By Theo Werner (*)
Attorneys for the Knight First Amendment Institute at Columbia University are hopeful that Pegasus manufacturer NSO Group will be held accountable in their lawsuit on behalf of Salvadoran journalists. Reporters from the news site El Faro believe the suit will set an important precedent for the protection of journalists across the globe.
“We expect this to open a door so that colleagues all around the world find tools to defend themselves,” said Carlos Dada, co-founder and director of El Faro, at a conference in New York City on Wed., Feb. 8.
The conference, “Spyware and the Press,” was hosted by the Knight Institute at Columbia University to discuss a lawsuit filed against Israel-based NSO Group in November 2022. The suit concerns the alleged use of NSO Group’s Pegasus spyware in the hacking of the cell phones of 15 members of El Faro, including 13 journalists. Reporters for El Faro are working with the Knight Institute in order to advance the lawsuit in U.S. courts. Tech giants WhatsApp and Apple are also suing NSO Group in separate cases.
One of the main challenges that victims of Pegasus face is the NSO Group’s policy to not disclose its clients. The most that NSO Group will reveal is that it only sells to governments. It has also said that "data is collected only from...suspected criminals and terrorists." In the case of the El Faro attacks, members of the research group Citizen Lab reported that they traced the origin of the hacking to El Salvador. In response to this finding, the Salvadoran government denied using Pegasus. Because NSO Group will not disclose its buyer, it is difficult to prove the Salvadoran government’s involvement.
“It is a government and it is in El Salvador, that is as far as we can go,” Dada said. “There are not too many choices.”
Attorneys for the Knight Institute say they believe U.S. courts will find NSO Group in violation of U.S. law and order NSO Group to disclose the client to whom it sold the software. With that order, they believe that governments will be more hesitant to purchase the software. Additionally, they believe that NSO Group will be more cautious of who it sells to if they are subject to U.S. law.
“It will send a message to other government actors around the world that they can’t rely on NSO Group’s assurance of secrecy,” Carrie DeCell, senior staff attorney at the Knight Institute, said at the conference.
Another challenge for victims of Pegasus is that NSO Group has made extensive efforts to claim foreign sovereign immunity. This would allow NSO Group to operate on behalf of a foreign government, meaning the company would be immune to litigation in U.S. courts.
In the 2019 WhatApp lawsuit, NSO Group attempted to dismiss the lawsuit on sovereign immunity grounds. A California district court rejected this attempt, prompting NSO Group to appeal first to the Ninth Circuit Court of Appeals and then to the U.S. Supreme Court. In January 2023, the Supreme Court ruled that NSO Group was not entitled to sovereign immunity, opening the door to future lawsuits against the company.
All lawsuits against NSO Group in the U.S. are based on the 1986 Computer Fraud and Abuse Act. This law prohibits anyone from accessing a computer without authorization or in excess of authorization. However, the law is not very specific regarding what constitutes authorization.
Oftentimes, computer viruses and spyware require that a person initiate the malware by clicking on something, such as a link. What makes Pegasus so hard to trace is that it is largely undetectable. Most victims are unaware their device has been compromised until it is too late. The lawsuits against NSO Group argue that because there is no way for a user to detect the hacking, it should be considered a lack of authorization.
In a press release, Apple announced it found that Pegasus would anonymously download itself onto a user’s device by creating an Apple ID that would send malicious data to the device. Apple claims to have fixed this issue with operating systems iOS 15 and newer, though it notes that spyware technology is continually evolving. It said it is also making efforts to notify users it finds to have been compromised by Pegasus and other spyware.
Although NSO Group claims to only sell its spyware to governments, there has been a rise in other spyware companies that market to a larger audience, including jealous spouses. Earlier this month, the New York Attorney General’s Office announced it has fined one developer, Patrick Hinchy, for the illegal promotion of his 16 spyware companies.
“The genie is not going back into the bottle,” said Ronan Farrow, investigative reporter for The New Yorker, at the Knight Institute conference. “This technology is getting more and more accessible, and cheaper.”
While the Apple and WhatsApp lawsuits concern the protection of technology corporations, the El Faro lawsuit is the first to be filed on behalf of journalists. Apart from protecting press freedom globally, the El Faro suit concerns many U.S. security interests. In addition to many readers of El Faro being located in the U.S., part of El Faro’s compromised information included conversations with U.S. Embassy officials. Furthermore, some of the hacked journalists were U.S. citizens, including Roman Gressier, who at the time had been living in El Salvador and Guatemala.
In countries like El Salvador, bringing a lawsuit against NSO Group is highly unlikely to be successful. Dada adds that governments of countries that utilize spyware are unlikely to take action against themselves, even within the European Union. Notably, countries such as Spain and Poland have recently admitted to using Pegasus. Even the U.S. Federal Bureau of Investigation had purchased the software, though it has since been blacklisted by the Biden Administration.
Until an international organization is established to regulate spyware, the U.S. courts and others will help secure privacy around the world. Other journalists are already looking to follow in the footsteps of El Faro. Hanan Elatr Khashoggi, wife of murdered Saudi journalist Jamal Khashoggi, announced her plans to sue NSO Group in U.S. courts over the alleged role of Pegasus in her husband’s killing. France has also initiated criminal proceedings against NSO Group on behalf of journalists.
Given the lengthy process of a lawsuit in U.S. courts, results of the El Faro case are not expected anytime soon. However, the Knight Institute is pleased with the progress of other lawsuits against NSO Group and the future of cyber protection.
“That’s a great kind of initial victory for these kinds of lawsuits in the United States and really clears the path forward,” DeCell said.
–
(*) Theo Werner is a Journalism student at the University of Texas, reporting for the Press Freedom in Latin America class. Theo began his career with The Daily Texan and has freelanced for a number of publications. Theo carries with him the core principles of journalism, putting verification and transparency above everything.
