Telephone Spyware Targets El Salvador’s Independent Journalists

January 14, 2022

At least 22 collaborators with the digital news site El Faro were hacked 226 times by the Pegasus spyware, between July 2020 and November 2021.

By Confidencial

HAVANA TIMES – The cellphones of journalists and human rights advocates in El Salvador were infected with the invasive Israeli Pegasus spyware, according to an investigation carried out by two international organizations and confirmed by Amnesty International (AI).

“A joint investigation through Access Now, an organization that advocates for the protection of digital rights, and Citizen Lab, a University of Toronto laboratory specializing in cybersecurity, has identified the broad use of the Pegasus spyware program in El Salvador. The invasive program, developed by the Israeli NSO Group Technology, targeted journalists and members of civil society organizations in the Central American country. The information was confirmed recently by Amnesty International in a press conference.

The Pegasus program infects and harvests information from all activities conducted on a smartphone, including the user’s location, the sites they visit and their personal contacts. In addition, these technological tools can convert the user’s personal telephone into a vehicle for secret recording.

Amnesty International added: “Technical experts from Amnesty International’s Security Laboratory have reviewed the report and independently verified the forensic evidence demonstrating the abusive use of Pegasus in [El Salvador]”

Program carried out between 2020 and 2021

AI recalled that in November 2021, “the public was made aware that journalists and members of certain civil society organizations received an alert from Apple, warning them that they may be subjects of selective surveillance by government-sponsored attackers.”

Amnesty International was able to verify this, via a sampling that “included a number of journalists from two media outlets.”

“The forensic analysis confirmed that each device was infected with the NSO Group’s Pegasus spyware,” AI noted, adding: “the first indications of attacks on the devices in the sampling came around July 30, 2020.” Further, “signs of threat or attempts at attack continued up until November 15, 2021.”

The Citizen Lab report states that they succeeded in confirming “35 cases of journalists and members of civil society whose telephones had been successfully infected with NSO’s Pegasus spyware between July 2020 and November 2021.”

The report detailed: “Objectives included journalists from [independent media sites] El Faro, GatoEncerrado, La Prensa Grafica, Revista Digital Disruptiva, Diario El Mundo, El Diario de Hoy, and two freelance journalists.” Others infected belonged to the organizations Fundacion DTJ, Cristosal, and other NGO’s.

“The hacking took place when the organizations were reporting on delicate topics involving the administration of Salvadoran President Nayib Bukele. For example, a scandal related to the government’s efforts to negotiate a “pact” with the MS-13 gang to reduce violence and thus increase [the president’s] electoral support,” states the report. The full text can be found at www.citizenlab.ca.

Case of El Faro

The online Salvadoran news site El Faro denounced that the telephones of 22 journalists with the site were infected with Pegasus. “From editorial heads, to journalists, to Board members and administrative personnel, the entire team was under constant surveillance between at least June 29, 2020 and November 15, 2021. There was a total of 226 hacks, including evidence of an operator monitoring the Pegasus program from a base in Salvadoran territory.”

Bukele’s government has maintained constant harassment and attacks on the El Faro digital site, whose journalistic investigations have revealed – among other things – the clandestine negotiations between the Salvadoran president and the country’s large gangs, as well as other cases of government corruption.

In September 2020, Bukele “announced a criminal investigation” being launched against El Faro, supposedly for “money laundering” and “tax evasion”. This decision followed the digital newspaper’s revelations of government negotiations with the Mara Salvatrucha (MS13) gang.

El Faro explained that the period of telephone surveillance ranged from one day to a year under constant attack. “In other words, there were 17 months of continual spying, with total access to the smartphone devices of over half the news site’s employees. The specific dates coincide with different investigations undertaken by El Faro, and with relevant events in national political life, or with government attacks launched against the site.”

“In 11 of the cases involving the media outlet’s employees, the investigation found conclusive evidence of hacks and intervention with the device. In another 11 cases, the investigation concluded that, in addition, information was extracted. The inquiry wasn’t able to determine what kind of information was copied, but the Pegasus program allows the extraction of anything at all that’s on the telephone: photos, conversations, audio content, contacts. The investigation didn’t discount the possibility that information was also stolen from the other telephones, but in the former 11 cases it was able to fully confirm that this had occurred,” states a note on the site.

A new threat

“The use of Pegasus to tap communications in El Salvador reveals a new human rights threat in the country,” said Erika Guevara Rosas, Amnesty International’s Americas Director.

She added: “Authorities should cease all efforts aimed at restricting freedom of expression and carry out an impartial and exhaustive investigation to identify those who may be responsible.”

“It’s unacceptable that in El Salvador, denunciations of harassment and threats against journalists and those defending human rights have increasingly become everyday occurrences. They’re working in a hostile environment, and are at great risk,” Erika Guevara emphasized.

In their annual report, Human Rights Watch found that Bukele and his allies in Congress “have undermined the basic democratic checks and balances” in 2021. The report included the Salvadoran president among new “leaders with autocratic tendencies” in the world.

The organization’s report cited 173 denunciations of attacks against press freedom, principally carried out by government agents. The denunciations were originally collected by the El Salvador Journalists’ Association.

“Since assuming office, President Bukele has undermined the credibility of the independent media outlets, accusing them of spreading ‘fake news’ or of serving political interests,” the Human Rights Watch report highlighted.