The notifications suggested that many opposition figures could be under “state-sponsored” surveillance, but even Apple said the warning could have been a false alarm.
By Alex Travelli and Suhasini Raj
Throngs of people fill an Apple store in Mumbai. Francis Mascarenhas/Reuters
More than a dozen iPhones across India buzzed with the same message earlier this week. Each notification sounded its own little alarm, but was amplified many times over when the targets identified themselves publicly. Most were prominent political opponents of Prime Minister Narendra Modi and his Bharatiya Janata Party.
The warning on their phones, sent by Apple on Monday, seemed stark: “State-sponsored attackers may be targeting your iPhone,” it said in part. But these so-called threat notifications could, by Apple’s own admission, be a false alarm, and Mr. Modi’s government dismissed allegations that it was spying on the opposition, journalists and critics, as some speculated.
Now in power for nearly a decade, Mr. Modi and his government have consolidated power by cracking down on free speech, undermining the independent press and silencing dissenting voices, including those in the opposition. This week’s episode seemed to fit into that pattern for his critics and many who got the warning from Apple. And, they said, the surveillance suggested by the alert would help the governing party in getting an upper hand on rivals ahead of next year’s election.
Rahul Gandhi, the foremost opposition leader, said many of his confidants in the Congress Party received the notification. Mr. Gandhi added that he takes illegal surveillance by the government for granted. At a news conference, he said, “We are not scared. You can do as much phone-tapping as you want, I don’t care.” This tussle is a distraction, he said, from the government’s most serious failings, like corruption.
Ashwini Vaishnaw, India’s minister of communications, electronics and I.T., dismissed the allegations of spying as complaints from “compulsive critics,” making it plain that he meant Mr. Gandhi in particular. He, too, called it a distraction, adding that the government would investigate the matter even as he urged the public to ignore the “vague” notifications.
But Sriram Karri, a newspaper editor in the southern city of Hyderabad, said this was the fourth such alert he had received in two years. This time, he said, he “freaked out” and feared “very political” motives.
“One feels breached, that not just your calls, but someone has access to all of the data on your phone including photos and videos,” Mr. Karri said.
Apple started sending the threat notifications in 2019, after the widespread use of Pegasus, a spyware program developed by NSO, an Israeli cyber-intelligence company, became public. NSO’s clients included governments around the world who used Pegasus to sneak into the phones of dissidents and opponents. One of those customers, The Times reported last year, was India. Pegasus was a centerpiece of a $2 billion defense package that it bought from Israel in 2017.
Some independent researchers in India have reported evidence of Pegasus infections on their phones. A committee formed by India’s Supreme Court to investigate those reports disbanded last year, noting that “the government of India has not cooperated.”
The human rights group Amnesty International played a crucial role in uncovering the global scale of Pegasus spyware. In a statement, Likhita Banerji, a technology and human rights researcher at the group, said that the cause of the Apple notifications “appears to be yet another surveillance scandal.” She added: “In India, reports of prominent journalists and opposition leaders receiving the Apple notifications are particularly concerning in the months leading up to state and national general elections.”
On Tuesday, Apple confirmed that it was the source of the alerts in India. But its public statements, like the Indian government’s, had the effect of minimizing the warnings’ impact. The notifications were based on “intelligence signals that are often imperfect and incomplete,” the company said, adding, “It’s possible that some Apple threat notifications may be false alarms.” And they must remain vague in order to avoid helping “state-sponsored attackers adapt their behavior to evade detection in the future.”
The company also said that it has sent out these notifications in nearly 150 countries since it started alerting potential victims.
For Mishi Choudhary, a lawyer who started an organization in India defending the rights of internet users and software developers, the episode stood out because only opposition figures appeared to have received it. “This was not a run-of-the-mill security breach,” she said.
In recent years, Apple has set up a high-stakes position in India as the country’s economy has grown to the fifth-largest in the world. It has moved more forcefully into India’s consumer market, opening Apple Stores and challenging the dominance of the Android platform.
At the same time, Apple has become more important to India’s government. It is by far the most prominent company to have joined a government campaign to increase manufacturing in the country. India’s Tata Sons and Taiwan’s Foxconn have bought and built factories that are churning out more and more high-end iPhones at the same time that Apple is eager to reduce its dependence on China as a manufacturing hub.
Alex Travelli is a correspondent for The Times based in New Delhi, covering business and economic matters in India and the rest of South Asia. He previously worked as an editor and correspondent for The Economist.
Suhasini Raj has worked for over a decade as an investigative journalist with Indian and international news outlets. Based in the New Delhi bureau, she joined The Times in 2014.
© 2023 The New York Times Company