President Nayib Bukele of El Salvador speaks to members of the media in Washington, D.C., U.S., on Tuesday, May 7, 2019. Photo: Andrew Harrer/Bloomberg via Getty Images
Journalists from an investigative news outlet in El Salvador filed a lawsuit this week in U.S. federal court against an Israeli company for allegedly infecting their phones with malicious spyware that allowed its operators unfettered access to their lives and work.Developed by Israeli-based NSO Group, Pegasus is considered the world’s most powerful cyberweapon. Once installed on a target’s phone, the spyware can monitor and extract contact lists, text messages, search histories and GPS locations, copy passwords to cloud-based accounts, and turn on the phone’s microphone and camera to record conversations and take photographs—all without detection. The spyware can be installed remotely without the cell phone user clicking on a single link. “The attacks have compromised Plaintiffs’ safety as well as the safety of their colleagues, sources, and family members,” according to the lawsuit, which was filed on Wednesday in U.S. District Court in the Northern District of California by journalists from the El Faro news outlet. The journalists believe El Salvador’s government purchased the spyware and is behind the attacks. Many of the infiltrations occurred while they were communicating with confidential sources, including U.S. Embassy officials, about abuses by the Salvadoran government of President Nayib Bukele and his relationship with the Central America nation's powerful MS-13 street gang, they say. But Bukele’s government has denied responsibility. NSO Group maintains Pegasus is intended to combat crime and terrorism and only sold to government or law enforcement organizations.
The lawsuit accuses NSO Group of violating the Computer Fraud and Abuse Act, a 1986 U.S. federal law that makes it illegal to access a computer without authorization, as well as a related California law. It also asks the court to require NSO Group to detail the information it collected as a result of the Pegasus attacks on the El Faro journalists, to return and delete the information, and to disclose the names of NSO’s Group’s clients who were involved in the Pegasus attacks. Between June 2020 and November 2021, at least 22 people associated with El Faro had their cell phones infiltrated with Pegasus, according to a technical analysis by Citizen Lab, a cybersecurity watchdog, that was validated by researchers at Amnesty International. They determined that one El Faro reporter who was investigating secret negotiations between the Salvadoran government and powerful street gang MS-13 had his cell phone infected with Pegasus for at least 269 days. El Salvador’s government has denied it negotiated with gangs.A spokesman for NSO Group denied all the allegations laid out in the lawsuit, including findings that Pegasus was used to infiltrate the journalists’ cell phones.“These intentionally biased reports have repeatedly proven to be false, lack any independent verification and rely on probabilities and circumstantial protocols rather than on actual forensics and evidences,” a spokesman wrote in a statement to VICE World News. “In fact, Citizen Lab and Amnesty are unable to differentiate between NSO’s tools and those of other cyber intelligence companies in operation and mislead the public.
“NSO is a software provider, the company does not operate the technology or is privy to the collected data. The company does not and cannot know who the targets of its customers are.” Óscar Martínez, El Faro’s editor-in-chief, said he hopes the U.S. lawsuit yields information about who hacked his cell phone. “What agency of the Salvadoran government approved this? I want to know details. How much public money did they spend buying this spyware? Who has information about my private life? That’s what we are looking for.”El Faro has accused Bukele of launching a campaign of “harassment, attacks, censorship and threats” against it. The president frequently attacks El Faro on Twitter and has sought criminal investigations into its journalists. He also pushed through a vaguely worded law that makes sharing information about gangs punishable with up to 15 years in prison. Multiple journalists from the outlet have fled the country because of the ongoing threats from Bukele and his supporters.Roman Olivier Gressier, an America citizen who reports for El Faro, said he and the other journalists filed the lawsuit in U.S. court because they don’t trust the Salvadoran justice system. “Pegasus is the tip of a spear of an industry that is going to keep expanding and finding new ways to operate and infect devices like ours,” said Olivier Gressier, who was among those targeted with Pegasus spyware, according to the Citizen Lab analysis. “It’s important to send strong signals that you can't hide illegal activity under the guise of national security and quote unquote combating crime.”
The journalists are being represented by lawyers with Knight First Amendment Institute at Columbia University and California-based Schonbrun, Seplow, Harris, Hoffman & Zeldes. Facebook, now known as Meta, sued NSO Group in October 2019 and accused it of accessing WhatsApp servers without permission in order to install Pegasus spyware on victims’ phones. NSO Group has asked the U.S. Supreme Court to intervene on its behalf and recognize the company as a foreign government agent with “sovereign immunity.” Apple also sued NSO Group in December 2021 for abusing its products. It’s seeking to ban the company from using any Apple software, device or server. Both lawsuits are ongoing.
Advertisement
The lawsuit accuses NSO Group of violating the Computer Fraud and Abuse Act, a 1986 U.S. federal law that makes it illegal to access a computer without authorization, as well as a related California law. It also asks the court to require NSO Group to detail the information it collected as a result of the Pegasus attacks on the El Faro journalists, to return and delete the information, and to disclose the names of NSO’s Group’s clients who were involved in the Pegasus attacks. Between June 2020 and November 2021, at least 22 people associated with El Faro had their cell phones infiltrated with Pegasus, according to a technical analysis by Citizen Lab, a cybersecurity watchdog, that was validated by researchers at Amnesty International. They determined that one El Faro reporter who was investigating secret negotiations between the Salvadoran government and powerful street gang MS-13 had his cell phone infected with Pegasus for at least 269 days. El Salvador’s government has denied it negotiated with gangs.
Advertisement
“NSO is a software provider, the company does not operate the technology or is privy to the collected data. The company does not and cannot know who the targets of its customers are.” Óscar Martínez, El Faro’s editor-in-chief, said he hopes the U.S. lawsuit yields information about who hacked his cell phone. “What agency of the Salvadoran government approved this? I want to know details. How much public money did they spend buying this spyware? Who has information about my private life? That’s what we are looking for.”El Faro has accused Bukele of launching a campaign of “harassment, attacks, censorship and threats” against it. The president frequently attacks El Faro on Twitter and has sought criminal investigations into its journalists. He also pushed through a vaguely worded law that makes sharing information about gangs punishable with up to 15 years in prison. Multiple journalists from the outlet have fled the country because of the ongoing threats from Bukele and his supporters.Roman Olivier Gressier, an America citizen who reports for El Faro, said he and the other journalists filed the lawsuit in U.S. court because they don’t trust the Salvadoran justice system. “Pegasus is the tip of a spear of an industry that is going to keep expanding and finding new ways to operate and infect devices like ours,” said Olivier Gressier, who was among those targeted with Pegasus spyware, according to the Citizen Lab analysis. “It’s important to send strong signals that you can't hide illegal activity under the guise of national security and quote unquote combating crime.”
The journalists are being represented by lawyers with Knight First Amendment Institute at Columbia University and California-based Schonbrun, Seplow, Harris, Hoffman & Zeldes. Facebook, now known as Meta, sued NSO Group in October 2019 and accused it of accessing WhatsApp servers without permission in order to install Pegasus spyware on victims’ phones. NSO Group has asked the U.S. Supreme Court to intervene on its behalf and recognize the company as a foreign government agent with “sovereign immunity.” Apple also sued NSO Group in December 2021 for abusing its products. It’s seeking to ban the company from using any Apple software, device or server. Both lawsuits are ongoing.