Finalist: Staff of The Washington Post
Nominated Work
By Gerry Shih
MUDBIDRI, India — At first, the WhatsApp messages touted roads paved, schools built, free food distributed to the poor — all the usual pitches from a government during election season. But as May drew closer, the messages turned darker.
One viral post that landed in Sachin Patil’s iPhone listed the names of 24 local Hindu men it said were murdered by Muslims. Another mass message warned of Hindu girls being groomed by Muslim men to join the Islamic State. Yet another viral post that reached Patil made an urgent appeal to vote: “If the BJP is here, your children will be safe. Hindus will be safe.”
By the time election day arrived here in south India’s Karnataka state, Patil, a 25-year-old bank teller in a sleepy village outside Mangaluru, said he was receiving 120 political messages a day in six WhatsApp groups. “They were definitely a reminder,” Patil said, to cast a ballot for the Hindu nationalist Bharatiya Janata Party that governs India.
The BJP, led by Prime Minister Narendra Modi, and affiliated Hindu nationalist groups have been in the global vanguard of using social media for political aims — to advance their ideology and cement their grip over the world’s largest electoral democracy. They have perfected the spread of inflammatory, often false and bigoted material on an industrial scale, earning both envy and condemnation beyond India’s borders.
Central to the success of the BJP, a party with 180 million members, is a massive messaging machine built on top of U.S. social media platforms. It is part of a wider effort by the right-wing forces aligned with Modi to wield technology in various ways — and restrict its use by opponents — in pursuit of a Hindu nationalist agenda that seeks to marginalize religious minorities and suppress criticism.
As hate speech and disinformation in India have grown in recent years, Silicon Valley giants have at times tried to police this incendiary content. But often they have struggled — or willingly turned a blind eye.
The Biden administration, meanwhile, has been aggressively courting India as a counterweight to China even as Modi has accelerated his country’s descent into autocracy. Just this month, the world’s attention was urgently focused on the conduct of the Modi government, after Canada alleged that Indian agents may have assassinated a prominent Sikh separatist on Canadian soil, again raising questions about the efforts of Western countries to draw closer to New Delhi.
This spring, Washington Post journalists spent several weeks in Karnataka as it was gearing up for elections and gained rare access to the vast messaging machinery and the activists who run it. In extensive interviews, BJP staffers and the party’s allies revealed how they conceive and craft posts aimed at exploiting the fears of India’s Hindu majority, and detailed how they had assembled a sprawling apparatus of 150,000 social media workers to propagate this content across a vast network of WhatsApp groups.
Using this infrastructure, the party was able to send messages touting the BJP’s accomplishments and denigrating its opponent, the Indian National Congress party, directly into the pockets of hundreds of millions of people.
But beyond the party’s official online efforts, there was also a shadowy parallel campaign, according to BJP staffers, campaign consultants and party supporters. In rare and extensive interviews, they disclosed that the party quietly collaborates with content creators who run what are known as “third-party” or “troll” pages, and who specialize in creating incendiary posts designed to go viral on WhatsApp and fire up the party’s base. Often, they painted a dire — and false — picture of an India where the nation’s 14 percent Muslim minority, abetted by the secular and liberal Congress party, abused and murdered members of the Hindu majority, and where justice and security could be secured only through a vote for the BJP.
Today, India is WhatsApp’s largest market, with more than 500 million users. Social media researchers, government officials and WhatsApp itself have acknowledged the platform’s potential as a tool to fan polarization and stoke violence. But precisely what goes on within the BJP’s WhatsApp ecosystem has long been a mystery to political scientists and opposition parties, which have struggled to replicate the party’s digital success.
“Other parties in India have tried this. We’ve seen it in other countries like Brazil. But WhatsApp was really mastered first, and at scale, by the BJP,” said Rutgers University professor Kiran Garimella, who has studied WhatsApp’s role in Indian politics. “It requires resources, planning, investment, a top-down belief in building this infrastructure. But 99 percent of what’s happening in these groups is off-limits. We have no visibility at all.”
On the breezy, palm-lined coast of Karnataka, few trolls had more influence than “Astra,” which means “weapon” in Sanskrit. Most BJP party workers said they did not know Astra’s real identity, but many spoke glowingly about his fiery reputation.
Astra cranked out polarizing WhatsApp posts that would be shared over and over in coastal Karnataka — like those that eventually reached Patil, the bank teller. Astra was courted by local BJP candidates whenever they launched their campaigns, although he rarely spoke at rallies. Astra was such a militant voice on the internet that even BJP leaders feared being accused by him of being too moderate toward Muslims.
“Pages like Astra are much bigger than the official BJP accounts,” said Sudeep Shetty, who heads social media for the BJP in Udupi district. “They’re our secret weapon.”
On a sultry morning in April, with the election still a month away, Astra emerged from his office, an airless, converted college dormitory overlooking a dirt cricket field. He pressed his palms together in a traditional Hindu greeting and introduced himself.
In person, Astra wasn’t as fearsome as he was by reputation. He was a willowy, bespectacled 28-year-old, and his name, he said, was Sunil Poojary.
A vast army
Wedged between the Arabian Sea and the Western Ghats mountain range, the twin cities of Mangaluru and Udupi boast top universities and historic temples. Along tidy village roads, Muslim women cloaked in body-length black niqabs walk past Hindu priests resting under sacred fig trees. Ethnically and culturally diverse but conservative, affluent yet a hotbed of religious friction, the coast has always stood apart from the rest of Karnataka state.
In the 1980s, the Rashtriya Swayamsevak Sangh (RSS), the paramilitary volunteer organization that serves as an umbrella for Hindu nationalist groups, swept in. The RSS built homes for poor tribes and fed the needy. It sent aspiring politicians into the BJP, its political wing. It established camps for youngsters and indoctrinated them in Hindutva, or Hindu nationalist ideology.
It funneled them into hard-line activist groups, most notably the Bajrang Dal, a group that accosted and beat up Muslims accused of smuggling cows, considered sacred in Hinduism. Gangs of Bajrang Dal members tracked down and forcibly separated interfaith couples, often accusing Muslim men of waging “love jihad,” and frequently clashed with Muslim activist groups.
While young men roiled the streets, political parties jockeyed at the ballot box. In the past seven years, the BJP and Congress — the two biggest parties — have battled on WhatsApp. (While Congress attracts some Muslim voters, its leadership happens to be predominantly Hindu.)
It was approaching noon one day this spring, and Ajith Kumar Ullal, the BJP’s social media head in Mangaluru, had been up for seven hours, barking orders over a droning air conditioner that struggled to match the south India heat.
Ullal, 59, worked out of a “war room” in the BJP’s gleaming downtown office, commanding a social media “cell” of nine volunteers responsible for an area in coastal Karnataka inhabited by 1.5 million people. The cell included his deputy, who serves as copywriter, and three graphic designers who combined text with photos and logos to craft rectangular picture posts, widely considered the most attention-grabbing and shareable format on WhatsApp.
Volunteer fieldworkers, who had combined phone numbers from voter registration rolls with information collected going door to door, added as many residents as possible to WhatsApp groups. All told, the BJP had 150,000 workers staffing WhatsApp just for the state election, according to Vinod Krishnamurthy, a former head of BJP social media for Karnataka.
Ullal, himself, belonged to 200 WhatsApp groups. Within an hour of seeding a new WhatsApp post, Ullal expected it to be spread to hundreds of thousands of residents in his coastal district. “Each and every BJP volunteer who has a mobile is a social media warrior,” he said.
A revolution begins
This revolution in political communications started to stir in 2016, when the Reliance conglomerate entered the telecommunications sector and offered new customers unlimited free data, sparking a price war. Within three years, India’s mobile data went from among the most expensive to among the cheapest in the world.
Late that decade, BJP officials began assembling huge databases of phone numbers and seeking ways to streamline the messaging process, three former campaign officials recalled. During an election in Gujarat state, the party used software written in Python code that could hijack WhatsApp’s web interface to spread attack ads to tens of thousands of recipients with just a few clicks, according to an internal presentation seen by The Post.
WhatsApp’s engineers in 2018 introduced new limits on message-forwarding in India after witnessing the rise of fast-spreading rumors, which had led to mob killings and other tragic consequences. They also made technical changes to curb mass messaging.
So the BJP turned to its biggest strength: organizational discipline. “Everyone who wants to know how the BJP operates looks for hi-fi, extraordinary tech, and some of that exists,” said a former BJP campaign manager. “But the reality is, it’s mostly brute, manual labor.”
According to a field study conducted in 2020, Indian users told Meta researchers they “saw a large amount of content that encouraged conflict, hatred and violence” that was “mostly targeted toward Muslims on Whatsapp groups.” “Anti-Muslim rhetoric … is likely to feature in upcoming elections,” warned the internal study, which was shared with The Post by whistleblower Frances Haugen. One former Meta employee who examined Indian elections said that the problem has been recognized internally for years but that executives have not found a solution to monitor or moderate a platform that is by design private.
In response to questions about what measures parent company Meta has taken to address divisive political material on WhatsApp, Meta spokeswoman Bipasha Chakrabarti said WhatsApp has limited message-forwarding and used spam-detection technology to prevent automated mass messaging.
When asked whether the company was aware of the online campaigns in Karnataka, Chakrabarti said: “WhatsApp provides end-to-end encryption by default to protect people’s conversations, and that means that nobody — including WhatsApp — can read or listen to your message.” She declined further comment.
At the start of the campaign season, Ullal added The Post to one of his WhatsApp groups, and in the ensuing weeks, his team mostly disseminated traditional campaign messages about public services and government achievements. But as election day neared, the tenor of the campaign changed dramatically, and the WhatsApp group became strewn with incendiary posts and appeals to religious bigotry. Ullal compared it to cricket strategy. “In the last few overs,” he said, “that’s when you do the big hitting.”
One post likened Congress politicians to Tipu Sultan, an 18th-century Muslim king who is often vilified for allegedly butchering Hindus. Another post defended as a “victim of conspiracy” a Hindu vigilante who was arrested in March for allegedly beating a Muslim man to death.
Typically, BJP staffers didn’t create the inflammatory content, said Akshay Alva, Ullal’s deputy. But they spread it anyway. “There are things we may not say, but the troll pages say it,” Alva said.
A string of viral hits
Sunil Poojary pounded on his office desk.
“I don’t want beautiful videos. I want only content!” he shouted toward the next room, where Ashwini, his video editor, was struggling to keep up with the pace.
On this day in April, the BJP’s nominees for state assembly were registering their candidacies, officially kick-starting the election season, and Poojary, who led a team of four, was overwhelmed. New computers and streaming equipment for YouTube were still sitting unboxed in his windowless office. Using his three Android phones, Poojary needed to churn out a steady stream of image posts, stamp them with the Astra logo and blast them out to 30 WhatsApp groups.
In the past few days, Astra had scored a string of viral hits. Poojary had compared the election to a struggle between nationalists (the BJP) and terrorists (the Congress party). He disseminated a photo of a Muslim man groping a statue of a goddess worshiped by a community that’s considered a swing vote in the state. He also edited down a speech of a local Congress candidate, he admitted, to make it falsely seem that he was praising Muslim kings.
Poojary didn’t make money from the Astra posts, he said. But his social media exploits and his reach helped garner him an unusual level of influence for a 10th-grade dropout who had never held a regular job: The chief minister of Karnataka shared Astra posts on Facebook, and Poojary said he would get calls from other top government and party officials.
A writer, not a fighter
Poojary, who hails from an ethnic group that traditionally tapped coconut trees for sap, never expected this kind of success. When he was 7, Poojary recalled, the RSS arrived at his family’s remote two-acre farm carved out of the jungle. They asked to recruit him. His father said yes.
In the local RSS branch, young Sunil learned Hindu chants and nationalist songs. He performed military drills and practiced yoga. His formal schooling was derailed in the 10th grade when his father died, leaving him adrift, he said. But he had already found a family in the RSS and purpose in hard-line Hindutva.
Elders in Poojary’s RSS chapter diverted him into the Bajrang Dal, but he quickly knew he did not fit in with muscle-bound bruisers. When his Bajrang Dal gang would start drinking by the highway to steel themselves for ambushing cow transporters, Poojary would not drink or join in the beatings. When they roamed around looking to break up cases of “love jihad,” Poojary would urge what he considered restraint: “I would tell others, ‘Don’t hit the women.’”
Instead, he turned to writing, penning lengthy essays about Hindu mythology and Indian history, and self-publishing three books.
But nothing gave him the attention he desired until he found WhatsApp. In 2020, Poojary launched Astra and three other troll pages and learned to craft headlines, insert images using the free Android app Blend Collage and tweak colors for maximum virality. He reveled in the fact that people assumed the man behind Astra was a “gangster.”
“If people see me, they’ll see I’m slim and diminutive,” he said. “But I have a gift from God: Goddess Saraswati holds my hand and tongue.”
Braying for revenge
In April, the BJP’s state leadership sent shock waves along the coast by tapping a local businessman named Yashpal Suvarna as a candidate for the state assembly. In 2005, as a local leader of the Bajrang Dal group, Suvarna had become known after stopping two Muslims transporting cows in a truck, stripping them naked and parading them before reporters while police looked on.
Given Suvarna’s past as a thug, his campaign team was hoping to use WhatsApp to soften his image and showcase his “humility.” But Suvarna’s personal assistant Yatish felt unsure, so he called up the best social media whiz he knew: Astra.
Poojary told the campaign that the strategy would not work. Up to a third of voters were young men, who liked an aggressive candidate, he reasoned. Furthermore, the Congress party was hinting that if elected, it would ban the Bajrang Dal. Suvarna’s team pivoted. It began sharing to about 1,000 WhatsApp groups strident posts bearing Suvarna’s face next to a menacing Lord Bajrangbali, the deity after which the Bajrang Dal is named, and boasting of his ties to the group.
Poojary also jumped into action. To boost the BJP campaign, he exploited a number of communal killings that had rattled Karnataka the previous summer.
In July 2022, a Muslim teenager was killed in an altercation with members of the Bajrang Dal. That led to the revenge killing of a BJP volunteer by local members of an Islamist militant group, according to Indian law enforcement. Poojary and several other right-wing influencers then spread material agitating for the volunteer’s death to be avenged.
Days later, around sundown on July 28, Mohammed Fazil, 23, was hacked to death by four masked men as he walked near a busy highway crossing north of Mangaluru. Police said Fazil was randomly targeted as a Muslim. At a Bajrang Dal rally, a Hindu nationalist leader openly boasted that Fazil was killed out of revenge. The role of the heated WhatsApp discourse in the violence remains unclear.
A perpetual ‘civilizational battle’
Looking back months later, Poojary said he believed that the anger circulating on WhatsApp had contributed to the bloodshed and that violence could be justified in the service of Hinduism.
Santosh Kenchamba, who runs the highly influential Rashtra Dharma troll page, said he also called for the revenge killing. He explained that it was part of a perpetual “civilizational battle” by online activists to help remake India into a Hindu state where Muslims knew their place.
As the election heated up in April, Poojary doubled down on spurious claims on WhatsApp that Muslims, abetted by the Congress party, had killed dozens of other Hindu activists.
One of the voters who received these pre-election messages was Patil, the bank teller. Lounging with friends outside a barbershop not far from where Fazil was killed, Patil, a middle-class young Hindu man with a taste for flower-print shirts and new iPhones, said he had known Fazil from school.
Patil said that while growing up, he did not think Fazil, or most Muslims, posed much of a threat. But over the past five years, Patil had become increasingly troubled by what he was seeing on WhatsApp about the danger Muslims allegedly posed, he said. He had heard anonymous voice recordings on WhatsApp that purported to be of Muslim extremists plotting to kill Hindus. As the May election approached, he received warnings about more violence if Congress won.
Patil did not question any of this disinformation. Instead, he and his friends, who said they consumed news only from WhatsApp, arrived at an inevitable conclusion.
“Hindus are in danger,” Patil said.
An unending struggle
With the campaign reaching fever pitch at the start of May, Modi landed on the coast to lead a teeming rally. Poojary stood in the heat, mostly bored as his hero spoke about the economy. But after an hour, Modi’s voice began to rise. His arms reached for the sky. Finally, he unleashed his fury over the Congress party’s proposal to ban the Bajrang Dal.
“When you press the button in the polling booth,” Modi thundered, “punish them by saying, ‘Hail, Lord Bajrangbali!’”
