Apple spyware threat notification: Govt may put onus on citizens to prove breach

People look at the new iPhone 15 Pro as Apple's new iPhone 15 officially goes on sale across China at an Apple store in Shanghai

Unlike earlier, the Ministry of Electronics and Information Technology (MeitY) may not send a notice to Apple for the recent round of spyware attack threat notifications that were sent to a few Indian politicians and activists.

The ministry believes that the onus is on the citizens to prove any breach, and for that it is recommending such victims to submit their phones for checking by the Indian Computer Emergency Response Team (CERT-In), a source said.

In November 2023, Apple had sent a similar threat notification that several Opposition MPs and journalist had received from the company.   The issue had sparked a political firestorm with the opposition accusing the government of spying.

Denying the charge the government, sent a notice to Apple and sought clarification as well. CERT-In was roped in to investigate these claims. However, despite Apple officials meeting government officials regarding the matter in December 2023, the stage at which the investigation is in remains unclear.

A similar notification was also sent to a few Indian users on April 11, 2024.

The recent recipients of Apple's threat notifications include Congress' KC Venugopal, Iltija Mufti, media adviser and daughter of former Jammu and Kashmir chief minister Mehbooba Mufti, and Pushparaj Deshpande, founder of Samruddha Bharat Foundation,  and others. Users in 97 other countries too received similar notifications.

"This seems to be very routine. The main thing here is that the breach has to be proved. People can get their phones checked by CERT-In to see if such an attack or breach has happened or not," an official said.

However, an earlier recipient of such threat notification from Apple, expressed their wariness when it came to submitting their phone to the government for inspection.

"Spywares like Pegasus are used by governments. There is no question of submitting my personal mobile phone to government for checking in this situation," the Parliamentarian had earlier told Moneycontrol.

In the notification sent via email to the potential victims on July 10, Apple said, “Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware."

Moneycontrol has reached out to MeitY and Apple for comments on the matter and the article will be updated when a response is received.