A Handset in Every Pocket, a Spy in Every Room: The Silent Breach of State Secrets

By Engineer Arshad H. Abbasi & Malik Khuda Bakhsh Awan, former Inspector General of Police

Do you have a smartphone in your hands? Look at it carefully. Think of it as a grenade. The pin is not in your hand. It is a thousand miles away, in someone else’s fingers. You cannot see them, but they can see you. Your phone tells them where you are in real time, to the street, to the exact room. Someone is tracking you, very close, and you do not know it. Your messages are “end-to-end encrypted,” so you feel safe. You are not. Encryption protects a message while it travels across networks. It does not protect the phone that sends or receives it, and that phone is now the weakest link in the security chain.

WhatsApp’s encryption is real. Messages are scrambled between devices, and the company cannot read them in transit. But the gap between the message and the physical device is where the vulnerability lies. Commercial spyware like Pegasus compromises the handset itself. It reads messages after they are decrypted for display, records the microphone and camera, and copies files, so it never has to break the cryptography. WhatsApp, Signal, Telegram, and WeChat all lose their protection once the underlying device is owned by an adversary.

The scale of this issue turns it into a direct state problem. Pakistan’s PTA chairman told a National Assembly committee in early November 2026 that WhatsApp has roughly 100 million accounts in the country, with about one billion calls and 12 billion messages a day. These figures represent accounts rather than unique individuals, but the point stands. Ministries, regulators, police departments, journalists, and political party offices now run almost entirely on one consumer app, usually on personal phones, with no separation between private chat and official state business. Almost nobody uses a landline or an ordinary call for serious official conversation any more.

The best-documented legal and technical case is NSO Group’s Pegasus against WhatsApp itself. A U.S. jury found that NSO violated anti-hacking laws when 1,400 WhatsApp users were infected. In October 2025, Judge Phyllis Hamilton issued a permanent injunction barring NSO from targeting WhatsApp. She specifically noted NSO’s “multiple design-arounds,” including missed calls and zero-click attacks, while cutting the punitive award from about $167 million down to $4 million. NSO responded by stating the injunction did not apply to its commercial customers. The court stopped the vendor from attacking the platform, but it did nothing to restrain the governments that buy and deploy these surveillance tools.

Paragon’s Graphite spyware demonstrates the same operational pattern. Investigators at Citizen Lab found that attackers added targets to a WhatsApp group and sent a malicious PDF that the device processed automatically in the background, triggering a zero-day flaw. WhatsApp subsequently notified roughly 90 Android users across more than two dozen countries. The crucial lesson is that a message you never open can still serve as an entry point, simply because the application parses incoming files automatically in the background.

In India, the public record is thoroughly documented regarding targeting and heavily contested regarding attribution. The 2021 Pegasus Project, a international consortium of 17 media outlets, uncovered more than 1,000 Indian phone numbers on a surveillance list, alongside hundreds of targets from Pakistan. Digital forensics identified Pegasus traces on the phones of journalists like The Wire’s Siddharth Varadarajan and M.K. Venu, as well as poll strategist Prashant Kishor. Opposition leader Rahul Gandhi, former election commissioner Ashok Lavasa, and ministers Ashwini Vaishnaw and Prahlad Patel also appeared on the leaked list as potential targets. Appearing on a list indicates target selection rather than guaranteed infection. However, Citizen Lab’s 2018 report identified a specific operator codenamed “Ganges,” active since 2017, with most infected networks located inside India. This aligns with the 2017 timeline often cited for India’s acquisition of the software, though it does not conclusively prove who operated it.

India’s Supreme Court subsequently appointed an independent technical committee. It reported finding malware in five of 29 submitted phones, but could not state definitively whether it was Pegasus, noting that the government failed to cooperate with the probe. That outcome represents neither an exoneration nor a confirmation. The Indian government’s official position, voiced through ruling BJP leaders, remains that the allegations are an international conspiracy to malign India. Ultimately, there is no public evidence that every Indian bureaucrat and minister is monitored; the sourced record demonstrates selected high-value targets rather than blanket coverage.

Pakistan appears throughout this narrative as a key target. Pegasus Project reporting indicated that hundreds of Pakistani numbers were selected on the surveillance list. Islamabad announced it would investigate whether executive phones were surveilled and stated it would seek a UN probe. A 2019 Guardian report had already described Pegasus allegedly being used against Pakistani state officials’ phones. The narrative of how foreign influence operationalizes itself within Pakistan’s governance apparatus reveals a calculated strategy of systematic institutional penetration.