The crowd, including Poojary, erupted in rapture.
But even with the prime minister’s last-minute intervention, the statewide election proved to be a disappointment for the BJP. Television analysts said the party had been weakened, in part, by infighting among its leaders, and the Congress party gained enough seats to take control of the state legislature in Karnataka.
On a quiet street north of Mangaluru, Patil — who ultimately had voted for the BJP — worried about Hindus’ safety. With Congress now running the state, he said, “Muslims will be emboldened.”
But the shrill warnings that left Patil so alarmed had actually helped carry the day for the BJP along the coast. In this part of the state, where operatives such as Poojary and Ullal had filled voters’ screens with their divisive content, the BJP swept all but two of the 13 contested legislative seats. Down by the sea, roads were blanketed every 100 yards by banners congratulating one of the region’s rising stars, “Yashpal Suvarna, Member of the Legislative Assembly.”
Up in the red clay hills, Poojary seemed relieved. Five local BJP candidates he had supported on social media all won. But he was also worried, he admitted, that with Congress now controlling the state police, he might be charged with libel or spreading fake information.
Still, Poojary could not help continuing to stir the pot. The election had barely ended, and he was already spreading posts that compared the new Congress state government to Tipu Sultan, the Muslim oppressor. He warned, using an image of splattered blood, that a Hindu holy man had already been murdered near Bangalore.
In his windowless office, Poojary was still giving directions to his video editor and graphic designer every few minutes. His phone was still lighting up constantly with WhatsApp notifications.
“The Muslims have won,” he said, “for now.”
He excused himself, pressed his palms together in front of his heart, and went back to work.
Mohit Rao and Shams Irfan contributed to this report.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Copy editing by Gilbert Dunkley and Martha Murdock. Story editing by Alan Sipress. Project editing by Jay Wang.
By Joseph Menn and Gerry Shih
SAN FRANCISCO — Nearly three years ago, Facebook’s propaganda hunters uncovered a vast social media influence operation that used hundreds of fake accounts to praise the Indian army’s crackdown in the restive border region of Kashmir and accuse Kashmiri journalists of separatism and sedition.
What they found next was explosive: The network was operated by the Indian army’s Chinar Corps, a storied unit garrisoned in the Muslim-majority Kashmir Valley, the heart of Indian Kashmir and one of the most militarized regions in the world.
But when the U.S.-based supervisor of Facebook’s Coordinated Inauthentic Behavior (CIB) unit told colleagues in India that the unit wanted to delete the network’s pages, executives in the New Delhi office pushed back. They warned against antagonizing the government of a sovereign nation over actions in territory it controls. They said they needed to consult local lawyers. They worried they could be imprisoned for treason.
Those objections staved off action for a full year while the Indian army unit continued to spread disinformation that put Kashmiri journalists in danger. The deadlock was resolved only when top Facebook executives intervened and ordered the fake accounts deleted.
“It was open-and-shut” that the Chinar Corps had violated Facebook’s rules against using fictional personas to surreptitiously promote a narrative, said an employee who worked on the Kashmir project. “That was the moment that almost broke CIB and almost made a bunch of us quit.”
Three others who were involved confirmed the previously unreported internal battle. Most of those who spoke to The Washington Post discussed company matters on the condition of anonymity. Facebook did not dispute their account.
The Kashmir case is just one example of how Facebook has fallen short of its professed ideals in India under pressure from Prime Minister Narendra Modi’s Bharatiya Janata Party (BJP). India, a country with a population that is 80 percent Hindu and 14 percent Muslim, has long wrestled with religious strife. But in the past decade, the Hindu nationalist BJP has been accused of abetting violence and fanning incendiary speech against Muslims to stoke support from its political base. And often, when harmful content is spread by BJP politicians or their allies on Facebook, the platform has been reluctant to take action. The company denied acting to favor the BJP.
For Silicon Valley, which has seen user numbers in the United States plateau and international growth become critical to Wall Street shareholders, India is the biggest remaining prize and an ideal market. It is substantially English-speaking and rapidly growing, a tech-savvy democracy that is being wooed by the Biden administration to counter China. The number of Facebook users in India is greater than the entire U.S. population; India is also one of the biggest markets for X, formerly known as Twitter. That has meant special treatment for content that otherwise would violate both platforms’ terms of service.
Facebook’s cautious approach to moderating pro-government content in India was often exacerbated by a long-standing dynamic: Employees responsible for rooting out hackers and propagandists — often based in the United States — frequently clashed with executives in India who were hired for their political experience or relationships with the government, and who held political views that aligned with the BJP’s.
Interviews with more than 20 current and former employees and a review of newly obtained internal Facebook documents illustrate how executives repeatedly shied away from punishing the BJP or associated accounts. The interviews and documents show that local Facebook executives failed to take down videos and posts of Hindu nationalist leaders, even when they openly called for killing Indian Muslims.
In 2019, after damning media reports and whistleblower disclosures, Facebook’s parent company, now named Meta, bowed to pressure and hired an outside law firm to examine its handling of human rights in India. That probe found that Facebook did not stop hate speech or calls for action ahead of violence, including a bloody religious riot in Delhi in 2020 that was incited by Hindu nationalist leaders and left more than 50 people, mostly Muslims, dead. Meta never published the document, strictly limited which executives saw it and issued a public summary that emphasized the culpability of “third parties.”
Social media companies today do not lose much when they call out the Russian or Chinese governments for propaganda or dismantle networks of fake accounts tied to those countries. Most U.S. social media platforms are banned in those countries, or they do not generate significant revenue there.
But India is at the forefront of a worrying trend, according to Silicon Valley executives from multiple companies who have dealt with the issues. The Modi administration is setting an example for how authoritarian governments can dictate to American social media platforms what content they must preserve and what they must remove, regardless of the companies’ rules. Countries including Brazil, Nigeria and Turkey are following the India model, executives say. In 2021, Brazil’s president at the time, Jair Bolsonaro, sought to prohibit social networks from removing posts, including his own, that questioned whether Brazil’s elections would be rigged. In Nigeria, then-President Muhammadu Buhari banned Twitter after it removed one of his tweets threatening a severe crackdown against rebels.
The day before May’s tight election in Turkey, Twitter agreed to ban accounts at the direction of the administration of President Recep Tayyip Erdogan, including that of investigative journalist Cevheri Guven, an Erdogan critic.
“Nigeria very much took Modi’s playbook, and it exacerbated existing tensions in Turkey,” a former Twitter policy lead said, speaking on the condition of anonymity to discuss internal matters.
“All of the hard questions around tech come to a head in India. It is a huge market, it is a democracy, but it is a democracy with weak judicial protections, and it’s really geopolitically important,” said Brian Fishman, a former U.S. Army counterterrorism expert who led efforts to fight extremism and hate groups for Facebook until 2021.
U.S. officials depend on nuclear-armed India as a strategic counterweight to neighboring China. And they have been willing to overlook human rights abuses and other problems in India because the officials deem the geopolitics a higher priority, former U.S. officials say. India’s success against the internet companies has inspired many imitators, Fishman added.
“We’re moving into an era around the globe where governments have gotten off their hands and built legal frameworks, and in some cases extralegal frameworks, that allow them to directly pressure the companies,” he said.
A covert campaign
When Facebook’s U.S. investigators first saw the posts from accounts that purported to be residents in Kashmir, it wasn’t hard to find evidence of a central organization. Posts from different accounts came in bursts, using similar words. Often, they praised the Indian military or criticized India’s regional rivals — Pakistan and its closest ally, China.
The technical information about some of the accounts overlapped, and the geolocation data associated with some accounts led directly to a building belonging to the Indian army.
The disinformation hunters also found that the fake accounts often tagged the official account of the Chinar Corps, India’s main military force in Kashmir, showing that they were not putting great effort into disguising themselves.
For a couple of months, employees said, the Facebook team mapped out the network in preparation for rooting out the whole operation, a standard procedure for combating coordinated inauthentic behavior.
Often, the accounts promoted YouTube videos about problems in Pakistan. Some featured a channel run by Amjad Ayub Mirza, a writer from the Pakistani-controlled part of Kashmir who has declared that Muslims are treated well in India and has called on minorities in Pakistan to rise up against the government.
“The reality is that the people being persecuted inside India and also outside the country are actually the Hindus,” Mirza once told an interviewer. “One has to ponder over the question — where did terrorism start from? Terrorism started from Pakistan.”
In just 32 minutes on May 24, 2021, a Post review found, 28 accounts from the covert Chinar Corps network on Twitter shared a post criticizing Pakistan’s treatment of Muslim Uyghurs who had fled oppression in China. Some made the point in English or Hindi that “Pakistan is not a safe place for Muslim minorities.” Twitter released its database of network account activity to researchers last year, and The Post obtained it. Though the database did not attribute the accounts to any entity, employees at Twitter and Facebook told The Post they were from the Chinar Corps. A research team at the Stanford Internet Observatory pointed to circumstantial evidence of a connection between the accounts and the military unit. Facebook said it did not preserve its accounts, making research more difficult.
At least 43 tweets contained some version of: “My religion is Islam, but my culture is Hinduism.” Another dozen said the account holders were Muslim but “Indian first.”
The campaign was unfolding at a sensitive time in Kashmir, claimed in its entirety by both India and Pakistan and divided into Indian- and Pakistani-controlled sections. For decades, India administered its portion as a semiautonomous region while its army fought a separatist insurgency that was supported by many Muslims there and often backed by Pakistan.
In 2019, the Modi government stunned the world by announcing a constitutional change that revoked Kashmir’s semiautonomous status and transferred it to New Delhi’s direct rule. The move triggered protests as well as the army crackdown in Kashmir, which included alleged torture and widespread internet shutdowns. With popular anger reaching a boiling point in Kashmir, the Indian government felt pressed to respond.
In public, Indian officials argued that Kashmir’s Muslims would benefit from closer integration with India. Meanwhile, the Chinar Corps covertly spread its messaging. Jibran Nazir, a Kashmiri journalist working in central India, said he was “shocked” to one day find his photo adopted as the avatar of two anonymous Twitter accounts spreading the #NayaKashmir, or “New Kashmir” hashtag, which touted Kashmir’s prosperity under New Delhi’s control.
“They were recently created accounts that had more than 1,000 followers each,” Nazir recalled. “The accounts wanted to show Kashmiris are doing well, which they’re not.”
The Chinar Corps’s stealth operation kept pushing that line — but also went further. It called out independent Kashmiri journalists by name, disclosing their personal information and attacking them using the anonymous Twitter accounts @KashmirTraitors and @KashmirTraitor1, according to Stanford’s analysis and The Post’s review.
One target was journalist Qazi Shibli and his publication, the Kashmiriyat.
“@TheKashmiriyat posts #fake news on the various operations conducted by the #IndianArmy causing hate amongst people for the #Army,” @KashmirTraitors wrote in a series of tweets. “Even the positive things like ration distribution that are happening in #Kashmir are shown in a negative prospect in posts of @TheKashmiriyat.”
“The #traitor behind this account and website is @QaziShibli (born in 1993) who has been detained numerous times under various charges for cybercrimes and posting content against national security.”
Shibli’s home was raided, and he was jailed repeatedly on charges including violation of the Public Safety Act, according to the Committee to Protect Journalists. The pressure online was crippling, Shibli said.
“A lot of people left work at the Kashmiriyat” because of the attacks, he told The Post. “It got to the point that a lot of people were not willing to work with us.”
Shibli said that sources dried up and that even personal friends grew afraid to speak with him.
The @KashmirTraitors tweet with the most “likes” targeted journalist Fahad Shah in early 2021, saying the founder of the Kashmir Walla magazine “rigorously publishes content on anti-#India sentiments.”
Shah’s coverage of Kashmir had been published by the Guardian, Foreign Affairs and Time. He was later arrested and accused of “frequently glorifying terrorism, spreading fake news, and instigating people” under the Unlawful Activities Prevention Act. He remains in prison today.
A security official recently based in Kashmir with knowledge of the matter confirmed the existence of the Chinar network, saying it was a failed attempt to counter narratives from Pakistan.
A couple of months into its investigation, Facebook’s Coordinated Inauthentic Behavior team handed its findings to supervisors and security policy chief Nathaniel Gleicher, who then informed Facebook’s team in India.
Executives there began raising objections. It wasn’t the first time they had.
Turning a blind eye
Even before Modi’s rise in 2014, the major U.S. social media companies were overwhelmed by the sheer number of languages and cultures that make up India, according to current and former employees. Inflammatory speech was often coded with slang or references that eluded those unfamiliar with India’s political history, culture or latest memes.
But the problem wasn’t just about resources. Employees described broad reluctance to take down posts of any kind from Modi’s BJP or its affiliates or to make designations that would cast India in a negative light.
Indian content moderation “was always a hands-off situation because of the political pushback,” said a former employee familiar with the India team. During internal discussions with executives in California and elsewhere, the India office argued in effect that “this is our area; don’t touch it,” the employee said. India-related content policy employees “would use a case-law-setting tone, instead of what human harm was being done.”
After U.S. Facebook employees in 2020 warned that Indian Hindu nationalist groups were spreading the hashtag #coronajihad, implying that Indian Muslims were intentionally spreading the coronavirus in a conspiracy to wage holy war, a content policy staffer for the region pushed back, arguing that the meme didn’t amount to hate speech because it wasn’t explicitly targeting a people, two former employees recalled. (Facebook eventually barred searches for that hashtag, but searching for just “coronajihad” returns accusatory posts.)
In late 2019, Facebook data scientist Sophie Zhang tried to remove an inauthentic network that she said included the page of a BJP member of Parliament. She was repeatedly stymied by the company’s special treatment of politicians and partners, known as Xcheck, or “cross check.” Facebook later said many of the accounts were taken down though it could not establish that the BJP parliamentary member ’s page had been part of the network.
The following year, documents obtained by Facebook employee-turned-whistleblower Frances Haugen show, Kashmiris were deluged with violent images and hate speech after military and police operations there. Facebook said it subsequently removed some “borderline content and civic and political Groups from our recommendation systems.”
In one internal case study on India seen by The Post, Facebook found that pages with ties to the Hindu nationalist umbrella organization Rashtriya Swayamsevak Sangh (RSS) compared Muslims to “pigs” and falsely claimed that the Quran calls for men to rape female family members. But Facebook employees did not internally nominate the RSS — with which the BJP is affiliated — for a hate group designation given “political sensitivities,” the case study found.
In a slide deck about political influence on content policy from December 2020, Facebook employees wrote that the company “routinely makes exceptions for powerful actors when enforcing content policy,” citing India as an example.
A key roadblock was Facebook’s top policy person and lobbyist in the region, Ankhi Das, who told employees it would hurt the company’s business prospects to take down posts such as one by a prominent BJP official that called for shooting Muslims. She also shared commentary on her personal page in which a former official described Muslims as a traditionally degenerate community.
After an August 2020 Wall Street Journal story spotlighted her interventions, Das resigned that October.
But the pro-government leanings extended beyond Das and reflected a long-standing culture within Facebook to treat India — and its powerful BJP government — with a light touch, according to current and former employees in India and the United States.
After Das’s departure in 2020, Meta appointed Shivnath Thukral, a former public-relations executive who had been head of public policy at Meta’s WhatsApp subsidiary since 2017, to oversee public policy for Meta in India on an interim basis. He assumed the position on a permanent basis in November 2022.
Thukral was closer to the BJP than Das: He had worked on Modi’s national campaign in 2014 and had collaborated with Hiren Joshi, a longtime Modi aide who is today the prime minister’s head of communications, on a pro-Modi website called Modi Bharosa, or “Modi is Trust,” recalled a former Modi staffer who worked with both men. The site churned out glowing articles about Modi’s economic record and accused his political rivals of fomenting riots or misgoverning the country.
Around the time of Das’s departure, the BJP’s head of social media, Amit Malviya, kept the pressure on Facebook by sharing, in interviews with news outlets and on Twitter, the employment and personal backgrounds of Facebook employees and calling out those who had previously worked for liberal politicians or causes.
Soon after, Facebook India’s head, Ajit Mohan, addressed the staff at an all-hands meeting. His message: He didn’t want Facebook employees to become the focus of external attention.
In response to inquiries for this story, Facebook said it has hired more staff, now reviews content in 20 Indian languages and has partners that can fact-check in 15 languages.
