The Pegasus Project’s revelations in India continue to shock. Yesterday, the Wire reported that industrialist Anil Ambani may have been a potential target and former Central Bureau of Investigation Alok Verma as well.

Meanwhile, the list at the very heart of this investigation has come under attack.

The governing Bharatiya Janata Party leaders and their friends in the media have whipped up a theory that the list itself – which has 50,000 names of potential Pegasus targets, including journalists, human rights activists, and politicians – is “fake”. Union minister Meenakshi Lekhi declared that “Amnesty has denied the list circulating in the media”.

The government’s chief primetime defender, Arnab Goswami, hosted a show on Republic TV with the hashtag #PegasusFiasco and thundered that Amnesty had done a u-turn and denied the list was linked to the NSO Group, the Israeli company behind the Pegasus spyware which enables remote surveillance of smartphones.

Goswami’s poor imitations on Times Now had similar takes.

The fodder for this spin came from a tweet by American cybersecurity journalist Kim Zetter.

The quote in Zetter’s tweet is from an article in Calcalist Tech, an Israeli publication. The article is titled, “Amnesty clarifies: The list of 50,000 phone numbers is not directly related to NSO”. The operative word is “not directly” and you’ll read a lot about this later.

The Calcalist article is written by reporter Omer Kabir in Hebrew. Newslaundry reached out to Kabir to know the exact contents of his piece and his views on the furore it had caused in India.

“Can you please explain to me why I am getting so many calls from the Indian media?” Kabir asked when we called him on his mobile phone at 2.12 pm on Thursday or about 11.42 am in Israel.

We sent him Zetter’s tweet quoting from his piece and explained how it had been picked up by sections of the Indian media to question the “legitimacy of the spygate reports”.

We also sent Kabir a tweet by Times Now anchor Rahul Shivshankar questioning the “legitimacy of the spygate reports”. Kabir was surprised. He clarified that his report never claimed that the list was not related to the NSO Group.

“Why is this confusion arising?” he asked. “I have reported very clearly that Amnesty has always maintained and in their press release once again maintained that the list was of numbers either affected by the spyware or the numbers of persons of interest to NSO clients.”

Kabir added, “This is why my article is titled ‘not directly related to NSO’. The important word here is ‘not directly’. The report was simply a clarified reiteration of what had already been said by Amnesty and misreported by parts of the media. Neither our reports nor Amnesty have ever said they were backtracking or denying their investigation.”

Here, we need to back up a little and lay out the actual chronology and context of what has transpired.

Read carefully

On July 18, Amnesty International introduced the Pegasus Project as a “major investigation into the leak of 50,000 phone numbers of potential surveillance targets”.

On July 20, Kabir reported that in an interview with Calcalist, the NSO Group’s CEO Shalev Hulio said the Israeli company had nothing to do with the list. “The foundation on which this investigation is based is a list which no one knows is actually true,” the CEO claimed.

The next day, Kabir did another report. Titled “Amnesty clarifies: The list of 50,000 phone numbers isn’t directly related to NSO”, it has landed at the centre of the debate in India.

In his article, Kabir noted that some media organisations had claimed that every number on the list was ostensibly targeted by Pegasus. Kabir, however, did not name such organisations nor did he cite any of their reports on this.

In response to this, Kabir further reported, Amnesty released a statement clearly stating that they never claimed the entire list was a target of the spyware, but that forensic analysis had confirmed that some phones on the list were indeed infected with Pegasus, and that the other numbers indicated persons of interest to the NSO Group’s clients, or potential targets.

Put simply, the list is of potential targets – and some of whom were indeed targeted – for the Israeli company’s clients. It’s not an “NSO list” of the numbers of persons actually targeted by Pegasus.

Amnesty’s first statement

Newslaundry accessed Amnesty’s statement which Kabir reported on.

This statement, in Hebrew, was issued on July 21 to counter the NSO Group’s reaction to the Pegasus Project investigation.

According to Kabir, the statement was mostly sent to Israeli journalists. When asked why, Kabir said, “NSO’s CEO spoke to Israeli news organisations like ours and discredited the entire study. So, Amnesty released a press statement to the Israeli media and made their stand clear.”

It accused NSO of “creating a narrative of conflicting and confused versions”. To buttress this point, the statement clarified that even though Amnesty had made it clear the NSO Group was not solely to be blamed, it couldn’t wash its hands off the matter.

“The NSO group is only the tip of the iceberg when it comes to Israeli cyberwarfare and Israeli weapons being misused, and even though we hold it responsible for the misuse of its products, it is not solely to be blamed,” the statement said. “The main responsibility is that of the Israeli Ministry of Defense."

It added, “The Truth is that Amnesty has never presented this list as ‘NSO’s Pegasus Spyware List’.”