An Islamabad-based think tank—functioning effectively as a localized proxy for India’s Research and Information System for Developing Countries (RIS)—has systematically embedded itself into the core of the state’s administrative setup. Under the guise of civil society engagement, its Executive Director leveraged strategic seminars and sponsored foreign delegations for senior bureaucrats to cultivate access and influence. This access translated into key institutional footholds, including seats on the Board of Governors of the National School of Public Policy (NSPP) and roles as a Subject Specialist and Interview Panel Member for the Federal Public Service Commission (FPSC). These positions provided direct visibility into the selection, training, and promotion pipelines of Pakistan’s top executive leadership. Rather than serving the public interest, these board positions and administrative access were converted into intelligence assets for handlers in New Delhi. Financed by substantial foreign funding, this network highlights a critical vulnerability: when massive financial inflows enter the equation, oversight breaks down even at the highest levels of the executive secretariat. This exposure demonstrates how soft-power apparatuses, foreign funding, and cyber-intelligence vectors like Pegasus combined to compromise key decision-makers and target the integrity of Pakistan’s governance system from within.

There is a further danger that extends far beyond reading private messages: the phone acts as a continuous location beacon. A mobile phone reveals where its owner is, accurately and continuously, through GPS, cell towers, and Wi-Fi connections. Anyone with access to that stream of data knows where you sleep, whom you meet, and when you travel. Combined with intercepted messages, it allows an observer to build a specific narrative about you, and in a tense security environment, that narrative can be lethal. A location record placing you near a scene, or a file or message that is planted on your device or altered after the fact, can easily be presented as proof that you were carrying a bomb or a grenade. Spyware that can read a phone can also, in principle, write to it. Anyone who can alter a document after six hours, as tests have demonstrated, can also inject something that was never originally there. A phone that records where you are and what you hold can be used to protect you or frame you, depending entirely on who controls the data and who verifies it. Most citizens, and many officials, have no means of telling the difference. This is precisely why forensic verification and independent oversight matter, because a digital record is only as trustworthy as the process that handles it.

Is Pegasus a cause of governance failure in Pakistan? There is an urgent need for a forensic audit of WhatsApp messages and attached documents among top bureaucrats. Spyware may have exposed the sheer intensity of these attacks. What the record proves is that Pakistan’s official communication habits make it an easy target for any capable adversary. Sensitive discussions occur routinely on consumer apps and personal handsets. Phones are rarely patched, isolated, or inspected. There is no public forensic capacity or published incident-response protocol for handling spyware infections.

The wider Israeli-origin surveillance toolkit involves distinct categories of technology, and understanding the distinction matters. Pegasus, Graphite, Candiru’s Sherlock, and QuaDream are remote implant spyware that infects a device over the network, often requiring zero clicks from the target. Cellebrite represents forensic extraction, which requires physical access to a handset and is deployed by law enforcement and border authorities. Corsight and Blue Wolf are biometric surveillance platforms, which track individuals in physical space and have nothing to do with phone compromise. What these systems share is their customer base: sovereign governments. Citizen Lab found Paragon’s infrastructure linked to Australia, Canada, Cyprus, Denmark, Israel, and Singapore, several of which are established democracies. The surveillance industry sells indiscriminately to democracies and autocracies alike, operates with weak export oversight, and offers almost no legal redress for victims.

No countermeasure is completely effective against a state-level zero-click attack, but organizational exposure can be drastically reduced. Official state business should run exclusively on dedicated, managed devices with a minimal set of approved applications, and consumer apps like WhatsApp should never carry classified deliberations. High-risk officials should keep operating systems updated, enable iOS Lockdown Mode or Android’s equivalent, and reboot handsets regularly, since many temporary implants do not survive a system restart. Auto-download of media, link previews, and open group additions should be disabled, as Paragon’s attack relied specifically on group adds and automatic background file handling. Pakistan urgently needs a national forensic team trained on tools like Amnesty’s Mobile Verification Toolkit, with its findings made public. For the most sensitive strategic conversations, the safest assumption is that the phone is already compromised, which means meeting in person inside rooms where electronic devices are strictly prohibited. Finally, any interception tools Pakistan purchases should face parliamentary-level oversight, and the country must actively press for international export controls on commercial spyware.

WhatsApp’s encryption is not the structural weakness. The weakness is treating a phone, a consumer app, and a state secret as if they belong together. The Indian Pegasus cases are documented as targeting and contested as attribution. Pakistan’s exposure is real but unquantified, and its institutional response so far has been mostly rhetorical. Until governments enforce a total separation between official communication and consumer apps, protect the integrity of digital evidence, and publish independent forensic results, Pakistan remains at a critical cybersecurity crossroad—where the question “was it Pegasus?” will keep going unanswered while state security hangs in the balance.