“We prohibit coordinated inauthentic behavior, hate speech and content that incites violence, and we enforce these policies globally,” Facebook spokesperson Margarita Franklin said in the company’s only direct comment.
“As a global company, we operate in an increasingly complex regulatory environment and are focused on keeping people safe when they use our services and ensuring the safety of our employees in a manner consistent with applicable laws and human rights principles.” Facebook declined to make any of the employees named in this article available for interviews.
Report buried
As the controversy over its handling of hate in India grew in 2019, Facebook hired the law firm Foley Hoag to study and write about its performance there in what is called a human rights impact assessment. Some rights groups worried that the firm would go easy on Facebook because one of its human rights lawyers at the time, Brittan Heller, was married to Gleicher, Facebook’s head of security policy.
But the firm interviewed outside experts and Facebook employees and found that dozens of pages that were calling Muslims rapists and terrorists and describing them as an enemy to be eliminated had not been removed, even after being reported.
Foley Hoag cited multiple underlying issues, including the lack of local experts in hate speech, the application of U.S. speech standards when Indian laws called for greater restriction of attacks on religion, and a legalistic approach that, for example, withheld action if a subject of threats was not explicitly targeted for their ethnicity or religion.
Foley Hoag found that the company allowed incendiary hate speech to spread in the lead-up to deadly riots in Delhi in 2020 and violence elsewhere, according to people briefed on its lengthy document. It recommended that the company publish the report, name a vice president for human rights and hire more people versed in Indian cultures.
Instead of releasing the findings, Facebook wrote a mostly positive four-page summary and buried it toward the end of an 83-page global human rights report in July 2022. That readout said the law firm “noted the potential for Meta’s platforms to be connected to salient human rights risks caused by third parties.” It said the actual report had made undisclosed recommendations, which the company was “studying.”
Foley Hoag partner Gare Smith said by email that the firm’s human rights impact assessment “was conducted in accordance with the highest ethical standards and pursuant to guidance provided by the U.N. Guiding Principles on Business and Human Rights. Inasmuch as it was conducted under privilege, we cannot comment on specific elements of the Assessment or on our client’s summary of it.”
Facebook said that it discloses more on its human rights performance than any other social media company and that it withheld the full report because of concerns about employee safety.
Facebook executives similarly downplayed problems reported by outside groups. The London Story, a Netherlands-based human rights group, reported hundreds of posts that it said violated the company’s rules. Facebook asked for more information, and then asked for it in a different format, then said it would work to improve things if the group stayed quiet. When nothing happened, the group succeeded in getting a meeting with the company’s Oversight Board, created to handle a small number of high-profile content disputes.
It took more than a year to remove a 2019 video with 32 million views, according to the London Story’s executive director, Ritumbra Manuvie.
In the video, Yati Narsinghanand, a right-wing cleric, says in Hindi to a crowd: “I want to eliminate Muslims and Islam from the face of earth.” Facebook took it down just before the London Story released a report on the issue in 2022.
Versions were then posted again. One remained visible as of Monday, but on Tuesday, after Facebook was asked for comment, it was no longer available.
Mounting fears
When Facebook’s investigators brought their Kashmir findings to the India office, they expected a chilly response. The India team frequently argued that Facebook policies didn’t apply to a particular case. Sometimes, it argued that they didn’t apply to sovereign governments.
But this time, their rejection was strident.
“They said they could be arrested and charged with treason,” said a person involved in the dispute.
Facebook’s India team, including policy chief Thukral and communications head Bipasha Chakrabarti, was especially nervous after police raids on Twitter, two people recalled. In 2021, the Indian government was feuding with Twitter over its refusal to take down tweets from protesting farmers. Officials dispatched police to the home of Twitter’s India head and anti-terrorism units to two Twitter offices. Some officials publicly threatened Twitter executives with jail time.
Two former Facebook executives said they had believed that their colleagues’ fears were genuine, though no legal action was ever taken against them.
“I’m not angry at Facebook,” one said. “I’m angry at the Indian government for putting the people who worked on this in a position where they couldn’t address the harms that they found.”
Blocked by their own colleagues, Facebook’s U.S. threat team passed the Chinar Corps information to their counterparts at Twitter. Facebook employees said they had been hoping that Twitter would follow the leads and root out the parallel operation on that platform. The team’s members also hoped that Twitter would do the first takedown, giving Facebook political cover so it wouldn’t have to face government retribution alone and its internal dispute could be resolved.
Twitter, which had been more forceful in pushing back against the Indian government, took no action. It told Facebook staff members that it was having technical issues.
In truth, the San Francisco company was changing direction.
The Indian police raids and public comments from government officials criticizing the company had scared off firms that Twitter had planned to use for promotion, former Twitter employees said. “We saw a very obvious slowdown in user growth,” one former policy leader said. “The government is very influential there.”
The former executive added: “We had just promised [Wall] Street 3x user growth, and the only way that was going to be possible was with India.”
Another former policy staffer said Twitter’s bigger problem was physical threats to employees, while former safety chief Yoel Roth wrote in the New York Times this month that Twitter’s lawyers had warned that workers in India might be charged with sedition, which carries a death penalty.
In any case, Twitter was tired of leading the way with takedowns, and it changed how it treated the government overall. The company did not respond to a request for comment.
Fishman, the former senior Facebook executive, said the U.S. tech companies will not respond more forcefully to Indian government pressure unless they receive help from the U.S. State Department, where onetime cybersecurity executive Nate Fick has been named the first cyber ambassador and has built out a team focused on internet freedom and security issues.
“If we want free speech, [if] we want free elections, while these companies are not the most popular institutions in the world, we need U.S. policy to have their backs at times,” Fishman said. Fick did not respond to requests for comment.
But while Indian activist groups and international democracy monitors have warned about the erosion of democratic norms under the Modi government, the Biden administration has largely refrained from publicly criticizing a country seen as a crucial strategic counterweight to China in the Indo-Pacific.
After meetings with Modi in Washington and New Delhi this year, Biden offered no criticism. Uzra Zeya, U.S. undersecretary of state for civilian security, democracy and human rights, visited India in July. She did not publicly comment about India’s human rights or its democracy after meeting Foreign Secretary Vinay Kwatra but said in a Twitter post: “Grateful for the vital #USIndia partnership & shared efforts to advance a free & open Indo-Pacific, regional stability, and civilian security.”
A senior State Department official, speaking on the condition of anonymity because of the sensitivity of the issue, said that despite the lack of public comment, American diplomats are engaged with India on censorship and propaganda.
“These are precisely the kinds of issues that we raise on a bilateral basis at both the working and senior levels of government,” he said. “The U.S. is committed to ensuring that tech is a force for empowerment, innovation and well-being, and working to ensure that the world’s largest democracy is aligned with us on this vision is a top policy priority.”
Continued silence
As Facebook’s India team delayed acting on the Chinar inauthentic network, the propaganda investigators in Washington and California worked on less controversial subjects.
“You have only so much time in the day, and if you know you are going to run into political challenges, you might spend your time investigating in Azerbaijan or somewhere else that won’t be an issue. Call it a chilling effect. That dynamic is real,” said Fishman, the former senior Facebook executive.
The impasse continued until the U.S. team demanded action from Nick Clegg, then Meta’s powerful vice president of global affairs, who had been put in charge of India public policy. Clegg was later named president of global affairs.
Finally, after discussions with Facebook’s top lawyers, Clegg ruled in favor of the threat team, employees said.
But the India executives had a request: They asked that Facebook at least break with past practice and not disclose the takedown.
Since coming under fire for failing to spot Russian propagandists using its platform during the 2016 U.S. presidential campaign, Facebook has routinely announced significant removals of disinformation. It often describes what the campaign was trying to do and how it did it, and there is frequently direct attribution to a national government or enough detail for readers to guess.
The idea is to increase transparency that could help disinformation hunters and deter its spreaders from trying again. Smaller takedowns are described more briefly in quarterly summaries.
This time, the India side argued that it would be unwise to embarrass the Indian military and that doing so would increase the likelihood of legal action.
Clegg and Facebook chief legal officer Jennifer Newstead agreed, staffers said. At their direction, Facebook changed its policy to state that it would disclose takedowns unless doing so would endanger employees.
Following standard practice, Facebook removed the fake accounts, and the official Chinar Corps pages they had been working with on Facebook and Instagram, on Jan. 28, 2022. (After the Indian army publicly complained about the takedown of the official pages, they were reinstated.)
That March, Twitter followed Facebook and quietly removed the Chinar Corps’s parallel network on its platform and shared it with researchers. In private meetings with Facebook and Twitter executives, the army defended its fake accounts and said they were necessary to combat Pakistani disinformation.
Facebook didn’t disclose the takedown, and Twitter hasn’t issued what had been twice-yearly summaries of its enforcement actions since one for the period that ended in December 2021.
A month later, Facebook issued a quarterly “adversarial threat report” that listed takedowns of inauthentic networks targeting users in Iran, Azerbaijan, Ukraine, Brazil, Costa Rica, El Salvador and the Philippines.
It said nothing about India.
Shih reported from New Delhi. Jeremy B. Merrill in Atlanta and Karishma Mehrotra in New Delhi contributed to this report.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Copy editing by Feroze Dhanoa and Martha Murdock. Story editing by Mark Seibel. Project editing by Jay Wang.
By Gerry Shih and Pranshu Verma
HUSSAINPUR, India — The Hyundai hatchback barreled down the country road past darkened fields. A white SUV followed in hot pursuit, shattering the pre-dawn quiet with its screaming siren.
The three young Muslim men in the first car were desperately trying to outrun one of the most notorious Hindu vigilantes in north India when they lost control, veered into a vegetable truck and came to a screeching halt. Now, they were in the clutches of Monu Manesar.
The three men were immediately pulled out of their wrecked vehicle by Manesar’s gun-toting gang, then interrogated and beaten, according to surveillance footage and witness accounts. But the events of that fateful morning were recorded and then flaunted by another, unusual source: Manesar’s own Facebook page.
The violence on display was carried out in the name of protecting cows.
Since 2020, the self-styled “cow protection” squad led by Manesar had repeatedly live-streamed its late-night missions to intercept drivers suspected of transporting and slaughtering cows — a job often done by Muslims in India. Manesar would film himself exchanging gunfire with moving cattle trucks and ramming them with his SUV. He chased cow transporters on foot and beat them on camera. In return, his fans on YouTube and Facebook left comments full of heart emojis, praising him for doing the work of God.
For a century, vigilantes in north India have worked discreetly in a legal gray zone to protect cows, an animal worshiped by Hindus. But these enforcers have become more extreme and flamboyant in the past decade, thanks to American social media companies that reward them with online followings, and officials from Prime Minister Narendra Modi’s Bharatiya Janata Party (BJP), who offer them political protection and champion their militant brand of Hindu nationalism.
The emerging phenomenon of cow vigilante streamers exemplifies how the BJP and allied right-wing groups have used U.S. social media platforms — including YouTube, a Google subsidiary, and Facebook and Instagram, owned by Meta — to polarize India, rally their political base and assert Hindu dominance, sometimes brutally, in one of the world’s most digitally connected countries. This effort is part of a broader campaign by Hindu nationalists aligned with Modi to use technology to advance their ideology and consolidate their control.
Despite repeated warnings from Indian activists, Silicon Valley companies gave Manesar a platform to broadcast violence — and propelled his rise to fame.
Last October, Manesar received a “Silver Creator” award from YouTube for reaching 100,000 subscribers and posed with his plaque next to a cow. A cycle of soaring viewership and increasing violence followed.
In January and February, according to complaints filed with police and the courts, Manesar and his followers were involved in several shootings and killings.
In April, Instagram granted Manesar’s account a “verified” badge reserved for public figures and celebrities.
In July, Manesar was widely accused of inciting a sectarian riot that left six dead outside New Delhi, the nation’s capital, after he taunted Muslims in a WhatsApp video.
In a call with The Washington Post, Manesar said several weeks ago that he was “staying underground” and avoiding the media. He declined to comment on the allegations against him. Speaking with Indian media earlier this year, he denied any criminal wrongdoing in connection with the series of violent incidents.
A YouTube spokesman said the platform terminated Manesar’s channel four months ago following a review of his videos. Meta said that in general the company removes from its platforms accounts that repeatedly violate a ban on violent content.
Earlier this year, The Post began tracking Manesar’s social media and downloaded 25 gigabytes of his videos before YouTube closed the account amid a probe of his network by police in Rajasthan state. A review of these videos and other posts published by Manesar’s supporters, along with interviews with his associates and their victims and an examination of hundreds of pages of police documents and court filings, tells the story of a gang leader who terrorized minority Muslim communities in two Indian states.
One of Manesar’s most chilling videos was published on Jan. 28. Shortly before 5 a.m., his Facebook page went live with a video showing the three Muslim men — Nafis, Shokeen and Waris, all known by single names — being led away from their wrecked Hyundai. In the 21-minute stream, Manesar asks the men, their faces bloodied, for their names and hometowns. The three are pressed to the ground while Manesar and his gang stand over them like trophy hunters, clutching rifles and smiling for photos.
Around sunrise, Waris’s older brother Imran received an anonymous call demanding a payment of 100,000 rupees ($1,200) to set Waris free, Imran recalled.
He said no and hung up. Unlike younger Muslims in the region who feared Manesar, Imran, 32, never used much social media. He never followed Manesar’s videos boasting of shootings and beatings.
He never anticipated that Waris would be dead by noon.
Rise of the vigilante streamer
Since ancient times, Hindus have revered the cow as the embodiment of a multitude of gods, the Mother whose milk sustains life and Earth itself. Today in north India, most states strictly prohibit cattle slaughter, and cracking down on the black market in cows — through whatever means necessary — is a rallying cry for Hindu nationalist organizations and their political wing, the BJP.
In the last decade, the ascent of the BJP coincided with the arrival of U.S. social media services, setting the stage for vigilante streamers. The Post reviewed more than 140 accounts of cow protectors on Facebook, who often uploaded bucolic videos of injured or abandoned cows being nurtured and fed. But roughly 30 percent of the accounts resembled a hardcore, extrajudicial version of “Cops,” replete with posts of car chases, arrests and beatings.
Raqib Hameed Naik, the Washington-based founder of HindutvaWatch, which monitors far-right Indian social media, said violent cow vigilante videos began to surface in 2018 but skyrocketed during the pandemic, when online video consumption boomed. “We also observed that the more violent the content, the more reach and engagement it would get,” Naik said. “For the most part, platforms like Facebook, Twitter, Instagram and YouTube have provided them an unrestricted space.”
The YouTube cache reviewed by The Post contained 10 violent videos that Manesar posted between 2020 and 2022. His social media reach, however, was much wider because he maintained several accounts on different social media platforms and his associates also disseminated videos in which he featured.
YouTube spokesman Jack Malon said that the company suspended Manesar’s ability to make money off ads on his channel in February after Indian police made serious allegations against him, and that the channel was terminated in late May after repeated violations of the company’s harassment policy. Asked why YouTube did not act sooner, Malon said it uses a combination of software and human review to identify problematic videos, but “our systems sometimes don’t detect potential violations.” If they had, he said, Manesar “would have been ineligible to receive a Creator Award.”
Meta spokeswoman Erin McPike said, “We have clear rules prohibiting particularly violent or graphic material on our platform. We removed content that broke those rules and disabled accounts for repeated violations.” Several Facebook and Instagram accounts associated with Manesar were taken down by the company this year. McPike said Manesar’s verified Instagram account was “restored in error and has since been disabled.” X, formerly known as Twitter, declined to comment, saying it was too busy.
Human rights activists say they sounded warnings about Manesar long before the companies took action.
Thenmozhi Soundararajan, executive director of the civil rights group Equality Labs, said she warned YouTube and Meta “as early as 2021 and 2022” through internal reporting mechanisms that Manesar’s accounts were hateful and posed a risk to society. She said the companies told her they would look into the accounts, but no action was taken. Representatives from YouTube and Meta also told her they worried that removing hateful influencers would physically endanger the firms’ employees in India, she said. In response, Malon said, the “notion that we’d allow violative content to remain on YouTube due to employee concerns is false.”
Ritumbra Manuvie, director of the London Story, a Hague-based group that investigates online propaganda that fuels hate crimes, said she has flagged hundreds of hateful Indian influencers to Meta using its internal reporting mechanism, often with no success. In April 2022, Manuvie’s group reported Manesar’s account to Meta but received no response, she said. The group reported another account it said was associated with him this June again with no result.
