Fifteen journalists from digital news outlet El Faro of El Salvador have filed a lawsuit in a U.S. federal court against NSO Group, the Israeli company that manufactures Pegasus spyware. The journalists are asking the U.S. courts that the company reveal who is the customer that bought Pegasus and ordered the invasion of the journalists’ cell phones, revealed in January. They also demand that the company clarify what information was collected without the journalists' knowledge and what was done with it, and delete it from its servers.
"It is necessary to set a precedent so that the companies that promote this espionage market, as well as the clients that run this program, know that their actions have consequences," Julia Gavarrete, one of the journalists from El Faro who filed the lawsuit, told LatAm Journalism Review (LJR).
In January 2022, an investigation confirmed that dozens of journalists in El Salvador were the target of digital spying with spyware, installed on the professionals' cell phones without their knowledge. At least 22 people from El Faro, including journalists and administrative staff, were among the professionals spied on. The forensics showed that El Faro was under constant surveillance from June 29, 2020 to Nov. 23, 2021. In total, 226 tappings were performed on the digital media professionals' cell phones.
Julia Gavarrete, from El Faro (Photo: Víctor Peña)
Pegasus spyware allows remote access to all information on the phone, such as messages, photos and videos, as well as access to applications. It also allows microphones and cameras to be activated at any time and record what is happening around, without the person to whom the phone belongs being aware of it.
NSO Group claims to sell the program's license only to governments. The government of Nayib Bukele, president of El Salvador, maintains that “the government of El Salvador is in no way related to Pegasus and is not a client of NSO Group,” as stated in January by Sofía Medina, the president's communications secretary. She also said at the time that the government was investigating “a possible use” of the program in the country.
El Faro journalists are represented in the lawsuit by the Knight First Amendment Institute at Columbia University in New York City. The organization was founded in 2016 and is dedicated to defending “the freedoms of speech and the press in the digital age through strategic litigation, research, and public education,” according to their website. The organization says this is the first time journalists have filed a lawsuit against the NSO Group in a U.S. court.
Carrie DeCell, a senior attorney at the organization and one of the El Faro journalists' representatives in the case, told LJR that the Salvadoran digital media team was “the victim of one of the most extensive spyware attacks against journalists that we’ve seen around the world to date.”
“NSO Group has supplied spyware to authoritarian and rights-abusing regimes around the world, and these regimes have used that spyware against journalists, human rights activists, and political dissidents. The use of spyware by NSO Group and other mercenary spyware manufacturers thus poses one of the most urgent threats to press freedom—and to democracy more broadly—today,” she said.
DeCell said the suit was filed in a California state court because the spying via the Pegasus spyware “involved deliberate and sustained abuses of the U.S. infrastructure of U.S. technology companies—in this case, Apple.”
“NSO Group accessed Apple servers to develop the exploit used to deliver Pegasus to the plaintiffs’ phones. NSO Group and its clients may also have accessed Apple and other U.S.-based servers in order to extract data from the plaintiffs’ cloud-based accounts. And the spyware attacks against the plaintiffs clearly violated U.S. law,” she said.
Lawyers for the El Faro journalists have filed a petition to have this case heard along with another case against NSO Group filed by Apple. Apple's case is awaiting a decision by the U.S. Supreme Court on a petition by NSO Group in another case, filed by WhatsApp, in which the Israeli company claims "foreign sovereign immunity," DeCell said. The lawyer expects the Supreme Court to reject that petition in January 2023, which would allow the cases against NSO Group to progress in the U.S. courts.
“U.S. Courts have a crucial role to play in ensuring that spyware manufacturers like NSO Group are held accountable for the role they play in facilitating the persecution of journalists, particularly when that facilitation entails the abuse of U.S. technology,” she said.
DeCell stressed that the most important measure the journalists and their lawyers seek in this case is a court order requiring NSO Group to reveal who ordered the Pegasus attacks against El Faro professionals.
“Such an order would send a clear message to rights-abusing regimes around the world that they cannot get away with using spyware to silence the press, intimidate human rights activists, or crack down on political dissidents,” DeCell said.
Gavarrete, for his part, said that journalists in El Faro believe it would not be possible to get justice in El Salvador's courts, “taking into account that there is no independent Public Prosecutor's Office capable of carrying out a serious investigation to find out who is responsible for this espionage.”
“In addition, we believe it is important that NSO Group, being the company behind the design of Pegasus, also be held accountable for the abuses of the program by its clients. It is unacceptable that after so many outrages and hundreds of registered cases of human rights violations, NSO Group is not accountable either,” Gavarrete said.
In February, less than a month after the use of Pegasus against journalists was confirmed in El Salvador, the country's Legislative Assembly approved a reform of the Penal Code that created the figure of the "digital undercover agent.” This allows police officers to access electronic devices and collect data to be used as evidence in criminal proceedings. This reform was criticized by journalists and other civil society actors in the country, who claimed that it is the legalization of digital spying on Salvadoran citizens.
"El Salvador is a country where the use of a program as dangerous as Pegasus is confirmed and its government responds with reforms that enable more espionage under the excuse of "fighting crime". NSO Group says the same when it defends the use of its program, however, we know that it has been used to attack and persecute dissident voices and journalists. While the government of El Salvador says that journalists are not murdered in the country, it is not necessary to go as far as that when we confirm that a program like this has been used to attack us. The use of Pegasus confirms that both the press and freedom of expression are under attack,” she said.
Gavarrete also said that the discovery that they were being spied on via their own cell phones had significant impacts on the journalists' daily professional and personal lives.
“It changed our way of communicating with our sources, with our family and friends; it changed the way we should and must share information (...) our personal life was also affected by not being able to continue going or visiting the places we frequented regularly for fear of being followed. We cannot think that life goes on as normal, because it does not. We are aware that we must be careful of our movements because we are exposed to being publicly attacked. No one spies if it is not for the purpose of using this information to destroy and attack,” she said.
The lawsuit against NSO Group is a way to tell "hundreds" of Pegasus spyware victims around the world "that they are not alone," she said.
“Suing a company like NSO Group is not an easy decision to make, but it is necessary. Every year there are more and more cases of how spying tools like Pegasus are misused against journalists, activists and human rights defenders. We have known how journalists were victims of espionage when they were murdered,” Gavarrete said. “Lobbying from an international level through this type of lawsuits can help to stop this espionage industry that at the moment is expanding more and more because it knows it can act with impunity.”
