WhatsApp? Why did you withhold attack info: Govt

New Delhi: The government on Friday pulled up US social media firm WhatsApp for not disclosing to Indian authorities the details of the spyware attack launched on Indian citizens through the Israeli software Pegasus, despite at least a couple of high-level meetings between the two sides in the past few months.

But in a statement issued late Friday, WhatsApp appeared to counter the Indian government, saying it had in May "quickly resolved a security issue and notified Indian and international government authorities."

Senior government officials though argued that while WhatsApp had informed CERT-In, or the Indian Computer Emergency Response Team, in May that the app had been hacked globally and that they had fixed the issue, what they failed to tell New Delhi "or hid from us" was the fact that Indian citizens had been affected by it.

They added that the communication from the US company in May was "about a technical vulnerability" without any mention of Pegasus or the extent of breach, or that Indians were affected.

"We met with their high-ranking executives after that but nobody told us that India had also been hit by the spyware. We learnt of it only through news reports after Facebook/WhatsApp filed the lawsuit," one of the officials told ET.

Will Cathcart, WhatsApp's global head, and Nick Clegg, the global public policy head of Facebook, had met Indian authorities including IT minister Ravi Shankar Prasad in July and September this year, respectively.

Legally Bound 7

The hacks took place between April 29 and May 10.

A WhatsApp official told ET the firm had written letters to CERT-In informing that a specific number of Indian users were impacted and data stolen from their smartphones. The official, who did not want to be named, however, said that the Facebook-owned company made public NSO as a culprit only in the lawsuit filed early this week in a US court.

Earlier Friday, a team of senior Facebook and WhatsApp executives met Indian officials and said that the company's headquarters in the US will be responding to the government's queries on the hacking incident by Monday, November 4.

The government is awaiting WhatsApp's response to decide on the future course of action, which could include imposition of penalty. "They are legally bound under Section 70(B) of the IT Act, 2000 to inform us about the details of such attacks (on Indian citizens), which they failed to," the official said.

"Despite our discussions regarding traceability, etc, they never informed us about the attack on Indian citizens but kept harping on how they cannot compromise on encryption," the official said.

In its statement, a WhatsApp spokesperson said: "We agree with the government of India it's critical that together we do all we can to protect users from hackers attempting to weaken security. WhatsApp remains committed to the protection of all user messages through the product we provide."

WhatsApp late October sued the NSO Group, an Israeli surveillance firm and developers of Pegasus, which is reportedly behind the technology that helped unnamed entities hack into roughly 1,400 devices across at least 20 countries, including India, Bahrain, Mexico and UAE, as per the company's lawsuit in the US.

Those targeted included diplomats, political dissidents, journalists and senior government officials. However, the company did not say at whose behest the phones of journalists and activists across the world were targeted.

The official cited earlier reiterated that the Indian government hadn't purchased the Pegasus software from NSO. The Cyber & Information Security (C&IS) division of the ministry of home affairs on Thursday had denied purchasing the software which is at the centre of the alleged snooping row.

The government though hasn't contacted NSO for any details and said the court matter was between WhatsApp and NSO, as per the official.

NSO declined to answer ET's queries on its Indian customers, and disputed Facebook and WhatsApp's allegations.

"The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime. Our technology is not designed or licensed for use against human rights activists and journalists...," it said.

India is peeved at the timing of this hacking episode, especially the filing of the subsequent lawsuit in the US by WhatsApp and its parent, Facebook. A second official said that India suspects that the lawsuit by Facebook is an attempt to push back growing demand from governments the world over to bring about regulation on traceability.

"After India took a stand on traceability, other countries including US & UK are also asking them for the same thing. In fact, Mexico and Brazil have cited the Indian government's example and asked them to limit forwards," the official said.

The official added that the government is "disturbed by this entire episode, of first not informing us, which they are legally bound to, and secondly, for what we feel is a selective leak of information showing how only government critics have been targeted by the malware".

Government officials further pointed out that Facebook's US lawsuit came soon after the Indian government informed the Indian Supreme Court that it will be notifying by January the amended intermediary guidelines, which are aimed at tightening accountability rules for social media apps such as WhatsApp and Facebook, especially on traceability.

The ministry of electronics and information technology (MeitY) on October 22 informed the Supreme Court that it will need three more months to finalise the social intermediary guidelines. Facebook and WhatsApp filed the case against NSO in a US district Court in California on October 29.

"It is too much of a coincidence that this lawsuit comes at a time when we are insisting on traceability...other countries are joining us in this respect and the Supreme Court order asking us for a timeframe for guidelines on traceability," the second official said.

The stalemate between the Indian government and WhatsApp centres around the issue of traceability. The government wants WhatsApp to help India's law enforcement agencies to track the origin of messages which lead to crimes such as mob lynchings and riots. WhatsApp has refused to do so, citing breach of user privacy and technological challenges.

"We don't want WhatsApp to decrypt any messages, we have only asked them to trace the source of a malicious message. In the past we have seen malicious messages are relayed in the same area, same region and has led to cases of mob lynching and this doesn't require rocket science," the official said.

WhatsApp has over 1.5 billion users globally, of which India alone accounts for about 400 million.