Pegasus Spyware Scandal: WhatsApp Payments Faces More Roadblocks

Dealing with the political and cybersecurity ramifications of the Pegasus spyware scandal, the Indian government seems to be in no mood to allow WhatsApp to roll out its payment services in the country and is in talks with other authorities regarding the risks around WhatsApp Payments.

According to an ET report, the government has reached out to the National Payments Corporation of India (NPCI) and Reserve Bank of India (RBI) to raise concerns regarding data security in WhatsApp Payments “In case some extra steps need to be undertaken to ensure that the security of financial data is not breached,” a senior government official was quoted as saying.

The move has come in the wake of a lawsuit filed by WhatsApp against the Israel company NSO Group, which allegedly developed the Pegasus spyware used to spy on human rights activists, lawyers and journalists in India.

WhatsApp Payments Caught In Pegasus Scandal

Earlier this year, WhatsApp resumed the pilot of WhatsApp Payments in India with plans to launch the service by the end of this year. However, it is stuck in regulatory clearance for seemingly not complying with the RBI’s data-localisation norms for fintech companies, which has delayed the launch.

In October 2019, NCPI chief executive Dilip Asbe said WhatsApp would likely take two more months to comply with India’s data localisation norms, but the Pegasus spying scandal is likely to delay that even further.

Since the news of Pegasus snooping on Indian users emerged on October 29, the government and WhatsApp have been blaming each other.

While the government claimed that WhatsApp hadn’t shared any information regarding the breach, the instant messaging app said that it submitted two documents to the Ministry of Electronics and Information Technology (MeitY), one in May and another in September, informing the government about the breach. While IT ministry officials confirmed receiving the notice from WhatsApp in September, it said it was vague and did not explain the breach clearly.