Thirty journalists and employees of six Salvadoran news organizations had their phones hacked with Pegasus spy software, according to an investigation by Citizen Lab. The program was developed by the Israeli company NSO Group and acquired by various governments to allegedly investigate organized crime and terrorism. However, many of them used it to monitor opponents, human rights activists, and critical journalists.
Citizen Lab, a cybersecurity laboratory at the University of Toronto, made the findings with the participation of Access Now, an organization that monitors the protection of digital rights. The media outlets affected are the website El Faro, the magazine Gato Encerrado, the digital magazine Disruptiva and the newspapers La Prensa Gráfica, Diario El Mundo and El Diario de Hoy.
El Faro, one of the most important outlets in the country and internationally recognized for impactful investigations, was the main target: 22 journalists and administrative employees were hacked, out of a total team of 34 people. The expertise showed that El Faro was under constant surveillance from June 29, 2020 to Nov. 23, 2021. In total, 226 interventions were carried out.
“We were not surprised to learn that we were hacked, but rather the number, frequency, and duration of these interventions. Almost all of El Faro has been hacked. Everything points, according to the expert reports we have analyzed, that the person responsible for these interventions is the Salvadoran government, which is using the software to spy on and illegally obtain information from journalists' phones. It is completely unacceptable,” El Faro founder and director Carlos Dada said.
According to The New York Times, the Salvadoran government denied responsibility for the spying. Additionally, the NSO Group would not say if its spyware had been provided to past or present Salvadoran governments. It told El Faro and Gato Encerrado that using cyber tools to monitor journalists is a misuse of the technology.
Dada's phone was hacked a total of 12 times. On the other hand, the phone number that recorded the most intrusion was that of the editor-in-chief Oscar Martinez: 42. He is the one who, by the nature of his role, is aware of all the investigations in progress. Another seven journalists from El Faro had their phones hacked more than ten times.
Hacking periods range from a day to a year under constant attack. In other words: 17 months of continuous spying with full access to the phones of more than half of the staff who work for this newspaper, on specific dates that coincide with different investigative processes at El Faro and with relevant events in national or governmental political life, attacks on the newspaper.
“During the time that the events occurred, these journalists carried out investigations about negotiations between the Government and gangs, the theft of food meant for the pandemic by the director of Penal Centers and his mother, the secret negotiations of Bukele's brothers for the implementation of Bitcoin, the assets of current Government officials, the handling of the pandemic and a profile of President Bukele,” El Faro wrote.
“The reporters tried to meet in-person with sources and use encrypted messaging, but the government always seemed to know what they were doing. Now we have an explanation. We were hacked,” Martínez told The Washington Post. “The whole newsroom is going to continue to investigate. We will continue with this, have no doubt.”
In 11 of the cases, experts concluded that newspaper employees had their phones hacked. In the other 11, the experts concluded that there was also data extraction. The expert report was unable to determine what type of information was removed from the phones, but the access provided by Pegasus allows extracting whatever is on the phone, such as photos, conversations, audio, and contacts. The expert report does not rule out the possibility that information was stolen from the other phones, but it was able to conclude without reservations that this occurred in 11 cases.
"This is one of the most shocking and obsessive espionage cases we have investigated," John Scott-Railton, senior researcher at Citizen Lab, told El Faro. “Millions of dollars were spent on this spy tool (in the case of El Faro); but instead of being used to fight crime, the licenses were used hundreds of times to monitor journalists."
On Nov. 23, Apple had emailed 12 El Faro employees with a warning that they might have been targeted by state-sponsored espionage. At the time, the company said, "These attackers are likely targeting you individually because of who you are or what you do. If your device is compromised by a state-sponsored attacker, they may be able to remotely access your sensitive data, communications or even the camera and microphone.”
After El Faro, the second Salvadoran media outlet with the most intrusions is the magazine Gato Encerrado, which specializes in journalistic investigations. Three journalists from the outlet had their phones hacked, according to the Citizen Lab analysis.
“The dates on which Citizen Lab confirmed a successful hack and a successful information extraction coincide with key periods of journalistic exercise and development of investigations that, in some way, affect the image of the government of President Nayib Bukele,” Gato Encerrado wrote.
The other 17 hacks took place on the phones of a journalist from El Diario de Hoy (10), one from Diario El Mundo (2), from the digital magazine Disruptiva (2), from the newspaper La Prensa Gráfica (1) and an independent journalist (2).
Salvadoran press under pressure
In response to the revelation of spying on Salvadoran journalists, 15 international organizations, media outlets and individuals called in a letter for a serious investigation by the Salvadoran authorities. Among the organizations are the Committee to Protect Journalists, Article 19 and Amnesty International.
“Nayib Bukele’s hostile treatment of the media began early in his presidency, when, during the first months of his term, he generally avoided giving press conferences. Instead, he used his personal Twitter account to issue orders, fire public officials, and harass journalists, who he often arbitrarily categorizes as ‘political activists.’ The Salvadoran government has repeatedly harassed El Faro and Gato Encerrado journalists in particular,” the statement read.
Critical investigative journalism by El Faro and Gato Encerrado, and other media, is a thorn in the side of Salvadoran President Nayib Bukele, who has been in power since 2019. A few months after the new government took office, journalists in El Salvador warned of a lack of access to official sources and little tolerance by the new government for criticism. A year later, Bukele announced a tax audit of media accounts, accused of money laundering. In response, 600 journalists and intellectuals from 47 countries signed a letter in defense of El Faro and sent it to the Office of the Special Rapporteur for Freedom of Expression of the Inter-American Commission on Human Rights (IACHR).
In January 2021, the IACHR granted precautionary measures of protection to 34 journalists and employees of El Faro, “subjected to harassment, threats, intimidation and stigmatization - mainly through social networks - because of their journalistic activities.” The commission understood that professionals are “in a situation of gravity and urgency of risk of irreparable damage to their rights.”
Project Pegasus
The revelation that Salvadoran journalists were also targets of spying comes six months after the first reports of Project Pegasus, a transnational collaborative investigation that revealed how governments in 10 countries used NSO Group software to spy on journalists, political opponents and human rights defenders. Eighty journalists from 17 media outlets in ten countries participated in the original investigation, based on 50,000 phone numbers obtained by Amnesty International and Forbidden Stories. In Latin America, reporters from Aristegui Noticias and Proceso, from Mexico, were part of the team.
Based on reports from Project Pegasus, Reporters Without Borders (RSF, for its acronym in French) denounced the NSO Group in French courts and at the UN. Nineteen journalists from seven countries are part of the complaint. Their phones appear on the Israeli company's customer target list. From Mexico, at least five journalists were spied on: Marcela Turati, Alejandra Xanic Von Bertrab, Ignacio Rodriguez Reyna, Jorge Carrasco and Alvaro Delgado.
In November, Mexico's public prosecutor’s office announced the arrest of a person allegedly involved in spying on a journalist with Pegasus. Juan Carlos G., as identified by the authorities, is accused of intervening in private communications without a mandate from a judicial authority, with the aggravating factor of having been committed against a journalist “with the aim of affecting, limiting and undermining her freedom of expression,” the Associated Press reported.