Climbing the influence ladder
Among cow vigilante influencers, no star shone brighter than Manesar, a 30-year-old from Haryana state who uploaded YouTube videos with catchy titles like “Watch Live Raid!” and “Clash with Cow Smugglers!” Sporting a bowl cut and a collection of assault rifles, Manesar’s on-camera persona was both boyish and hardened. He would dance and force his captives to eat cow dung. He would beat a cattle driver kneeling on the ground, zoom in on the boy’s swollen face — and plug his Instagram handle in a cartoonish font. At his peak, Manesar boasted more than 210,000 YouTube subscribers and 83,000 Facebook followers.
Akash Banerjee, a former media executive who now hosts Deshbakht, one of the biggest YouTube channels in India, estimated that Manesar could make hundreds of dollars a month, depending on his videos’ view count.
But in a rural society where the ability to garner support and mobilize the masses meant political power and prestige, making money wasn’t the point, Banerjee said. “He’s actually trying to climb up the political ladder, the influence ladder, and he’s using social media as a tool,” he said.
Sitting in a dirt parking lot illuminated by the moon, a vigilante named Sonu Bhiwadi recalled the night in 2014 when a chubby new kid from a poor but deeply religious Hindu family came along on his first car chase, excitedly yelling into a walkie-talkie. Manesar had already created his YouTube account a year earlier. “He was always into social media,” said Bhiwadi, a brawny 27-year-old with a thick beard and a wooden cow-shaped pendant dangling from his neck. “But you couldn’t imagine him being the star he is today.”
Soon, Manesar and Bhiwadi became a team. They set out to make a name for themselves by targeting Mewat, a nearby stretch of impoverished, majority-Muslim villages straddling Haryana and Rajasthan states. The state line was invisible but crucial: Cow vigilantes had to move cautiously in Rajasthan, where the opposition Congress party controlled the police. But the BJP won control of Haryana in 2014, and the state police afforded vigilantes free rein, even working alongside them.
In the early days, Bhiwadi recalled, their gang lacked cars, guns and recognition. They chased cattle trucks on motorcycles, with barely any money for gas. Muslim drivers were often armed and fought back. In a region where hundreds of vigilantes competed for clout, Manesar and Bhiwadi could stand out only by becoming more extreme.
Bhiwadi dragged on a cigarette, then pulled out a photo of Manesar recovering from a bullet to the chest in 2020. Bhiwadi himself was arrested for attempted murder last year but released from jail after a few months, with some serious charges dropped. The case won him attention and demonstrated his political clout, Bhiwadi said. “Right now,” he said proudly, “we’re the main men.”
Crucially, the gang rose because Manesar pioneered something new: videos that put viewers inside the action. The videos showed how “Monu puts his life on the line every time he leaves home,” said Vijay Tauru, another Haryana cow protector. “All kinds of people wanted to associate with Monu.”
An arm of the state
Over the years, Manesar’s social media feeds often showed Haryana police officers asking him to pose for photos. In 2021, Haryana formed a civilian cow-protection task force, and Manesar posted Instagram photos of himself in a khaki uniform issued by Haryana police.
Manesar uploaded a selfie with Amit Shah, who is India’s home minister overseeing domestic security and a Modi confidant seen as a driving force in executing the BJP’s Hindu-first agenda. Manesar also posted a YouTube video of BJP Minister of Information Anurag Thakur placing a hand on Manesar’s shoulder and giving a fiery speech exhorting right-wing activists to use social media. (Raj Kumar, a spokesman for Shah’s Home Ministry, did not respond to a request for comment about the Manesar selfie. Kanchan Gupta, senior advisor in the Ministry of Information and Broadcasting, said Thakur, who heads the ministry, encounters many people in public life and rejects violence of any kind.)
All of that made Manesar seem not just a freelancer but an arm of the BJP-led state.
On the dusty plains outside New Delhi, the Monu Manesar effect could already be seen among a new generation of vigilantes. Two hours south of Bhiwadi, Savinay Gaud, a 25-year-old with bulging biceps, said he diligently studies YouTube audience-growth strategies. Gaud’s younger brother Harshit practices video-editing.
A couple of nights a week, the Gauds’ crew goes out to ambush trucks. When they see one coming on the highway, they toss out a “kaanta” — a 50-pound metal frame with rusty six-inch spikes — to deflate its tires. Then they accost the drivers and seize the cows. Beatings are meted out if the smugglers are repeat offenders, Gaud said.
Gaud said he was considering escalating to torture and killings. He mulled the question of how best to publicize it. “We’ll upload a video of us stopping a truck,” he said, “and then let reporters find out later that the men were killed.”
A fatal encounter
Nothing seemed out of the ordinary when Waris left home at 7 p.m., telling his family he had a job to do.
The rail-thin, painfully shy 22-year-old mechanic often went out at odd hours, his brother Imran said. When Waris wasn’t working at a Hyundai showroom, he would get calls from car owners to fix vehicles all over Mewat. Whatever money he made, he used it to support his wife, Taslima, and 1-month-old daughter, Ridha.
But when Imran rose for morning prayers on Jan. 28, Waris wasn’t back. As the sun rose over fields of pearl millet, word filtered through social media: Waris had been nabbed by Manesar on National Highway 919.
Closed-circuit TV footage that was recorded at a nearby auto mechanic shop and reviewed by The Post shows Waris’s hatchback racing down the road at 4:56 a.m. when it loses control and smashes into a vegetable truck traveling the other direction. Vigilantes rush out of a Mahindra SUV and immediately start punching the men who stumble out of the crashed vehicle.
Then, one of Manesar’s associates takes out a phone and begins to film.
That video, streamed to Manesar’s more than 83,000 Facebook followers, shows glimpses of what happened next: The vigilantes drag their captives into the back seat of their SUV, and Manesar begins to interrogate them. Waris, meek but still alert, answers as Shokeen and Nafis try to hide their bloody faces. The camera pans to show vigilantes pulling a small cow out of the hatchback. They celebrate with chants of “Hail Mother Cow!” and “Hail Lord Ram!”
Over the next hour, according to the CCTV footage, more than a dozen vigilantes take turns entering the SUV and disappearing inside.
In a court petition that Imran filed, Nafis and Shokeen allege that Manesar’s men took turns beating them inside the SUV and used a rifle butt to pummel Waris, who sat in the middle seat. Witnesses interviewed by The Post described a similar scene. Abdul Hamid, a day laborer who lives next to the crash site, recalled seeing Waris keeled over vomiting and hearing vigilantes say that Waris was pleading for water.
The official account unravels
About 90 minutes after the crash, Haryana police arrived at the scene but did not interfere, CCTV footage shows.
About 7:30 a.m., police drove the three captured men to a local clinic, where records show Waris complained of severe abdominal pain but was turned away and referred to a surgeon. Police then drove the three to a nearby college hospital. By the time they arrived at 10:30 a.m., Waris was dead. An autopsy determined that he died from severe internal bleeding due to a ruptured liver. His face was cut and he had eight large bruises around his knee.
Haryana police and vigilantes would tell a different story. They alleged that the three Muslims were smuggling a cow when they crashed into a vegetable seller, who filed a reckless-driving complaint against them. Manesar’s vigilantes tried to save the men, Haryana police said, but Waris died of injuries sustained in the collision.
But the official account soon began to fray. The vegetable seller said in a subsequent court affidavit that police had coerced him to file a fake report. Doctors told Imran that Waris didn’t suffer the head and upper-chest injuries usually seen in car crash victims. And Imran recorded a video of Nafis at the hospital with his head bandaged, recounting how Manesar’s men had beaten them.
Bhiwadi, who was present and could be seen clutching a rifle in Manesar’s video, said Waris died because the car’s steering wheel struck his abdomen during the collision. No vigilantes “laid a finger” on the cow smugglers, Bhiwadi said.
A few hours after Waris was pronounced dead, Manesar removed his video from Facebook. By then, a screenshot showed, it had garnered 164 likes.
Reign of fear
On Feb. 6, nine days after Waris’s death, a fresh Facebook video of Manesar firing a rifle in what looked like a gang war started circulating online. Manesar had led his men in a clash against local Muslims in a dispute over an interfaith marriage, and the gunfight wounded a Muslim bystander, local residents alleged in a police complaint.
A week after that, two Muslims named Junaid and Nasir were allegedly kidnapped, then beaten and burned to death. This time, the kidnapping took place a few miles inside Rajasthan state lines, and a young police officer named Ram Naresh Meena decided to investigate. Meena arrested and charged three men within days, but he said he found they were part of a much larger, interstate network of cow vigilantes who may have been accomplices in the double killing. In a 4,000-page indictment, Meena listed 27 additional suspects. Most-wanted: Monu Manesar.
But Meena’s attempts to arrest Manesar sputtered. Police in BJP-controlled Haryana blocked his efforts, he said, and Hindu nationalist groups held huge street protests demanding that Rajasthan authorities back off.
A few miles away from Meena’s modest police station, the neighbors of Junaid and Nasir saw their hopes for justice dwindle. In a Muslim-dominated village where almost every man worked as a truck driver, villagers said their livelihoods were also at risk. Rather than face punishment, vigilantes were taunting Muslims on social media daily and stopping their trucks at will.
A few jobless drivers recently gathered one morning in front of the corner store, too fearful to ply the highways. Junaid’s brother Hamid spoke up, saying he couldn’t bear the constant stream of vigilante videos. “Every time they put out a video threatening us, it makes it fresh, like it happened yesterday,” Hamid said, referring to Junaid’s killing. “The reason they make videos is to put fear in our hearts.”
His uncle Ismail, an older man with a wispy white beard, shook his head.
“No,” Ismail told the younger men. “Within this regime, people who do criminal activity are rewarded. If his popularity continues to grow. I think he could contest for elections.”
Sparking a riot
Manesar continued to post.
In July, he teased on social media that he and his team would attend a yearly parade organized by Hindu nationalists through Muslim-dominated Mewat. The post set off a firestorm. Muslim YouTubers responded by vowing they would teach Manesar a “lesson” if he showed up.
In the end, he didn’t show — but his job was done. As the parade wound through Haryana on July 31, Muslim gangs showered stones on Hindu gangs armed with swords, sparking an all-out riot. Homes, shops and cars were torched. A mosque was burned to the ground, its young imam stabbed 13 times. Facing national outrage, the BJP chief minister of Haryana said the state would not obstruct Rajasthan police if they wanted to detain Manesar.
But the vigilante was defiant. In a local TV interview, he seemed preoccupied with social media as he lashed out at Muslim YouTubers who accused him of inciting the turmoil. “I’m tired of these small YouTubers who cannot understand anything,” he said dismissively. “They don’t even get 10 likes but think of themselves as big YouTubers making all kinds of videos about me.”
On Sept. 12, Manesar was finally detained by Haryana authorities for spreading “inflammatory posts” before the riot erupted, and handed over to Rajasthan police.
Today, Imran is still petitioning the Haryana high court to launch an independent inquiry into the death of his brother, Waris. Court records show that Haryana officials are indeed pursuing a criminal case arising from the fateful morning of Jan. 28. They have charged two men, Nafis and Shokeen, with animal cruelty and recklessly driving a Hyundai hatchback into a vegetable truck. Waris, though dead, was initially named as the third suspect.
Manesar’s reach still extends far across social media. The Post counted 40 fan pages on Instagram that continue to disseminate his videos. And in the weeks leading up to his arrest, he began to increasingly post on X, formerly known as Twitter.
Just last month, he secured a “verified” blue check mark for his X account.
Anant Gupta in New Delhi contributed to this article.
CLARIFICATION
This article has been updated to include a statement provided after publication by a YouTube spokesman, who challenged an assertion by an activist quoted in the story. The YouTube statement said it was not true that the social media company would allow content that violated its standards to remain on the platform in deference to employee concerns.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Copy editing by Brian French and Martha Murdock. Story editing by Alan Sipress. Project editing by Jay Wang.
By Anant Gupta and Gerry Shih
CHURACHANDPUR, India — During times of civil unrest and political turmoil, authorities around the world frequently cut access to the internet to control their populations and throttle the flow of information. The militaries in Sudan and Myanmar pulled the plug when they carried out armed coups in 2021. Iran flipped the switch when protesters flooded the streets following the death a year ago of a young woman, Mahsa Amini, in police custody.
But the country that most frequently deploys the tactic is not an authoritarian state such as Russia or China, digital rights groups say.
It is India.
Between 2016 and this May, India accounted for more than half of all the shutdowns recorded worldwide by an international coalition of more than 300 digital rights groups led by Access Now, a nonprofit. On more than 680 occasions during that period, state and local officials in India issued legal orders requiring the country’s handful of telecommunication companies to suspend mobile data transmission from cell towers and freeze wired broadband connections.
Indian officials argue that the measure is necessary to prevent the spread of online rumors and contain unrest. But by enforcing a digital blackout, critics say, the government can stifle dissent, cover up abuses and stymie independent reporting that challenges official accounts during times of conflict. The tactic can also exact a drastic, far-reaching economic toll, disrupting commerce, work and education.
In a report last year about the global use of blackouts, the U.N. High Commissioner for Human Rights warned that the practice infringes on basic rights of expression and may do more harm than good during times of upheaval. “The inability to access tools to document and rapidly report abuses seems to contribute to further violence, including atrocities,” the U.N. agency said. “Some shutdowns may even be implemented with the deliberate intent of covering up human rights violations.”
Since May, when ethnic bloodshed erupted in Manipur state, in northeast India, the state government controlled by Prime Minister Narendra Modi’s Bharatiya Janata Party (BJP) has enforced a draconian internet ban affecting the state’s 3 million people — one of the longest recorded shutdowns in the world — as violence between two ethnic groups spread from village to village, leaving more than 200 dead.
In three visits to the remote, lushly forested state bordering Myanmar, Washington Post journalists saw how severing the internet — considered a modern necessity, almost a basic right by many — upended daily lives and livelihoods practically overnight. Countless workers found themselves out on the street, and hospitals, with online payment systems suspended, struggled to keep operating.
Moreover, the internet shutdown shaped the Manipur conflict in profound ways. It allowed the BJP state government — and the state’s ethnic Meitei majority who control it — to dominate the public narrative about the turmoil. It impeded efforts by dissenters among the Kuki ethnic minority to spread their message and disseminate photo and video evidence of human rights abuses. And it effectively kept the roiling conflict, a stark challenge to the BJP’s leadership, behind a veil of invisibility.
While local governments ruled by opposition parties in India also frequently block the internet, the Manipur example highlights a wider pattern in an India governed over the past decade by Modi’s BJP. To maintain their grip on political power and advance their Hindu nationalist agenda, Modi and his ideological allies have often used their control of technology and social media to stifle dissent, promote divisive propaganda — or, in the case of Manipur, pull the digital plug altogether.
After a viral video emerged online in July of Kuki women being groped and paraded naked in a Meitei village, drawing international attention and concern about sexual violence in the Manipur conflict, several BJP leaders, including the state’s chief minister, N. Biren Singh, voiced frustration that the video had surfaced and alleged in media interviews that it had been intentionally “leaked” from Manipur to hurt them politically. The chief minister’s office and spokespeople for the Manipur state government declined multiple interview requests for this article.
To pierce the information veil, Kuki activists this year mounted a digital resistance.
Some secretly connected internet cables from an adjacent state to a college campus, where they huddled to spread word of their people’s plight. Others pursued old-school, shoe-leather journalism, forming teams to visit refugee camps and document allegations of war crimes, and collected evidence by transferring videos via Bluetooth or USB drives. Still others drove hours to the border, where they tapped into the faint cellphone signal to download independent commentary about the conflict.
On a Sunday morning in early July, one of these activists stood in a crowd and she listened intently to dozens of exhausted Kuki villagers recounting a terrifying tale.
Before sunrise that day, the displaced Kukis said, an armed mob of Meiteis had appeared, setting fire to their homes in the nearby foothills. Then the villagers made a stunning allegation: A 30-year-old Kuki named David Thiek was decapitated, his limbs sawed off and his head placed on a bamboo spike.
