A number of El Salvador-based journalists are suing the notorious makers of the prolific Pegasus spyware suite in US court, alleging the company sold the repressive Bukele regime’s spyware used to hack into their phones.
In the court case filed Wednesday in federal court in San Jose, Calif., attorneys representing journalists at the Central American media outlet Faro said Israel-based NSO Group sold the government of El Salvador the Pegasus software that was used to hack at least 22 people associated with their digital newspaper between mid-2020 and November 2021. Journalists claimed that this enabled the government to listen in and record the activities of journalists, even when they communicated with US embassy officials and found sources within the Salvadoran government.
Dual American and French nationality, and famous Central American journalist, Romain Gressier is just one of the names on the lawsuit. He said the new yorker that he was particularly concerned about the attacks because he is a member of the LGBTQ community. Gressier noted that pro-government activists could use this personal information to endanger his life and the lives of others, as these groups often face threats and acts of violence in the country, according to Human Rights Watch. Gressier said he was forced to leave El Salvador, fearing for his safety.
Pegasus software is particularly dangerous because it can be installed remotely without the user’s knowledge. The software then gives remote access to the user’s camera and voice input, allowing virtually unlimited monitoring even when the phone is not in use. The lawsuit claims that one of the journalists, Carlos Martinez, had his phone hacked for at least 269 days. The lawsuit said Martinez had to buy a new iPhone following the attacks.
The lawsuit cites a Citizen Lab report from this January showing that NSO’s Pegasus software had indeed hacked into the phones of 35 journalists from various news outlets around the country. The lab confirmed its data with Amnesty International’s Security Lab, finding that the phone hacks happened around the time there were major investigations into Salvadoran President Nayib Bukele, including reports he negotiated with the regularly violent MS-13 gang to reduce violence ahead of the election. Journalists backed up these reports with prison records confirming meetings between government officials and MS-13 leaders.
The Citizen Lab report notes that an agent they named TOROGOZ had worked exclusively with the Salvadoran government through a separate company linked to the ONS. Founder of the ONS Shalev Hulio has tried to plead the case before at 60 minutes for why it was A-OK to install spyware on reporters’ phones, somehow claiming that’s part of how drug lord Joaquin “El Chapo” Guzman was caught.
Although there is no excuse as to why Bukele wanted journalists’ phones tapped. The Salvadoran president is a notorious antagonist of the free press. Two years ago, he tweeted that El Faro and other outlets were publishing “opposition content”, adding “if there was any journalism left there, it’s gone”.
El Faro journalists are represented by the Columbia University’s Knight First Amendment Institute. Lawyers for the institute say this is the first time journalists have sued NSO Group in the United States over the company’s deployment of spyware. Alexander Abdo, the institute’s director of litigation, told Gizmodo in a phone interview that one of the main hopes of the lawsuit is that the US courts will compel the NSO Group, and by extension all spyware companies. mercenaries, to divulge which governments they are working for. If that happens, it could mean those contracts would dry up.
“It would limit their ability to do business with authoritarian regimes,” Abdo said.
In an email statement, a The NSO Group spokesperson told Gizmodo that Citizen Lab’s report was “biased” and that Citizen Lab and Amnesty International “recycle[d] intercourse with each other and knowingly release[d] speculative, inaccurate and incomplete reporting to the media. The mercenary spyware company further alleged that the two groups could not tell the difference between Pegasus and other spyware, although the company provided no evidence to support these claims.
The ONS spokesman did not address the lawsuit in his emailed statement.
NSO Group faced lawsuits from activists and other defenders who say they were targeted by governments deploying Pegasus spyware. Apple also sued spyware maker to try to prevent him from using his software to deploy his spyware. In 2021, the US government effectively blacked out the NSO Group by putting it on the “Entity List” for supplying spyware to foreign governments. The company’s finances would be in a desperate situation as he desperately tried to get back into the good graces of corporate America through a extensive lobbying campaign.
Separately, Greek journalist Thanasis Koukakis, who said his phone was hacked with competing spyware Predatoris to chase Spyware maker Cytrox, which is owned by another Israel-based company: Intellexa.