This part of the statement is what sections of the Israeli media reported and some Indian media outlets ran with to discredit the Pegasus Project investigation in its entirety.

Amnesty’s second statement

On July 22, after sections of the media claimed that Amnesty was backtracking on the investigation, the organisation released a press release stating that they “categorically stand by Pegasus Project and that the data is irrefutably linked to potential targets of NSO Group’s Pegasus spyware”.

Media misreports, politicians lap up

Through the day on July 22 Kabir spoke to Indian media outlets about the Pegasus Project revelations.

At 1.30 pm, Times Now tweeted that Kabir had made “sensational revelations” in an interview with Rahul Shivshankar. “Israeli journalist drops a bomb,” read a headline on the show.

Shivshankar persistently asked Kabir about the credibility of the database. Kabir reiterated that Amnesty continued to stand by it. He explained that Amnesty had never said it was a list of people directly targeted by NSO but that it was a “list of interest” of NSO clients.

Still, Shivshankar’s show went to town claiming that “Amnesty never linked data to NSO” and “Is Pegasus spygate call database fake?”

At 9.45pm, Times Now tweeted that Kabir “makes big disclosure; quotes Amnesty’s admission saying, ‘50,000 call list not linked to NSO spyware”.

Throughout the show, the anchor Padmaja Joshi referred to Kabir once, that too simply as an “Israeli journalist”.

When Newslaundry once again reached out to Kabir to ask about Times Now’s coverage of his reporting and statements, he said: “Well, what I said was it was not ‘directly’ linked to NSO. Again, I want to emphasise the word ‘directly’. I’m not saying that the list is not at all linked to NSO spyware. Some of them have proved to have Pegasus in them, we can’t discount that.”

India Today, meanwhile, interviewed Kim Zetter. Several people, including politicians and journalists, retweeted Zetter’s tweet. Although she later corrected herself, others did not follow suit.

At the very beginning of the show, Zetter said people were misinterpreting Amnesty’s statement and that “the list is not a hoax, it is not a bluff and it raises legitimate questions. Amnesty never asserted that the list is of people who were targeted with Pegasus”.

While she was saying these things, however, much like what Times Now did, India Today ran headlines such as “Amnesty backtracks on snooping list”, “Amnesty pulls back on ‘list’ claims”, and “U-Turn by Amnesty”. India Today also wrote an article titled “Amnesty says never claimed leaked phone numbers were of NSO Pegasus Spyware list”.

Despite Amnesty’s clarification, media outlets such as OpIndia wrote about Amnesty’s “massive u-turn”. Their article was titled “Amnesty now says they never claimed the ‘list’ was of NSO’s targets after lack of evidence was exposed, issues ambiguous statement”.

Amit Malviya, head of the BJP’s IT cell, called the investigation a “malicious report with no evidence”.

Quoting Zetter’s tweet, Shashi S, CEO of Prasar Bharati, said, “This is the kind of perverse journalism that results from media organisations pursuing an activist agenda where reportage is not based on facts but on fiction and speculation motivated by agenda driven activism to create disaffection within democracies.”

Rajeev Chandrashekhar, union minister of state for entrepreneurship, skill development, electronics & technology, went on to call it a “bogus hoax narrative” built around a so-called “list” of numbers.

What is the darn list?

Now that it’s clear what Zetter and Kabir said, and how a section of Indian media reported on what they didn’t say, let’s just go over what the list is or is not.

Confused? Well, here’s what we can deduce:

1. The list is not an “NSO list of Pegasus targets”. This is to say that the list is not indicative of the actual people targeted by Pegasus. Is it from an official NSO database? This is something that Amnesty has to clarify.

2. The list is indicative of potential people of interest for NSO clients. This means that the list has phone numbers that the NSO clients wanted to snoop on. So, is it a leak from the database of requests placed by the NSO clients? Again this is something that only Amnesty can tell us.

3. The list contains some phone numbers that were actually targeted with Pegasus. They include the number of Siddharth Varadarajan, co-founder of the Wire. The Washington Post also states that there is a tight correlation between time stamps associated with a number on the list and the initiation of surveillance attempts, in some cases as brief as a few seconds. Globally, 37 phones have been found to be infected by Pegasus or contain traces of the spyware. Amnesty was able to run 67 phones through a forensic analysis.

Here’s what even Zetter had to say.

Remember some of the questions around the antecedents of the list or its exact origin may remain a mystery because Amnesty and Forbidden Stories need to protect their source or whistleblower. This is not unique to Project Pegasus. We still don’t know who leaked the Radia Tapes, for example, or where the tapes came from.

What is important to know for now is that the list contains phone numbers of persons of likely interest to the NSO Group’s clients. So, essentially for governments that wanted to snoop on journalists, human rights defenders and political opponents, these people are as dangerous as terrorists, drug dealers, criminals, pedophiles. Think about that.