The activist — a former call center manager with a bubbly laugh and quiet intensity named Jhmar — belonged to the Indigenous Tribal Leaders’ Forum (ITLF), a pro-Kuki organization, as a volunteer in its “media cell.” Her job, she said, was to find and confirm reports about atrocities, then spread the word to the outside world, a challenge given the internet ban. But here, a nugget of firsthand information had found its way to her. (Jhmar recounted the episode on the condition that she be identified only by her tribal name, fearing government retribution.)
She immediately hopped on a motorbike and rode off into the hills.
A world leader in blackouts
Since 2020, India has been the leader in ordering internet shutdowns, far outpacing Iran and Myanmar, in second and third spots, respectively, according to Access Now. Indian government officials can issue blocking orders that cover relatively small districts or encompass vast states with millions of people. The blackouts tend to last for a few days, though they’re often renewed, and some stretch on for months.
Two months ago, a shutdown was imposed in Haryana state, ostensibly to control riots, and a blackout in March, affecting 27 million people, was enforced in Punjab state during efforts to catch fugitives. In February, the internet was blocked in 11 cities in Rajasthan state to prevent cheating during exams.
The longest recorded instance came in August 2019, when the Modi government revoked the semiautonomous status of the northern Jammu and Kashmir region and brought this restive Muslim-majority area directly under New Delhi’s control, sparking protests and an Indian army crackdown that included waves of detentions. The government cut phone lines and shut down high-speed internet for 18 months to curb what officials called the spread of disinformation from Pakistan.
But with the flow of information severed and journalists unable to work, it took weeks for allegations to surface that the Indian army had tortured detainees, among them minors, said Anuradha Bhasin, the executive editor of the Kashmir Times who is now a fellow at Stanford University.
“Seven million people in Kashmir and Muslim-majority areas of Jammu were completely pushed behind an iron curtain,” said Bhasin. “Shutting down critical reporting was one of the intended consequences.”
After Bhasin challenged the internet shutdown in court, the Indian Supreme Court ruled in 2020 that the tactic should be used only for a limited time and only if absolutely essential, adding that the justification must be publicized. But authorities often ignore the court’s recommendations, say Indian civil rights lawyers.
The clampdown begins
The unrest in Manipur began on April 27. Kuki activists called for a general strike against the land policies of the state’s chief minister that day, and the demonstration turned violent.
Tensions had been brewing for months between the Kukis, a Christian hill tribe, and Meiteis, the politically and economically dominant valley dwellers who mostly practice Hinduism. Kukis have long accused Meiteis of coveting land in the hills reserved under the Indian constitution for tribal peoples, and those fears sharpened this spring when the state’s top court backed a Meitei demand that it also be granted official tribal status.
At first, the state government ordered an internet blackout around Churachandpur, a city that forms the heart of Manipur’s Kuki population. But mayhem erupted anyway. On May 3, mob violence spread statewide, leading to two days of killing, rape and arson. While both sides were targeted, most victims were Kuki, according to the U.N. human rights office. Roaming death squads killed anyone they could find of the other ethnicity. Up to 60,000 people were displaced.
The state ordered telecom providers to kill the internet, and a digital darkness fell over Manipur. The resistance began.
Getting the word out
For Ginza Vualzong, a gregarious leader in the pro-Kuki ITLF who heads its “media cell,” the first task was tracking down a local technician who quietly dealt in special phone lines — an internet bootlegger. After weeks of negotiations, an eye-watering payment exceeding $1,000 and a flick of a router switch one day in late May, Vualzong turned the media cell office in Churachandpur into an oasis of WiFi, with slow, finicky, but unfettered internet piped in from a neighboring state.
To counter stories in newspapers and carried by television stations under the BJP government’s sway, one volunteer assembled a news bulletin every day and distributed hard copies to curious readers who queued up for them. Another team visited hospitals and camps for displaced people to document war crime allegations and uploaded oral histories to YouTube.
“What we’re fighting is a narrative war,” said Vualzong, who described most of his day-to-day work as “firefighting” against government propaganda.
As the conflict raged, the Indian government prohibited foreign journalists from visiting Manipur. In the Indian media, it was mostly English-language newspapers with relatively few readers and small, online-only news outlets that closely covered both sides of the conflict.
But with its secret internet line, the media cell managed to score small victories. In July, Jhmar and her team facilitated an interview involving a Kuki woman, who was beaten nearly to death by a mob, and a writer for the popular Instagram page Humans of Bombay — an Indian account inspired by Humans of New York with 3 million followers.
The post got 21,000 likes. It was nothing like making the front page of a national newspaper. But their people were starved of any outside attention, Jhmar said: “Every channel, be it small or big, is important for us right now.”
Return to a dark age
As the media cell huddled daily near its office hotspot, life outside changed dramatically for millions of people plunged into an earlier technological era.
At the Raj Medicity in Imphal, Manipur’s capital, hospital director Vijayraj Haobijam, 29, ticked off his mounting difficulties. Without internet access, he couldn’t receive timely reimbursements from the national health insurance program or digital payments from patients. His employees were working on half-salary.
“Even the covid lockdowns were not so difficult because that was not a war,” he said. “We had internet.”
On the boulevards of Imphal, the stately former seat of the Meitei monarchy, long lines snaked out from ATMs, because the demand for cash skyrocketed after India’s digital payments system suddenly became unavailable. The back streets were devoid of the food and package delivery boys ubiquitous even in small Indian towns, because the e-commerce companies paused local services. The offices that provide the white-collar jobs so many Indians aspire to were shuttered overnight.
Grunting and sweating outside a water packaging plant in Churachandpur, Janet Lalthiengzo, 27, wrapped a dozen bottles and heaved the package onto a truck — a job she never imagined she’d be doing after graduating from college and working for a company doing search engine optimization. But with the internet severed, Lalthiengzo found herself packing water bottles for $3 a day, a third of what she once made.
“Even if I get paid less, I have to work,” said Lalthiengzo.
On a recent evening, three Kukis gathered on a grassy hilltop bathed in moonlight. Locals knew it was possible to pick up a faint cellphone signal, but no one knew if it came from the neighboring state of Mizoram or Myanmar.
Siamkhanlal, 51, yelped with delight as 46 messages came flooding into his WhatsApp at once. He needed to download pay slips for his church group. People came to the hill for all kinds of reasons, he explained: to do homework, make payments or download the latest information about the fighting.
Another villager, O.K. Luna, wasn’t so lucky. He wanted a glimpse of his daughter Margaret, who had flown that morning to Italy to resume her job on a cruise liner. He clutched a phone in each hand, cajoling them to connect. He gave up after more than 90 minutes.
The veil briefly lifts
On May 4 — the second and, by most accounts, worst day of fighting — came a defining moment of the Manipur conflict.
A 26-second video showing dozens of Meitei men that day molesting two naked Kuki women, grabbing their genitals as they were paraded down a narrow concrete road and into dry paddy fields. There, relatives of the Kuki women alleged, they were raped off-camera.
For two and a half months, the video never surfaced. No arrests were made, no headlines created. But finally, the video made its way to social media. Instantly, it had an impact.
A body of U.N. human rights experts expressed alarm about what was happening on the ground. Modi, who had stayed away from Manipur and remained quiet about the conflict since it erupted, broke his silence after 78 days, telling the Indian people that “what has happened to these daughters of Manipur can never be forgiven.” The wheels of justice finally began to churn. Seven men were detained within days and handed to the federal investigative agency.
In a country where national politics is often driven by spectacle and social media outrage, capturing and sharing visuals is “the only time you are getting a response from those in power,” said Sevanti Ninan, a longtime media critic. “Manipur has long been invisible partly because of the mainland attitude to that state. The internet shutdown makes it further invisible.”
Hoaxes and rumors
But on the Meitei side, the emergence of the video fueled bewilderment and frustration.
Along the rain-soaked rice paddies of Pechi village, near where the video was shot, Meiteis wondered why they were denied internet when they too were regularly assaulted.
Two fuming Meitei women, who spoke on the condition of anonymity to address an incident that they said unfairly tarnished their village name, stopped sowing rice to vent. The attack on the Kuki women, they said, was in revenge for a rumored attack on Meitei girls.
Yet “the narrative is one-sided against us,” said one of the women. “Without internet, we cannot get photos and videos of what happened to our people.”
Khuraijam Athouba, the spokesperson of the Coordinating Committee on Manipur Integrity, the top civilian group representing Meitei interests in the conflict, said the internet shutdown was making the conflict worse by fueling hoaxes and rumors. Even Meiteis detested it, he said.
“People make more assumptions,” Athouba said, “because they are not getting the right information, at the right time.”
Compiling the evidence
As soon as she heard news of David Thiek’s July 2 death, Jhmar rushed on a motorbike to Saikot village, where Thiek’s family were seeking refuge after fleeing their home in Langza, 20 miles away.
Details were still trickling in about the pre-dawn attack on Langza. As waves of refugees arrived throughout the day, they brought more photos and videos that created, piece by piece, a fuller, terrifying account of destruction and savagery.
Videos showed Kuki volunteers rummaging through rubble, searching for Thiek’s remains. They gathered his charred bones and placed them on a traditional stole spread on the ground. One photo showed the blood-streaked bamboo fence where his head had been mounted.
Jhmar used Nearby Share, a Bluetooth file-sharing app, to gather every photo and video she could from Thiek’s friends, family and witnesses. For a week, she worked with her media cell colleagues to put together a memorial video. The group released it on their YouTube channel on July 13.
The only consolation
On July 24, Jhmar scored another small win. A team from CNN-News 18, a national TV network, caught wind of Thiek’s killing, and Jhmar brought the crew to interview his family. But after that, outside attention fizzled out again.
On Sept. 2, the Editors Guild of India, a professional group of journalists that had visited Manipur on a fact-finding mission, released a report saying the internet ban had impeded the work of journalists, who were forced to rely “almost entirely on the narrative of the state government” and produced shoddy, one-sided reporting.
Two days later, the Manipur government filed a criminal case against the editors association for “promoting enmity between different groups.”
Mobile internet was briefly restored on Sept. 23, and disturbing photos immediately surfaced on social media, this time showing the corpses of two young Meiteis allegedly killed by Kukis. Authorities arrested the suspected killers before severing the internet again on Sept. 26.
In Churachandpur, Jhmar fell into a gloom. She felt she hadn’t done enough to spread word about the violence. How could she, given Manipur’s internet outage that began in early May?
Jhmar said her only consolation was that Thiek’s slaying had been documented, saved for a day of reckoning when the digital darkness lifts.
“The only thing we can do,” she said, “is keep bringing out the stories as much as we can so that the world knows.”
Shih reported from New Delhi. Anu Narayanswamy in Washington contributed to this report.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Copy editing by Christopher Rickett. Story editing by Alan Sipress. Project editing by Jay Wang.
By Karishma Mehrotra and Joseph Menn
NEW DELHI — For years, a committee of executives from U.S. technology companies and Indian officials convened every two weeks in a government office to negotiate what could — and could not — be said on Twitter, Facebook and YouTube.
At the “69A meetings,” as the secretive gatherings were informally called, officials from India’s information, technology, security and intelligence agencies presented social media posts they wanted removed, citing threats to India’s sovereignty and national security, executives and officials who were present recalled. The tech representatives sometimes pushed back in the name of free speech. One company resisted the most: Twitter.
But two years ago, these interactions took a fateful turn. Where officials had once asked for a handful of tweets to be removed at each meeting, they now insisted that entire accounts be taken down, and numbers were running in the hundreds. Executives who refused the government’s demands could now be jailed, their companies expelled from the Indian market.
New regulations had been adopted that year to hold tech employees in India criminally liable for failing to comply with takedown requests, a provision that executives referred to as a “hostage provision.” After authorities dispatched anti-terrorism police to Twitter’s New Delhi office, Twitter whisked its top India executive out of the country, fearing his arrest, former company employees recounted.
In the past two years, the Indian government has dramatically tightened its grip on American social media companies. Silicon Valley firms that were at times defiant are now far more accepting of Indian government dictates to censor material, in particular criticism of Prime Minister Narendra Modi and his right-wing Bharatiya Janata Party (BJP).
Indian officials say they have accomplished something long overdue: strengthening national laws to bring disobedient foreign companies to heel.
This escalating censorship in the world’s largest democracy is part of a wider campaign by Modi and his Hindu nationalist allies to monopolize public discourse: tightening their grip on power, advancing their Hindu-first ideology and squeezing out critical and dissenting voices. American technology companies have increasingly fallen in line, fearing for their employees’ security and their profits.
Among the Big Tech companies, the shift has been most notable at Twitter, once seen as Silicon Valley’s flag-bearer for resisting government pressure worldwide. A company that not long ago adopted the risky strategy of fighting government censorship in the Indian courts now consistently bends to official demands. It has repeatedly taken down posts critical of Modi and his administration and accounts belonging to journalists and the BJP’s political opponents.
“The [stuff] that they’re doing in India should be freaking everybody out,” said a former U.S. Twitter policy staffer.
In January, Twitter and YouTube were ordered to remove links in India to a BBC documentary that faulted Modi, while chief minister of Gujarat state, for allowing the spread of intercommunal riots in 2002 that left more than 1,000 people dead, most of them Muslims. Citing a legal basis for the order, a senior adviser to the Broadcasting Ministry tweeted that the documentary was “hostile propaganda and anti-India garbage.” Both companies removed the links. YouTube said it did so after the BBC asked it to on copyright grounds.
In October, Twitter, now renamed X, agreed in India to block the accounts of two U.S.-based groups, Hindus for Human Rights and the Indian American Muslim Council, both nonprofits advocating for pluralism and religious freedom in South Asia.
Twitter became increasingly compliant under immense Indian government pressure even before Elon Musk bought the company just over a year ago. But after he did, Musk proved even less willing to contest takedown orders and discontinued transparency reports about how the company responded to them.
In more than 50 interviews, current and former technology executives and Indian officials detailed how the government broke Twitter’s resistance through a raft of new regulations, a streamlined censorship process — and the coercive muscle of law enforcement agencies. Many spoke on the condition of anonymity to describe such private interactions as well as the 69A committee meetings, which have not been previously reported in detail. (The name 69A refers to the section of the information technology law providing for government censorship.) Some executives wanted to share their concerns about how dire the situation has become and the industry’s complicity in the increasing censorship, while government officials wanted to highlight their success in reining in what they say are irresponsible companies.
Digital and human rights advocates warn that India has perfected the use of regulations to stifle online dissent and already inspired governments in countries as varied as Nigeria and Myanmar to craft similar legal frameworks, at times with near-identical language. India’s success in taming internet companies has set off “regulatory contagion” across the world, according to Prateek Waghre, a policy director at India’s Internet Freedom Foundation.
“India is steadily becoming a norm-shaping country,” said Neeti Biyani, a researcher at the Internet Society, a Virginia-based global internet advocacy organization. “Being the strongest economy in South Asia and one of the strongest emerging economies in the Asia-Pacific, it’s considered one of the first movers on new regulations.” Bangladesh, for example, adopted internet regulations in 2022 that were a “copycat” of India’s, Biyani said.
Despite the huge size of China’s market, companies like Twitter and Facebook were forced to steer clear of the country because Beijing’s rules would have required them to spy on users. That left India as the largest potential growth market. Silicon Valley companies were already committed to doing business in India before the government began to tighten its regulations, and today say they have little choice but to obey if they want to remain there.
“We are toeing the line, not antagonizing the government, knowing very well that this is a government that can come after you,” said an industry official. “All governments in India have been intolerant. But now, they are putting in place the mechanisms and measures. They are going about it in a systematic manner.”
Neither Twitter nor Musk responded to written questions for this article.
Silicon Valley companies once believed that “ideology trumped local law. They have been moved from that delusion,” said Rajeev Chandrasekhar, the deputy technology minister in the BJP government who oversees many of the new regulations, speaking in an interview. “The shift was really simple: We’ve defined the laws, defined the rules, and we have said there is zero tolerance to any noncompliance with the Indian law.”
“You don’t like the law? Don’t operate in India,” Chandrasekhar added. “There is very little wiggle room.”
The Information Technology Ministry did not respond to a list of subsequent questions for this article.
Brewing trouble
In 2018, Jack Dorsey, Twitter’s co-founder and its chief executive at the time, flew to New Delhi for a visit that would foreshadow trouble to come.
Clad in a black hoodie and beanie, the bearded billionaire posed for a photo with Indian anti-caste and feminist activists while holding a poster that read: “Smash Brahminical Patriarchy!” The picture went viral and incensed the Indian right wing, which viewed Dorsey as the archetype of an elite American trampling over traditional Indian culture. Many denounced Twitter as “racist,” and the company apologized on behalf of its chief executive.
