Journalists probing the Salvadoran government and who worked on the Pandora Papers investigation were illegally surveilled by spyware for more than a year, a cybersecurity analysis has revealed.
More than half the staff of El Salvador’s news outlet El Faro had their cellphones attacked between July 2020 and November 2021, using spyware sold to governments, the analysis confirmed.
The University of Toronto’s cybersecurity laboratory The Citizen Lab and digital rights advocate group Access Now found that 22 El Faro staff members were targeted 226 times with the spyware Pegasus, made by Israeli company NSO Group. Among those hacked were editors, reporters, members of the board of directors and administrative personnel.
El Faro, an outlet that partnered with the International Consortium of Investigative Journalists on the Pandora Papers and other investigations, reported that the journalists’ cell phones were bugged around the times they were reporting and publishing major investigations about government actions. The analysis was conducted between September and December 2021. The cybersecurity investigators discovered that the cell phone of at least one reporter, Carlos Martínez, was attacked even while they were conducting the analysis.
In an editorial note to its sources, El Faro placed responsibility for the espionage on the government of El Salvador’s President Nayib Bukele. “We understand that our journalism has put us on a collision course with a president who has managed to gain control — in some cases, illegally — of all of the state institutions, who has destroyed every avenue for citizens to demand public information, and who dismisses any truth other than his own and any reality that differs from that which proclaims him the sole interpreter of national history,” the editorial said.
El Faro reporter Julia Gavarrete told the Committee to Protect Journalists, “My first impression was shock; suspecting you’ve been targeted isn’t the same as knowing. It hit me not only on a professional level, but also emotionally.”
Bukele’s communications office told Reuters that El Salvador is not a client of NSO Group and that his government is investigating the alleged cyber attack because some senior officials could also have been targeted.
Besides El Faro, thirteen other Salvadoran journalists and activists were targeted, the analysis found. Investigators explained that the “unprecedented” operation likely cost millions of dollars. The Citizen Lab and Access Now said in a report that their findings were independently verified by Amnesty International’s Security Lab.
NSO Group has said that it only sells the spyware Pegasus to governments and with the authorization of the Ministry of Defense of Israel, El Pais reported. The company told Forbidden Stories that the use of cyber tools to monitor dissidents and journalists is a misuse “of any technology” and should not be tolerated by the international community.
NSO Group has insisted that Pegasus was developed to combat terrorism and organized crime. But journalism investigations last year exposed how the software has been used by governments to spy on reporters and critics.
In November, journalists from six media outlets in El Salvador, including 12 staff members of El Faro, received an email from Apple warning that “attackers sponsored by the State”, might be spying on them through their cell phones. Apple sent the notification the same day it sued NSO Group.