Journalists in El Salvador Targeted With Spyware Intended for Criminals

“It’s completely unacceptable to spy on journalists,” said Carlos Dada, founder and director of El Faro. “It endangers our sources, it limits our work and it also endangers our families.”

The cybersecurity watchdogs said 13 journalists from other Salvadoran news organizations were targeted as well. An El Faro journalist’s phone had been reinfected with the spyware over 40 times, the most persistent hacking attempt by Pegasus yet to be discovered.

“NSO Group’s tentacles continue to spread across the globe, crushing the privacy and rights of journalists and activists into oblivion,” said Angela Alarcón, who campaigns on Latin America and the Caribbean at Access Now. “Revelations that Pegasus software has been used to unjustly spy in El Salvador may not come as a complete surprise, but there is no match to our outrage.”

It remains unclear who was using NSO’s surveillance technology to spy on the journalists. El Salvador’s government denied responsibility, and a spokesperson with NSO Group would not say whether Pegasus spyware had been provided to El Salvador’s governments, past or present.

“The government of El Salvador is in no way related to Pegasus and is not a client of the NSO Group,” Sofía Medina, communications director for President Nayib Bukele of El Salvador, said in a statement.

“The government of El Salvador is investigating the possible use of Pegasus,” the statement added, before going on to describe a similar hacking attempt targeting Salvadoran government officials.

The development is the latest scandal to rock NSO Group, a prized Israeli technology company whose spyware has long been under scrutiny for its ability to capture all activity on a smartphone — including a user’s keystrokes, location data, sound and video recordings, photos, contacts and encrypted information — and for mounting allegations of misuse by repressive governments.

In August, it was revealed that Pegasus had been secretly installed on the smartphones of at least three dozen journalists, activists and business executives across the world, including close associates of murdered Saudi journalist Jamal Khashoggi. In Mexico, it was used against influential journalists and others.

The Biden administration blacklisted NSO Group in November, stating that the company had knowingly supplied spyware used by foreign governments to “maliciously target” the phones of human rights activists, journalists and others.

The measure was a notable break with Israel, a U.S. ally, as the company is one of Israel’s most successful technology firms and operates under direct surveillance of the Israeli government.

After the U.S. government blacklisted NSO Group, the company promised that Pegasus was only licensed to governments with good human rights records.

But in December it was announced that the iPhones of 11 U.S. Embassy employees working in Uganda had been hacked using Pegasus spyware.

In an emailed statement, a spokesperson for NSO Group, who declined to provide their name, maintained the company only provides its software to legitimate intelligence agencies and to law enforcement agencies to fight criminals and terrorists.

The spokesperson added that the company does not know who the targets of its customers are but that NSO works to ensure that its tools are used only for authorized purposes.

Israel’s Defense Ministry is in charge of regulating and approving exports of NSO’s software. The Israeli military has also been criticized for its human rights violations at home and abroad.

While it remains unclear what entity targeted the Salvadoran journalists, El Salvador has been criticized for intimidating and censoring local media.

Bukele has come under withering criticism from the U.S. government and rights groups for using the military to interfere with the legislature and to suspend Supreme Court judges and the attorney general.

(Author: Maria Abi-Habib)/(c.2021 The New York Times Company)