surveillance”.

In every story on the Pegasus Project Amnesty was careful to use the term “potential targets”. French President Emmanuel Macron, Pakistan’s Imran Khan and South Africa’s Cyril Ramaphosa were also selected as “people of interest” by clients of the NSO Group.

What does ‘potential target’ imply? Forbidden Stories founder Laurent Richard had explained this in an interview with India Today. “A list of phone numbers entered by NSO customers into the NSO system and some of those numbers have been infected. We were able to check and find some evidence inside phones,” he said.

Anchor Rajdeep Sardesai questioned, “Can we say that simply the existence of a particular number on this NSO list indicates a hack? Can we say with confidence that these are the very numbers or will we have to go through forensic analysis of all these numbers?” to which Richard replied, “We never say that. We only say that those numbers were entered into the system by NSO customers. This is what we say. The second thing that we say is that when we were able to approach people, we told them we have reasons to believe that you have maybe been under surveillance. Is it possible to do some forensic on your phone? And then when we did that we were able to find some traces of infection.”

The Wire had similarly reported, “A potential target is someone whose number appears on the list, but whose device has not been forensically analysed by Amnesty. A person is classified as a target if their phones show evidence of an attempted or successful hack.”

It further said, “The news organisations working on Pegasus Project were independently able to identify the owners of over 1,500 numbers across at least 10 countries. A small cross-section of these phones was forensically examined to find traces of Pegasus.”

Amnesty’s technical lab conducted a forensic examination of 67 phones, “37 of which were found to have evidence of a successful or attempted Pegasus hack”.

“For the remaining 30, the tests were inconclusive, in several cases because the phones had been replaced. Fifteen of the phones were Android devices, none of which showed evidence of successful infection. However, unlike iPhones, Androids do not log the kinds of information required for Amnesty’s detective work. Three Android phones showed signs of targeting, such as Pegasus-linked SMS messages,” reported The Washington Post.

Amnesty has explained the methodology used to trace Pegasus in the 37 phones. “Forensic analysis of the 37 phones shows that many display a tight correlation between time stamps associated with a number on the list and the initiation of surveillance attempts, in some cases as brief as a few seconds,” said The Washington Post. The list was not a random set of numbers. Amnesty’s research was independently peer-reviewed by Citizen Lab.

NSO called the investigation’s findings exaggerated and baseless. It also said it does not operate the spyware licensed to its clients and has “no visibility or access” to customer data. The company’s statement contradicts its denial of the use of Pegasus on specific targets. For instance, NSO said that its government clients did not use its malware to target Saudi journalist Jamal Khashoggi or his family. However, if NSO denies having any insight into specific intelligence activities, how does it know whether they were targetted or not?

WhatsApp had filed a lawsuit against NSO in 2019. Screenshots of the software and a contract included in the lawsuit show that “NSO provides hacking as a streamlined service, which means a lot of the actual tech is in the company’s own control, and NSO can offer hands-on assistance to the government employees who use it”.

After misleading claims about the list were widespread on social media, Amnesty put out the following statement – “Amnesty International categorically stands by the findings of the Pegasus Project, and that the data is irrefutably linked to potential targets of NSO Group’s Pegasus spyware. The false rumours being pushed on social media are intended to distract from the widespread unlawful targeting of journalists, activists and others that the Pegasus Project has revealed.”

What led the media and BJP to promote misleading claims?

American cybersecurity journalist Kim Zetter shared an article by Israeli website Calcalist. She claimed that the article said, “Amnesty International has never presented this list as a ‘NSO Pegasus Spyware List’, although some of the world’s media may have done so..list indicative of the interests of the company’s clients.”

Kanchan Gupta, senior adviser at the ministry of information and broadcasting, quote-tweeted Zetter and claimed that Amnesty “conjured” a list of possible targets. Zetter replied to him stating that he has completely misinterpreted her tweet.

Calcalist journalist Omer Kabir who wrote the Hebrew article told Newslaundry, “Why is this confusion arising? I have reported very clearly that Amnesty has always maintained and in their press release once again maintained that the list was of numbers either affected by the spyware or the numbers of persons of interest to NSO clients.”

However, widespread use of the mistranslation of his Hebrew report was already in place. Forbidden Stories journalist Phineas James explained in a thread how the ‘twisted’ version was pushed by a section of Israeli media and “by the morning, news that the list was “indicative” of NSO clients rather than “targets of potential surveillance by NSO clients” was everywhere.”

The Wire spoke to Gil Naveh, spokesperson of Amnesty International Israel, who said that the organisation’s Hebrew statement was wrongly reported by a section of the media in Israel and is being wrongly quoted in English. “One of the false stories doing the rounds is that Amnesty says the list of numbers is “indicative” of NSO customers,” reported The Wire. Naveh told the organisation this is a mistranslation, and that what he had said in his statement is that this is a list of numbers that the NSOs customers have expressed interest in, which includes journalists and human rights activists, political rivals, lawyers and so on. Alt News has also reached out to Amnesty and this report will be updated when they reponds.

Republic was among the Indian media outlets that claimed the list was “indicative” of the interests of the NSO’s clients. Gujarati news outlet Sandesh said that the spying was based on “speculation”.

“Amnesty, and the journalists involved in the investigation, made it clear from the outset in very clear language that this was a list of numbers marked or targeted as numbers of interest for NSO’s customers, who are various regimes in the world,” said Naveh.

Pro-BJP websites Swarajya and OpIndia published reports claiming this was a ‘new admission’ by Amnesty. OpIndia wrote, “As per reports, Amnesty International has now admitted that they have never said that the database containing names of activists, journalists, politicians from across the world belonged to NSO’s targets, rather it was the media that manipulated its readers.”

A Swarajya writer questioned The Wire’s reporting on the Pegasus Project. The Wire is one of the 17 media organisations from 10 countries that collaborated on the investigation. “The Wire used the phrase “potential targets of surveillance” in the opening sentence of their lead piece on the Pegasus affair…if the presence of phone numbers on that list, by The Wire’s own admission, don’t amount to snooping, then what allegation is there to make?” – the writer asked.

Outlook published a report headlined, “Amnesty Now Says Pegasus Spyware List Not NSO’s Target, Only Showed Its Clients’ Interest” and later changed it to, “Pegasus U-Turn? Never Claimed Leaked Phone Numbers Were On NSO Spyware List, Says Amnesty”.

Zee News editor-in-chief Sudhir Chaudhary referred to the investigation as a “case study”. Times Now anchor Rahul Shivshankar questioned the “legitimacy of the spygate reports”.

Thus, a misleading narrative has been built that Amnesty backtracked on its earlier investigation. But the fact is that the organisation has always maintained that the 50,000 numbers on the list are potential surveillance targets by the NSO Group’s clients. Forbidden Stories founder said that these numbers were fed into NSO’s system, and the news organisations working on the Pegasus Project were able to identify owners of over 1,500 numbers. Out of them, the phones of 67 people went through forensic analysis and traces of Pegasus were found in 37. The BJP has suggested that the list is fake but the party is yet to deny that it used Pegasus to spy on citizens. The exaggerated emphasis on the list distracts from the primary issue – there is evidence of Pegasus being infected into the phones of journalists and human rights activists. Illegal surveillance subverts democracy and targeting organisations who are exposing the illegal surveillance, instead of questioning the governments that may have spied on their citizens, is a distraction from the truth.