Twitter, Facebook and other U.S. companies were already grappling with how to moderate speech in India. They were seeing a deluge of anti-Muslim and other hateful posts by BJP leaders and their Hindu nationalist supporters, and on occasion the companies called out and pushed back against activity they considered abusive. Prominent BJP supporters accused Twitter of suppressing their online reach and denying them the blue check marks given to other high-profile individuals.
The Modi administration began to ramp up censorship requests, and the 69A committee meetings grew longer, spilling into days, executives recalled. Often, officials simply called Twitter to demand takedowns, industry and government officials said. Records published by the Indian Parliament show that annual takedown requests for posts and accounts increased from 471 to 6,775 between 2014 and 2022, with those to Twitter soaring from 224 in 2018 to 3,417 in 2022.
Government demands to block entire accounts and topic hashtags also soared. Twitter’s transparency reports show that 77 accounts were suspended in the country in 2020. In 2021, there were nearly 1,400. (The company stopped publishing transparency reports after that.)
One former IT Ministry official involved in the orders defended the blocking of accounts. “There are certain accounts that continue to spew venom,” he said. “I have to go by what content you have posted, how much of it is anti-India.”
A defining moment
In late 2020, hundreds of thousands of Indian farmers descended on New Delhi, demanding that Modi withdraw new laws that reduced crop subsidies and price supports and overhauled state-regulated agricultural markets. The farmers, drawn in large part from members of the Sikh religion in Punjab state, occupied highways for months. They brought food, tents, tractors and something unexpected: social media savvy.
The protesters formed an “IT cell” and connected with the Punjabi and Sikh diaspora around the world. They waged a social media campaign that attracted support from NBA players, Greta Thunberg and Rihanna.
The protest movement posed a rare — and unexpectedly serious — challenge to the BJP government. It was a “defining moment,” said Raman Jit Singh Chima, Asia policy director at Access Now, a digital rights group. “The government realized, ‘We need to cement our power in the tech sector,’” he said. “The digital authoritarian turn accelerated in 2021.”
Soon, the censorship orders flooded in. Government officials, who argued that the farmers’ movement harbored ties to separatists seeking an independent Sikh country, saw any posts that could be linked to the secessionist movement as a clear “no-go zone,” a tech executive said.
But the government’s net went far beyond that. Officials balked at posts critical of Modi and started to block journalists.
Sandeep Singh, a freelance journalist who spent months following the farmers’ protest, recalled tracking dozens of Twitter accounts that were taken down. The farmers’ “IT cell” was silenced. So were a news magazine, a Sikh politician and a poet from Canada. “We were shocked to see the scale,” Singh said.
While Twitter agreed to remove most of the accounts and posts flagged by the government, the company occasionally resisted. The Indian IT Ministry told Parliament that of 3,750 URLs ordered removed between August 2020 and December 2021, 167 were either left up by Twitter or taken down but restored.
In a public statement, Twitter declared it would not take down accounts of journalists, activists and politicians because the orders were not “consistent with Indian law” or its own “principles of defending protected speech and freedom of expression.”
Twitter’s defiance infuriated the Indian officials, who accelerated the adoption of new rules that in part required social media companies to respond to takedown requests within set time periods, and to appoint a compliance manager, a grievance officer and a liaison with law enforcement, all based in India.
The boiling point
While the farmers’ protest raged in the spring of 2021, a devastating delta variant of the coronavirus swept through India, ultimately killing more than 200,000 people. As criticism of the government response swelled on social media, Modi officials issued waves of new takedown orders. In response, Twitter even removed straightforward commentary, such as the tweet: “Second wave of COVID-19 in India = @narendramodi made disaster. #ResignModi”
When opposition leader Rahul Gandhi accused the prime minister of failing to distribute vaccines and shedding insincere “crocodile tears” about pandemic deaths, the speech set off a flood of anti-Modi and anti-government tweets with the hashtag “#crocodiletears.” In New Delhi, officials ordered Twitter to remove all posts with that hashtag and demanded that the company hand over information identifying users who tweeted it, two former employees recalled.
After Twitter resisted, Indian officials claimed that the hashtag was being used by terrorists and later alleged it was being used to distribute pornography, the former employees said. Indeed, some posts with the #crocodiletears hashtag contained pornographic images. But a Twitter investigator found that some of the posts came from a location near a police building, and a Twitter team concluded that the government itself was planting the images to justify social media restrictions, the former employees recalled.
Tensions between Twitter and the Modi administration reached a boiling point after the company labeled some BJP leaders’ posts as “manipulated media,” meaning they contained images that had been deceptively altered. An elite police force showed up outside Twitter’s New Delhi office in May 2021 with television cameras in tow. The promised raid, however, never materialized because the office was empty amid the pandemic.
In a separate dispute, police in the BJP-ruled state of Uttar Pradesh summoned Twitter India’s managing director, Manish Maheshwari, for questioning over accusations that the platform showed a disputed map of India that did not reflect the country’s declared borders, according to internal company documents. Although Twitter lawyers staved that off, a subsequent police visit to his home and escalating anonymous threats made Twitter’s U.S.-based leadership conclude that it had become “very, very dangerous for him and his family,” a former company executive said. Twitter hurried Maheshwari out of India in mid-2021, and he has not returned.
Maheshwari declined to comment for this article.
In a tweet that May, Twitter highlighted “the use of intimidation tactics by the police” and said it was “concerned by recent events regarding our employees in India and the potential threat to freedom of expression for the people we serve.” The IT Ministry hit back by calling Twitter’s noncompliance “an attempt to dictate its terms to the world’s largest democracy.”
But despite Twitter’s public rebuke of the Indian government, employees inside the company were growing concerned about how much it was bowing to the government’s censorship demands. At an annual presentation to the company’s leadership in 2021, Twitter’s communications team singled out India and delivered a warning about the global precedent the company was setting, according to a person familiar with the presentation.
“The concern was that if we were beginning to make exceptions for a certain government, a whole host of other governments would come to us, and it would be difficult to explain why we could not do the same for them,” the person said.
The ‘hostage provision’
As India’s new IT rules kicked in, the government told a Delhi court in summer 2021 that Twitter did not have local officers responsible for addressing grievances, coordinating with law enforcement and other tasks mandated by law, and thus had lost its “safe harbor” status, leaving it potentially liable for content deemed illegal. These local officers had to be based in India and could face penalties of five years in jail for failing to comply with government orders.
The threat of arrest “shifts the calculus significantly” for corporate decision-making, said Waghre, of the Internet Freedom Foundation. “You can draw a line in the sand from when the IT rules 2021 went into effect. There was a sudden drop in reported instances of any sort of pushback.” Former Twitter and Facebook executives agreed, saying in interviews that they could not allow colleagues to be jailed.
To meet the government mandate, Twitter hired Vinay Prakash — whose longest previous job had been as a political analyst for Chandrasekhar, then in Parliament and now the deputy IT minister in the BJP government — to be both grievance and compliance officer.
Because of the sensitivity of the position — compliance officers typically have access to internal discussions about legal and human-resource issues as well as user information — Twitter had asked a Florida-based boutique research firm, Divine Intel, to conduct an independent appraisal and background check on Prakash. The firm raised concerns, according to two people familiar with the events.
“Our assessment identified one applicant as high-risk/high-threat and we advised against hiring the individual due to the potential for undue influence from members of Parliament” and other issues, said a Divine Intel executive who spoke on the condition of anonymity to comply with the company’s secrecy policy. The executive said that despite these findings, the person was hired. Divine Intel did not identify Twitter as its client, saying only that it was a major U.S. tech company. But the people familiar with the episode said it was referring to the vetting of Prakash.
Prakash did not respond to requests to comment for this article.
Last year, former Twitter head of security Peiter Zatko filed a whistleblower complaint with the U.S. Securities and Exchange Commission and the Justice Department alleging that around the time of the farmers’ protest, the Indian government “forced Twitter to hire specific individual(s) who were government agents.” In testimony before Congress, he said that the government agent was to secretly monitor how Twitter responded to political and public pressure and that the company had known about it.
Zatko, who was fired in January 2022, never publicly named the employee he believed to be working for the Indian government. Twitter has denied Zatko’s allegations.
Loss of appetite
In July 2022, Twitter took the Indian government to court, suing over the continuing demands to censor tweets about the farmers’ protest.
Twitter lost. A judge in Karnataka state sided with the government in June, ruling that posts it wanted censored were “anti-India & seditious … designed to incite violence.”
Twitter appealed. But the company lost much of its appetite to challenge the government after Twitter was acquired a year ago by Musk, former employees said.
“Twitter doesn’t have a choice but to obey local governments,” Musk said in June to Geeta Mohan, executive editor of the India Today news channel. “If we don’t obey local government law, then we will get shut down. The best we can do is really to hew close to the law in any given country, but it’s impossible for us to do more than that or we will be blocked and our people will be arrested.”
Other U.S. companies also opted for a less confrontational approach. After the new IT law was adopted in 2021, for example, Google chief executive Sundar Pichai became one of the first tech leaders to say his company would adhere to it.
“When you comply, you make more revenue. We gained from that,” said a former Google global affairs executive.
Google spokeswoman Christa Muldoon said that the company examined removal requests to see if the content violated local laws, removing it for users in the relevant country, and that revenue was not a factor in decisions. The company reported that the number of items removed from all Google platforms in India soared from about 11,000 in 2019 to more than 23,000 in just the first half of 2023.
Lokman Tsui, who oversaw Google’s free expression program in the Asia-Pacific region in the early 2010s, said the company began a global shift away from its “moral stance” in his region, notably in India, before this spread worldwide.
Doubling down
Now, Indian officials say they want to tighten their regulations further. The “Digital India” bill being drafted is likely to weaken legal protections afforded to the companies for hosting content deemed illegal, according to Chandrasekhar.
“There will no longer be blanket immunity” for social media companies that do not obey, he said. He added that online anonymity and safe harbor protections have been abused to spread harmful misinformation and hate speech.
Other government officials, meanwhile, say it has become easier to make companies take down content because they have turned over many of the decisions to India-based staff, who focus more on complying with local laws and less on company policies. One former IT Ministry official praised the companies for becoming more “understanding” of the government’s perspective, noting that they increasingly comply with its orders.
Just the prospect of further regulation is being used by the government to bend the tech companies to its will, according to Chima, of the Access Now digital rights group. “It’s not only the issue of what actually will get into the law,” he said. “It’s that legal threats are used as a form of negotiation, to get companies to do or not do certain things.”
Gerry Shih contributed to this report.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Copy editing by Gaby Morera Di Núbila and Martha Murdock. Story editing by Alan Sipress. Project editing by Jay Wang.
By Gerry Shih, Clara Ence Morse and Pranshu Verma
NEW DELHI — Since 2020, an opaque organization calling itself the Disinfo Lab has published lengthy dossiers and social media posts claiming to reveal the personal relationships and funding sources behind U.S.-based critics of Indian Prime Minister Narendra Modi.
The Disinfo Lab has combined fact-based research with unsubstantiated claims to paint U.S. government figures, researchers, humanitarian groups and Indian American rights activists as part of a conspiracy, purportedly led by global Islamic groups and billionaire George Soros, to undermine India.
In each instance, these allegations have gone viral on Indian social media after they were amplified by pro-Modi influencers, who at times used the group’s findings to validate their own positions. Its reports have been cited by Indian officials on television and presented on Capitol Hill. Despite its reach, the Disinfo Lab does not disclose its affiliation, describing itself on its website as a “separate legal entity” that seeks to offer “completely unbiased research.”
In reality, however, the Disinfo Lab was set up and is run by an Indian intelligence officer to research and discredit foreign critics of the Modi government, according to three people who worked in the organization or were familiar with its establishment. While claiming that it aimed to uncover anti-India disinformation, the Disinfo Lab itself is running a covert influence operation, they said.
The organization’s material is among the most widely circulated by right-wing Indians and Hindu nationalists. Its reports gain global reach, partly because they are spread on social media by high-profile figures with large followings on X, previously known as Twitter, including current and former officials in Modi’s Bharatiya Janata Party, former intelligence and military brass, and a cabinet minister, according to a Washington Post analysis of nearly 100,000 reposts of Disinfo Lab content on X. While it is unclear how many of them, if any, are aware of the Disinfo Lab’s intelligence ties, these top retweeters give the Disinfo Lab a stamp of authority and, some of its targets say, boost its ability to intimidate individuals overseas.
The Disinfo Lab’s activities show how the online propaganda campaigns waged by the BJP and its allies have been expanding beyond their traditional, domestic aims of shoring up popular support and denigrating opposition parties — and now seek to influence attitudes far beyond India’s borders. Moreover, the organization’s ties to an Indian intelligence officer could blur the line traditionally observed by the country’s security apparatus between operations that serve the strategic interests of India and those that advance the political objectives of the ruling party, analysts said.
Sumit Ganguly, an expert on Indian diplomacy and national security at Indiana University at Bloomington, said undermining foreign governments and their officials is “routine” work for intelligence agencies around the world. But if Indian intelligence is “besmirching American critics and civil society organizations, it would be crossing a line reminiscent of KGB tactics during the Cold War,” he said. “It would be part and parcel of the Modi government’s attitude toward dissent, whether at home or abroad.”
The Disinfo Lab, which at one point consisted of about a dozen private contractors working out of a four-story whitewashed building on a leafy street in New Delhi, was created in mid-2020 by Lt. Col. Dibya Satpathy, now 39, an intelligence officer who has worked to shape international perceptions of India, said the three people familiar with the operation. They spoke on the condition of anonymity to describe sensitive intelligence activities.
Satpathy was initially commissioned as an infantry officer and served in the army’s intelligence and public information units, said a person briefed on his military personnel record. That person and another source close to the military said Satpathy was later detailed to his current posting with India’s external intelligence agency, the Research and Analysis Wing (RAW). Over the years, Satpathy has introduced himself to Western journalists and commentators under fake identities — including his preferred alias, Shakti, meaning “power” in Hindi — and sought favorable coverage of India or critical coverage of its adversaries, Pakistan and China, according to five additional people who have had contact with Satpathy.
In an emailed response to questions from The Post, the Disinfo Lab said, “We are in no form associated with any govt agency, nor with any of its personnel. Nor are we associated with any other organization — Indian or International.” The organization said it was created by individuals who had met in an anti-corruption political movement and were concerned about “the massive disinformation targeted at India to sow divisions in society.”
The email, signed by “Disinfo Lab,” said the group did not side with Modi’s government. “We are equal opportunity exposers, even calling out the ruling party. Disinformation is our arch-nemesis, irrespective of political allegiance,” the group said.
Efforts to reach Satpathy through the Disinfo Lab and separately through an intermediary did not yield a response. India’s national security adviser, Ajit Doval, who helps oversee the country’s intelligence agencies, did not respond to a request for comment.
‘New player’ on the world stage
Over the past five years, social media researchers have uncovered large Indian online networks that promote the BJP’s foreign policy positions to domestic and foreign audiences. Coordinated social media accounts have been found to play a role, for instance, in spreading identical posts in support of Russia, an important supplier of weapons and energy to India, and of Israel, an increasingly close partner.
“The Indian right wing is a new player that has arrived on the world stage and wants to shape global discussion,” said Joyojeet Pal, a professor of information at the University of Michigan who studies disinformation in India. “So far, much of it is done in the same way it’s done within India — through crude, blunt force. But it’s getting smarter.”
The Disinfo Lab has emerged as one of the more sophisticated players. In 28 reports it has published so far, the organization has often painted a picture of an India under attack by a sprawling “nexus” of conspirators funded by Pakistani intelligence, the Muslim Brotherhood and Soros.
The Disinfo Lab’s narrative alleges that these funds have found their way to Rep. Pramila Jayapal (D-Wash.), an Indian American and outspoken critic of Modi; Indian American activists who criticized the Modi government for discrimination against Muslims and low-caste Hindus; and members of the U.S. Commission on International Religious Freedoms (USCIRF), a bipartisan panel that has recommended the State Department designate India a “country of particular concern” for the Modi government’s treatment of Muslims, Christians, Sikhs and other minority groups.
