News: According to an Amnesty International report dated June 15, at least nine human rights defenders from India, including those who have been fighting for the Bhima Koregaon 11 were unlawfully targeted with a spyware attack.
Here are five components of the story:
- The Bhima Koregaon 11 refers to 11 human rights activists who were arrested two years ago in Maharashtra in relation to an outbreak of violence between Dalits and Hindu nationalists.
- Amnesty International and the Citizen Lab have uncovered a coordinated spyware campaign targeting at least nine human rights defenders (HRDs) in India. These targets include activists, lawyers, academics, and journalists. Eight called for the release of the Bhima Koregaon 11. One of the targets is not directly linked to this case, but has been vocal in calling for the release of GN Saibaba, a disabled academic jailed in Maharashtra.
- The report further states that this is not the the first time that activists and HRDs have been targeted with malware in India. In October 2019, Facebook’s WhatsApp revealed that NSO Group, a surveillance tool vendor, had exploited a zero-day vulnerability on their platform to target 1400 individuals earlier in the year. NSO Group says that it sells its products only to “government intelligence and law enforcement agencies”.
- The spyware campaign revealed in this blog targeted lawyers and activists Nihalsing B Rathod, Degree Prasad Chouhan, Yug Mohit Choudhary, and Ragini Ahuja; academics Partho Sarothi Ray and PK Vijayan, a journalist who prefers to stay anonymous, and a human rights collective – Jagdalpur Legal Aid Group (JAGLAG) through a campaign of spearphishing malicious emails.
- The spearphishing emails and spyware suggest that this is not a cyber-crime attack, but a spyware campaign trying to compromise devices of HRDs. If successful it would have enabled the attackers, to monitor the HRDs actions and communications and is therefore a violation of their rights to freedom of expression and privacy. However, the Amnesty investigation was not able to attribute the campaign to any particular agency.