The Disinfo Lab often cites publicly available U.S. lobbying and campaign finance records and produces complex flowcharts to illustrate alleged relationships. But the group draws tenuous connections, claiming, for instance, that a USCIRF commissioner was influenced by Islamists because she once worked on a conservative fundraising committee alongside a lobbyist who went on to represent Muslim American groups.
When the Disinfo Lab released its first major report, in early 2021, it created a template for the kind of attacks that would be repeated in the coming years. The organization released a dossier nearly 100 pages long alleging that Pieter Friedrich, a California-based activist and journalist who has written magazine articles and given public speeches critical of the BJP and affiliated Hindu-nationalist groups, had ties to the Sikh separatist movement and Pakistan’s premier intelligence agency. The Disinfo Lab burrowed into California state records to uncover Friedrich’s employment history, published his parents’ names and plotted detailed graphs about his social media activity.
A prominent Indian official among others spread the dossier on Twitter, amplifying the allegations. Police officials in New Delhi called a news conference and distributed the dossier, telling reporters that the “carefully researched” report showed Friedrich had been “on the radar of Indian security establishment.” Citing Disinfo Lab research, pro-government television channels ran reports alleging Friedrich and Pakistan had masterminded a 2021 protest by farmers at New Delhi’s Red Fort that erupted into violence and represented a major challenge to the Modi administration.
In a recent interview, Friedrich said that many personal and work details reported by the Disinfo Lab were true but that other claims — that he fomented an anti-government riot or had ties to Pakistani intelligence — were fabricated. The attacks made him fear for his safety, he said.
“It felt like the earth shook,” he said. “I understood it as a warning shot across the bow saying, ‘You need to stay in your lane, stop poking your nose in our business and keep your mouth shut.”
The Disinfo Lab also published a lengthy report in April denouncing Sunita Viswanath, the New York-based founder of the rights group Hindus for Human Rights who has criticized the BJP’s Hindu-nationalist ideology as antithetical to Hinduism. The Disinfo Lab dug into her past and reported that a nonprofit she launched to help female Afghan refugees had received funding from Soros’s Open Society Foundations.
Two months later, after Indian opposition leader Rahul Gandhi attended a meeting in Washington with Viswanath as part of a U.S. tour, Amit Malviya, the head of the BJP’s social media team, tweeted a photo of the meeting and shared a flowchart stamped with the Disinfo Lab logo illustrating Viswanath’s connections to Soros.
“Who is she exactly?” Malviya wrote on X. “She is nothing but a proxy of George Soros, who has committed $1 billion to meddle in India’s internal affairs, through a network of opposition leaders, think tanks, journalists, lawyers and activists.” The post was retweeted 7,800 times.
And last month, after The Post published an article about the Indian government’s efforts to censor X, the Disinfo Lab took to that platform and accused The Post, falsely, of waging psychological warfare against India at the behest of the CIA. The thread also went viral.
An information warrior
Until at least 2021, the Disinfo Lab shared its office with a separate team headed by a career RAW intelligence officer who specialized in China and carried out information operations related to Tibet, said the three sources who described the activities to The Post. The Disinfo Lab itself was headed by Satpathy, whose work has focused mostly on countering Pakistan and the unrest it allegedly foments in the Indian border state of Punjab and Indian-controlled Kashmir, these people said.
Much of the Disinfo Lab’s work reflected the thinking of its founder, Satpathy, who was described by journalists, a government official and a person close to the military as a deeply patriotic officer who is fascinated by geopolitical intrigue and concerned by threats he sees India facing.
When he self-published a novel in 2016, Satpathy gave book talks and interviews, describing himself as a 2002 graduate of India’s National Defense Academy who loved writing, theater, single-malt whisky and his motherland. In 2019, he penned an article for a defense journal analyzing how India used a “carefully scripted narrative” to justify to the world an airstrike conducted against Pakistan earlier that year.
By late that year, the Indian government was coming under intense international criticism for revoking the semiautonomous status of Muslim-majority Kashmir, and around that time, four journalists recalled, a polished national security official began introducing himself as “Shakti” to foreign correspondents in New Delhi, telling them he wanted to help them understand India’s perspective.
They said Satpathy offered to arrange a meeting for them with Modi’s national security adviser, Doval, coordinated a rare visit to Kashmir, which was then off-limits to foreign reporters, and pitched story ideas about Kashmir’s economic recovery under India’s direct rule. “Shakti” refused to disclose his name or affiliation, said the journalists, but they later identified him as Satpathy when shown photographs of him.
One of Satpathy’s former associates recalled working with him to feed Pakistani documents to Bruno Macaes, a former Portuguese diplomat who has written books about China’s Belt and Road Initiative and maintains a large following on X. Macaes, who confirmed he had been approached by men claiming to be Pakistani dissidents, said he was not aware they were connected to Indian intelligence, but he shared screenshots showing he was forwarded documents from a Telegram user named “Shakti.” Macaes said he ultimately did not write about the documents.
One person who played a role in the Disinfo Lab’s formation said the operation emerged from a world view in which India is besieged by “information warfare” from foreign countries that stoke religious divisions and grievances within India. For years, government officials, including Modi, have also pointed a finger at Western human rights and other nonprofit groups and news media, alleging they unfairly criticize India and conspire to hold back its development.
“The Indian government felt it was not having its views conveyed in the international media,” the person said. He added that, initially, the goal was for the Disinfo Lab to be viewed as a neutral organization on a par with well-known Western disinformation research groups and cited by mainstream news outlets. Like other people cited, he spoke on the condition of anonymity for fear of Indian government retribution.
Another person, a former employee, said the Disinfo Lab named and modeled itself after groups such as the Atlantic Council’s Digital Forensic Research Lab and the EU DisinfoLab, a Brussels-based nonprofit that researches disinformation targeting Europe.
The office operated under the name “Root and Wings Media,” which describes itself online as a social media marketing company, said the three sources familiar with the operation and Rohan Mehta, the landlord of the building where the operation was located until mid-2021. The Post could not locate company registration records for Root and Wings or its current address. Employees who picked up at its publicly listed phone number declined to provide their address or comment.
On a YouTube show in 2021, the founder of Root and Wings, Ajayendra Tripathi, described himself as a social media expert who specialized in busting fake news and inauthentic accounts. “You can’t tell outright lies if you want to spread fake news,” Tripathi explained to his interviewer. “You have to tell lies that are somewhat close to the truth.”
When reached by The Post via text messages, Tripathi denied any association with the Disinfo Lab and said he now works for a political consultancy. He declined further comment.
Asked by The Post about its offices, the Disinfo Lab said, “The place we worked from had multiple other offices including a co-working space. We do not and did not work for any other firm.”
Transnational reach
The Disinfo Lab has often served as a rapid-reaction force to counter criticisms of the Modi government that have attracted international attention or to preempt anticipated flak.
In February, Soros, a frequent critic of Modi, warned in a speech at the Munich Security Conference that the Indian leader was undemocratic and would lose his “stranglehold” over the Indian government. A day later, the Disinfo Lab posted a lengthy tweet thread alleging that Soros had ties to the Muslim Brotherhood and manipulated “fake” U.S.-based advocacy groups to smear India. A spokesperson for Soros’s Open Society Foundations called the Disinfo Lab’s claims “entirely baseless” and said they were part of a “campaign by this site and others in India against advocates of human rights, democratic governance and the rule of law in the service of the political aims of the BJP and its allies.”
When Jayapal arranged to have House and Senate members in June write a letter pressing President Biden to raise human rights issues with Modi days before his state visit to Washington, the Disinfo Lab published a lengthy X thread — retweeted more than 1,000 times — claiming Jayapal was influenced by Pakistan and “Islamist funding.” Jayapal did not respond to requests for comment.
The Disinfo Lab’s reports and social media posts often gain an enhanced veneer of authority as they propagate online because of the prominence of their retweeters.
The Post analyzed the 250 most-followed accounts that reposted content from the Disinfo Lab. Of those, The Post identified 35 current or former BJP officials, 14 government or military leaders, 61 journalists, authors or thought leaders, and 140 influencers or content creators, including Indian and American right-wing ideologues. Many had hundreds of thousands or millions of followers, and shared Disinfo Lab content dozens or even hundreds of times.
These retweeters included Tajinder Bagga, the national secretary of the BJP youth wing; Sanju Verma, a BJP national spokeswoman; and Kapil Mishra, the vice president of the BJP’s Delhi unit who has 1.5 million followers on X. Government- and military-linked amplifiers have included Rajeev Chandrasekhar, the junior information technology minister; Kanchan Gupta, senior adviser to the information ministry; Ved Malik, a retired chief of army staff; and Vikram Sood, a former RAW chief and author of “The Ultimate Goal,” a book about how shaping narratives at home and abroad is a key responsibility of intelligence agencies.
“Great work,” Sood said in tweeting a 108-page Disinfo Lab report detailing how Pakistan allegedly funded American academics, activists and retired CIA officials to criticize India’s governance of Kashmir. Sood also shared the report on Koo, an Indian homegrown alternative to X.
When contacted by The Post, Bagga, Mishra and Malik said they were not familiar with the Disinfo Lab’s background. Verma, Chandrasekhar, Gupta and Sood did not respond.
Other key spreaders, The Post analysis found, were U.S.-based groups advocating for Hindu-nationalist causes. Some of the Disinfo Lab’s frequent retweeters included HinduPACT and Hindu Action, two initiatives of the U.S. branch of the Vishva Hindu Parishad, a right-wing Hindu organization that is ideologically allied with the BJP. Sudha Jagannathan, an American activist who lobbied to block a California bill banning caste-based discrimination, retweeted the Disinfo Lab 120 times.
Ajay Shah, the convener of HinduPACT, said the group disseminates surveys, research reports and news items from “a wide variety of sources if we consider them to have impact on the American Hindus.” He said he does not know who runs the Disinfo Lab, adding, “We do believe that their analysis, unless unequivocally proved inaccurate, is highly relevant to American Hindus … and American national security.”
Hindu Action did not respond to a request for comment. But after being contacted, the group tweeted that the “material that we have shared are concerning and should be taken seriously by our American law enforcement agencies.” Jagannathan did not respond to a request for comment.
Disinfo Lab reports have also made their way into American halls of power.
Amid the covid pandemic in 2021, a senior U.S. congressman in the House India caucus received a Disinfo Lab report from a group in his district claiming that Islamic humanitarian agencies were receiving federal aid and sending it to Pakistan to fuel terrorist activities targeting India and the United States, said a congressional staffer speaking on the condition of anonymity to share details of private conversations.
The staffer said the lawmaker’s Hindu constituents insisted the office provide updates about what Congress would do about the claims made in the Disinfo Lab report and, a member of the office forwarded the report to law enforcement for further review and investigation.
The group’s work also showed up in the debate this year over California legislation to outlaw caste-based discrimination. Opponents of the measure gave lawmakers a slide presentation suggesting, in part, that they read a Disinfo Lab report attacking the group leading the push for the legislation, a person familiar with the lobbying efforts recalled, speaking on the condition of anonymity to discuss sensitive matters. The dossier painted that group — a U.S.-based civil rights organization called Equality Labs — as a radical outfit funded by Pakistan to orchestrate caste-related protests in the United States and included personal information about the group’s director, her divorce and her father.
“This is a situation where the American government needs to protect American citizens that are being targeted for foreign influence, simply because we want to have rights like other Americans,” said Thenmozhi Soundararajan, director of Equality Labs.
Ria Chakrabarty, a policy director for pro-pluralism Hindus for Human Rights, a group critical of Modi, said lobbyists working for U.S.-based Hindu nationalist groups have disseminated Disinfo Lab dossiers in other venues.
She recalled attending the 2022 International Religious Freedom Summit at the Renaissance Hotel in Washington when a lobbyist from HinduPACT walked around distributing a thick, bound Disinfo Lab report that claimed to connect the Indian American Muslim Council, an Indian diaspora group critical of Modi, to Pakistani intelligence. The lobbyist knew that Chakrabarty often collaborates with the IAMC, Chakrabarty recalled, and warned her to “know who you’re sitting next to.”
In its response to The Post, the Disinfo Lab pointed to its record of forcing “activists” and “human rights fronts” to shut down by exposing them, saying, “We take our craft very seriously, and we make sure that our claims stand. In our understanding, fake news/ fabricated data is the core of any info-war.”
The ‘Disinformation Age’
Ajai Shukla, a retired Indian Army colonel and a military affairs journalist, said that former prime ministers such as Indira Gandhi also painted her critics as national security threats. But the Modi government has gone further, sometimes blurring the line between its political foes and those who should be targeted by the security apparatus, he said.
The defense establishment “exists to serve national and strategic interests, not political interests,” Shukla said. “But the BJP under Modi has seen critics as anti-Indian, the enemies of India itself.”
With its reports repeatedly cited by BJP officials and its profile rising, the Disinfo Lab gave its only interview to date, in written format, to the Indian freelance journalist Sandhya Ravishankar this summer.
In response to Ravishankar’s emailed questions, the organization explained that it was founded in 2020 by people with political and marketing backgrounds. The group said it relied mostly on conventional open-source intelligence-gathering methods, lots of Googling and its self-made data visualization tools. It warned that India was caught in a “narrative war” against many belligerents: the United States, China, Pakistan and “hydra-headed Islamist fronts, all operating under lofty human rights and other banners.”
“Left with no other choice, we are trying to do what we can with limited resources,” the Disinfo Lab said. “The world moved from the Information Age to the Disinformation Age long back.”
Morse and Verma reported from Washington.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore and Jennifer Samuel. Data editing by Anu Narayanswamy. Copy editing by Christopher Rickett. Story editing by Alan Sipress. Project editing by Jay Wang.
By Gerry Shih and Joseph Menn
NEW DELHI — A day after Apple warned independent Indian journalists and opposition party politicians in October that government hackers may have tried to break into their iPhones, officials under Prime Minister Narendra Modi promptly took action — against Apple.
Officials from the ruling Bharatiya Janata Party (BJP) publicly questioned whether the Silicon Valley company’s internal threat algorithms were faulty and announced an investigation into the security of Apple devices.
In private, according to three people with knowledge of the matter, senior Modi administration officials called Apple’s India representatives to demand that the company help soften the political impact of the warnings. They also summoned an Apple security expert from outside the country to a meeting in New Delhi, where government representatives pressed the Apple official to come up with alternative explanations for the warnings to users, the people said. They spoke on the condition of anonymity to discuss sensitive matters.
“They were really angry,” one of those people said.
The visiting Apple official stood by the company’s warnings. But the intensity of the Indian government effort to discredit and strong-arm Apple disturbed executives at the company’s headquarters, in Cupertino, Calif., and illustrated how even Silicon Valley’s most powerful tech companies can face pressure from the increasingly assertive leadership of the world’s most populous country — and one of the most critical technology markets of the coming decade.
The recent episode also exemplified the dangers facing government critics in India and the lengths to which the Modi administration will go to deflect suspicions that it has engaged in hacking against its perceived enemies, according to digital rights groups, industry workers and Indian journalists.
Many of the more than 20 people who received Apple’s warnings at the end of October have been publicly critical of Modi or his longtime ally, Gautam Adani, an Indian energy and infrastructure tycoon. They included a firebrand politician from West Bengal state, a Communist leader from southern India and a New Delhi-based spokesman for the nation’s largest opposition party.
Of the journalists who received notifications, two stood out: Anand Mangnale and Ravi Nair of the Organized Crime and Corruption Reporting Project, a nonprofit alliance of dozens of independent, investigative newsrooms from around the world.
On Aug. 23, the OCCRP emailed Adani seeking comment for a story it would publish a week later alleging that his brother was part of a group that had secretly traded hundreds of millions of dollars’ worth of the Adani Group conglomerate’s public stock, possibly in violation of Indian securities law. A forensic analysis of Mangnale’s phone, conducted by Amnesty International and shared with The Washington Post, found that within 24 hours of that inquiry, an attacker infiltrated the device and planted Pegasus, the notorious spyware that was developed by Israeli company NSO Group and that NSO says is sold only to governments.
A spokeswoman for Adani denied that the magnate was involved in any hacking effort and accused OCCRP of conducting a “smear campaign” against the Adani Group. She also criticized The Post for asking whether the Adani Group was involved in, or had knowledge of, the hacking attempts against OCCRP. “While categorically denying and rejecting this insinuation, we find it disturbing and inappropriate that you would make an attempt to draw our name into this specious construct,” Varsha Chainani, the Adani Group’s head of corporate communications, said in an emailed response to written questions. “The Adani Group operates with the highest level of integrity and ethical standards.”
Gopal Krishna Agarwal, a national spokesman for the BJP, said any evidence of hacking should be presented to the Indian government for investigation. Hiren Joshi, the top communications official in the prime minister’s office, did not respond to requests seeking comment. Apple declined to comment in response to written questions.
The Modi government has never confirmed or denied using spyware, and it has refused to cooperate with a committee appointed by India’s Supreme Court to investigate whether it had. But two years ago, the Forbidden Stories journalism consortium, which included The Post and OCCRP, found that phones belonging to Indian journalists and political figures were infected with Pegasus, which grants attackers access to a device’s encrypted messages, camera and microphone.
In recent weeks, The Post, in collaboration with Amnesty, found fresh cases of infections among Indian journalists. Additional work by The Post and New York security firm iVerify found that opposition politicians had been targeted, adding to the evidence suggesting the Indian government’s use of powerful surveillance tools.
In addition, Amnesty showed The Post evidence it found in June that suggested a Pegasus customer was preparing to hack people in India. Amnesty asked that the evidence not be detailed to avoid teaching Pegasus users how to cover their tracks.
“These findings show that spyware abuse continues unabated in India,” said Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab. “Journalists, activists and opposition politicians in India can neither protect themselves against being targeted by highly invasive spyware nor expect meaningful accountability.”
NSO spokesperson Liron Bruck said that the company does not know who is targeted by its customers but investigates complaints that are accompanied by details of the suspected hack.
“While NSO cannot comment on specific customers, we stress again that all of them are vetted law enforcement and intelligence agencies that license our technologies for the sole purpose of fighting terror and major crime,” Bruck said. “The company’s policies and contracts provide mechanisms to avoid targeting of journalists, lawyers and human rights defenders or political dissidents that are not involved in terror or serious crimes.”
David Kaye, a former United Nations special rapporteur on free expression who has testified before an Indian Supreme Court committee probing the government’s suspected use of Pegasus, said the recent reporting by The Post and its partners “further shifts the burden onto the Indian government to disprove the allegations that it uses these kinds of tools.”
“Especially after this information, the government absolutely has to be honest and transparent,” Kaye said. "But the accretion of evidence suggests this is not divorced from the broader assault by the Modi government on the freedom of expression and the right to protest.”
A persistent threat
One after another at October’s end, some of India’s best known journalists and politicians posted on X, formerly known as Twitter, that Apple had warned them that state-sponsored hackers may have targeted their devices. While Apple, as usual, did not accuse the Indian government or describe the attacks, the self-identified victims said there was a pattern: Many had questioned Modi’s close relationship with Adani, who lent the Indian leader aircraft for his 2014 election campaign, traveled abroad with him during state visits and operates a vast portfolio of seaports, airports, railroads and power plants.
On Aug. 31, the OCCRP published a joint investigation with British news outlets the Financial Times and the Guardian, reporting that Adani’s longtime associates had routed funds through offshore shell companies into publicly traded Adani shares. Adani denied the story’s allegations, but the report spurred calls for a parliamentary probe of suspected stock manipulation, and it renewed criticism that Modi’s government had failed to regulate Adani’s dealings out of loyalty to the businessman.
Hours after OCCRP sought comment from Adani a week before the story’s publication, unknown hackers used an exploit called Blastpass to weave through two security holes in Mangnale’s phone and install Pegasus, according to Amnesty’s analysis. Amnesty said it found no signs of an attempted intrusion on Nair’s phone, which is not uncommon after sophisticated attacks.
“We know Pegasus is only licensed to governments, and we know that the attack happened hours after we sent the email,” Mangnale said. “I am not pointing at anyone, but that is a hell of a coincidence.”
Others warned by Apple include Mahua Moitra, a member of Parliament who has vocally condemned Modi’s relationship with Adani. Moitra was expelled from Parliament this month by a BJP-dominated committee investigating allegations that she accepted gifts from an Adani business rival in exchange for raising questions about the billionaire’s business interests. In an interview, Moitra called the charges fabricated and said the government should scrutinize Adani’s transactions instead of her communications.
“Adani is the government and the government is Adani,” Moitra said. “It is our greatest misfortune that we are governed by a bunch of peeping Toms.”
IVerify examined Moitra’s phone backup and confirmed that she had received an Apple warning. It also saw urgent crash reports that, together with other digital records, suggested the device had been hacked. The company also found a threat notification and suspicious activity on the phone of Praveen Chakravarty, head of the opposition Indian National Congress party’s data analytics department.
This is far from the first time the Indian government has been accused of snooping on critics.
In 2018, researchers at the University of Toronto’s Citizen Lab found evidence that servers used to plant NSO spyware were embedded in Indian telecom networks. Two years later, Citizen Lab and Amnesty found that nine human rights advocates in India had been hacked with emails that installed commercial spyware on their Windows computers.
In 2019, Meta’s WhatsApp also sued NSO, alleging that the firm exploited vulnerabilities in its chat software to hack approximately 1,400 people, and told the media that the victims included journalists and dissidents in India. NSO has denied wrongdoing in the case, which is pending. And last year, journalists working for OCCRP unearthed customs records showing that India’s Intelligence Bureau, the domestic security agency, received shipments of hardware matching Pegasus specifications from NSO’s offices outside Tel Aviv.
Siddharth Varadarajan, a co-founder of the Indian digital media outlet the Wire, received one of Apple’s Oct. 30 warnings. Amnesty found that the hackers that broke into Mangnale’s phone had tried to do the same to Varadarajan’s. In both cases, someone using the Apple ID [email protected] had used the Blastpass vulnerability. The Post received no response to an email sent to that address.
The attempt to infiltrate Varadarajan’s phone and install Pegasus, which took place on Oct. 16, failed, Amnesty found. That’s because Blastpass had been revealed in September by Citizen Lab, Apple had fixed the two flaws it used and Varadarajan had kept his iPhone’s software updated.
Varadarajan said he was not working on any sensitive stories around the time of the attempted hack. But he said he was leading protests over the arrest of a leftist publisher accused of spreading Chinese Communist Party propaganda. The publisher’s website, Newsclick, had often run articles critical of Modi and Adani.
Government counteroffensive
As soon as journalists and opposition politicians shared their warnings from Apple, BJP officials scrambled to contain the fallout.
Senior Modi administration officials called Apple India’s managing director, Virat Bhatia, after the news broke, said two people with knowledge of the matter. One of the people said Indian officials asked Apple to withdraw the warnings and say it had made a mistake. After a heated discussion, the company’s India office said the most it could do was put out a public statement that emphasized certain caveats that Apple had already listed on its tech support page about the warnings.
Apple India soon sent out emails observing that it could have made mistakes and that “detecting such attacks relies on threat intelligence signals that are often imperfect and incomplete.”
“Civil society was puzzled and concerned by the Apple statement,” said one U.S. digital rights advocate, who spoke on the condition of anonymity to speak frankly about what he viewed as company missteps.
Bhatia told others that the company was under intense pressure from the government, but other Apple executives stressed the need to stand firm, the two people familiar with the events said. Bhatia declined to comment.
Still, Apple India’s corporate communications executives began privately asking Indian technology journalists to emphasize in their stories that Apple’s warnings could be false alarms and that similar warnings had been issued to users in 150 countries, not just India, said three Indian journalists, who spoke on the condition of anonymity to protect their relationship with Apple. The guidance effectively cast doubt on Apple’s own security team and shifted the spotlight away from the Modi government, these journalists said.
A BJP memo distributed to party surrogates and friendly media outlets pushed similar talking points. The memo, seen by The Post, noted that Apple users in 150 countries, including “several political leaders in Uganda,” had received similar hacking notices and that Apple’s operating systems contained security vulnerabilities. The evening the memo went out, government officials anonymously told Indian outlets they suspected that an “algorithmic malfunction” within Apple’s internal systems had generated the hacking notices, and Piyush Goyal, India’s commerce minister, said in a television interview that the notices may have been “a prank.”
On social media, pro-government influencers further muddied the waters. Sanjeev Sanyal, one of Modi’s economic advisers, pointed out on X that, in Apple’s hacking alerts, the company advised targeted users to consult with Access Now, a digital rights group that Sanyal noted has received funding from George Soros, the liberal financier and philanthropist. Soros is often painted by the Indian right as a boogeyman who masterminds international conspiracies against India.
“See the sinister plot here?” Amit Malviya, the head of BJP’s social media team, asked his 765,000 followers on X, implying that Apple, Access Now, Soros and opposition politicians were working together to falsely accuse the government of hacking.
On Oct. 31, Rajeev Chandrasekhar, the deputy minister of electronics and information technology, announced that a government probe had been launched into “these threat notifications and ... Apples claims of being secure.”
After receiving a barrage of questions from the government, one Apple security expert from outside India flew to the country in November and met with officials at the technology ministry’s New Delhi offices, where officials again demanded alternative explanations for the warnings, according to the three people familiar with the events.
But Apple defended its work to the officials. “When Apple sends a notification, that’s yelling ‘fire.’ You’d better be pretty confident there’s a fire,” said a person who worked with the company. He and others spoke on the condition of anonymity to discuss sensitive dealings with authorities.
In response to questions from The Post about whether the government exerted pressure on Apple, the Ministry of Electronics and Information Technology said in a statement: “We have instituted technical investigation in the reported matter. So far, Apple has cooperated fully in the investigation process.”
Nikhil Pahwa, the founder of the Indian tech policy news website MediaNama, said the Modi government deployed a familiar tactic.
“You can’t have the Indian government investigating itself,” Pahwa said. “What we see often with the Indian government is what I would call ‘kite-flying’: putting a message out to defuse a situation or to misdirect a situation.”
A dilemma for Apple
Silicon Valley companies have been pressured to overlook Indian government overreach before. This year, The Post found that both Facebook and X uncovered covert Indian military propaganda and calls for violence on their platforms, but executives hesitated to remove them. In both cases, executives at the companies’ India offices warned colleagues at the U.S. headquarters about the risks of clashing with the government and endangering their business.
But the confrontation between Apple and the Modi administration this autumn was more delicate for both sides and ended in a stalemate, according to industry analysts and people working with Apple.
For its part, Apple has been looking to India as a revenue driver as sales flatten in other markets. India is on track to account for 10 percent of Apple sales in 2025, up from 4 percent now, according to Wedbush Securities analyst Daniel Ives.
“India will be the heart and lungs of Apple’s strategy outside of China,” Ives said.
The Modi administration, meanwhile, doesn’t want to alienate a high-profile device manufacturer that it has been courting as part of its “Make In India” campaign to create factory jobs. That may have helped to blunt the government’s retaliation over the hacking warnings, people working with Apple said.
Although Apple India executives initially helped provide Modi government officials fodder for doubts about the warnings, Apple ultimately ceded less ground than its Silicon Valley peers have, according to people familiar with the events who noted that Apple issued no new statement after the November summit with Indian authorities.
“Apple is treading a very delicate line,” said Steven Feldstein, a fellow at the Carnegie Endowment for International Peace in Washington who studies the spyware industry. “It needs to stand up for digital rights and its core brand of protecting privacy, but it also doesn’t want to jeopardize its presence in an extremely important market.”
Rank-and-file Apple employees say that the company cannot afford to compromise on its commitment to making its devices as safe as possible in an era when crime and surveillance are surging. Last year, Apple introduced Lockdown Mode, an option that drastically reduces the number of electronic avenues that can be used to implant Pegasus or similar spyware. No infections have been discovered on phones running in Lockdown.
A multitude of internal signals factor into Apple’s determination that a country is behind a specific hacking attempt, and the chances of false alarms are small, former employees and people working with the company say. Apple has expanded its security and threat-research teams in recent years, hiring technologists with human rights backgrounds as well as intelligence agency veterans, and it conducts inquiries like a small intelligence agency itself. If it detects something unusual, it looks for the same activity elsewhere and then follows the leads to find more hacking techniques and victims.
With many hacking attempts, something outside the norm occurs. It can stand out as starkly as someone coming into a restaurant and ordering three desserts, then one entree, and then six appetizers, said a former Apple employee.
Apple sued NSO for allegedly hacking its infrastructure and began warning of state-sponsored attacks in November 2021, after the Forbidden Stories consortium exposed worldwide abuses. (Attacks on Android phones are also common, but they have a variety of manufacturers.) The Commerce Department blacklisted NSO that same month, barring it from deals with American companies.
The alerts have played a major role in exposing hacking activity, especially when those notified get their phones examined afterward. The discoveries have revealed hacking methods that can then be blocked, making it more expensive for those who sell the most powerful hacking tools, industry experts say.
“Apple’s warnings have fundamentally changed the game for finding spyware abuses,” said John Scott-Railton, a researcher at Citizen Lab. “Their warnings shift the power balance.”
The increased attention has elevated the issue to the White House, which this year pledged with allied governments not to buy from the companies whose tools were being abused by authoritarian regimes.
India is not among the governments that joined the pledge.
This year, there have been other signs of the Indian government hacking targets it perceives as threats.
In recent weeks, iVerify examined the phone of the New York-based Sikh separatist Gurpatwant Singh Pannun, who U.S. prosecutors say was targeted for assassination by an Indian official. IVerify engineers found severe crashes of his encrypted messaging apps that could have been triggered by hacking attempts, said chief executive Danny Rogers. Referring to activity of an encrypted messaging app during two days in July, Rogers said: “Eight Signal crashes in a row screams that someone is trying to hack you.”
Rogers said those crashes were not proof of a hacking attempt but were troubling because there was other evidence Pannun had been targeted. In May, Pannun was chatting over Telegram with an account belonging to Hardeep Singh Nijjar, a Sikh separatist based in Canada, Pannun told The Post. When the conversation seemed off and Pannun called Nijjar over the phone, Nijjar said he hadn’t used Telegram in a while. A few weeks later, on June 18, Nijjar was shot by masked gunmen in a parking lot — a slaying that Canadian Prime Minister Justin Trudeau announced in September was “credibly” linked to the Indian government.
Pannun told The Post that his own phones had been hacked twice before.
The U.S. State Department declined to address India’s alleged use of spyware directly. A spokesman said that the government “remains very concerned about the proliferation and misuse of commercial spyware, which is being used around the world to erode democratic values and to enable human rights abuses. We are committed to countering the misuse of this technology and the threats they pose, in partnership with allies around the world, and we welcome other like-minded partners to join us.”
Journalists still under fire
Officially, the Indian investigation of Apple continues, but people briefed on the matter said pressure on the company has waned. The next step is a report by India’s cybersecurity office, but it has no deadline. Indian media have reported that Indian officials now believe Apple’s warnings of state-sponsored hacking were genuine, but that the culprit may have been Beijing. While China is India’s great regional rival and a prodigious hacker, it has never been publicly linked to any use of Pegasus. The Israeli defense ministry must approve all sales of the spyware.
While tensions between Apple and New Delhi have eased, the journalists who faced hacking attempts continue to experience pressure.
In November and December, a third Indian journalist who has worked with OCCRP received phishing emails from a hacker who posed as a whistleblower seeking to leak corporate documents. The emails contained malware, according to OCCRP’s security team, which has not been able to identify the sender.
After the publication of their Adani investigation in August, Mangnale and Nair were summoned by the crime branch of the Ahmedabad city police force, in Adani’s and Modi’s home state of Gujarat, to respond to a complaint by a local investor who accused them of releasing a “grossly false and malicious” story about Adani. Ahmedabad police have also summoned two British reporters with the Financial Times, which collaborated with OCCRP on the investigation, as part of a preliminary inquiry.
A spokesperson for the FT declined to comment. The OCCRP said it has successfully appealed to the Indian Supreme Court to protect Mangnale and Nair from potential arrest, but the journalists are still fighting in court to avoid questioning by police.
At their first hearing on Dec. 1, the OCCRP journalists discovered a particularly high-powered lawyer was arguing the case on behalf of local police.
That lawyer was Tushar Mehta, the solicitor general of India.
Menn reported from San Francisco. Anant Gupta contributed to this report.
About this story
Design by Anna Lefkowitz. Visual editing by Chloe Meister, Joe Moore, Olivier Laurent and Jennifer Samuel. Copy editing by Christopher Rickett. Story editing by Mark Seibel. Project editing by Jay Wang.