The Washington PostDemocracy Dies in Darkness

Report: 22 journalists at Salvadoran news site hit with Pegasus hack

An NSO Group branch near the southern Israeli town of Sapir. (Sebastian Scheiner/AP)
Placeholder while article actions load

At least 22 journalists from the independent Salvadoran news site El Faro were targeted with telephone spyware, investigators announced Wednesday, in one of the most extensive attacks yet discovered using the Pegasus software that human rights advocates say has been abused by governments around the world.

The journalists were among at least 35 people in El Salvador whose iPhones were hacked with Pegasus between July 2020 and November 2021, according to an analysis by the Toronto-based Citizen Lab and other groups. Also targeted were human rights activists and reporters for other news organizations.

Some devices were penetrated a dozen or more times, the investigators said. Óscar Martínez, El Faro’s news editor, was hacked 42 times, they said. The digital news site is known for its hard-hitting investigations into the government of President Nayib Bukele.

“This is jaw-droppingly aggressive and persistent targeting,” said John Scott-Railton, a senior researcher for Citizen Lab, at the University of Toronto’s Munk School of Global Affairs and Public Policy. “El Salvador’s media environment is under tremendous threat at the moment.”

The U.S. accuses El Salvador of a secret pact with gangs to tamp down killings

Citizen Lab analyzed forensic information from the victims’ phones in a joint investigation with digital rights group Access Now, and their conclusions were vetted by Amnesty International’s Security Lab. Citizen Lab found what it called “circumstantial evidence” that the hacks originated from Bukele’s government, but the attribution was not definitive. The government did not respond to an emailed request seeking comment. In a statement to the New York Times, the government denied responsibility and said it was not a client of the Israeli-based NSO Group, the creator of Pegasus.

The 40-year-old Bukele, a charismatic politician known for his leather jackets and Twitter salvos, won the presidency in a landslide in 2019 by presenting himself as a corruption-fighting outsider. He has grown steadily more authoritarian in office, dismissing Supreme Court rulings and attacking journalists. A senior U.S. diplomat, Jean Manes, expressed concern last year about a “decline in democracy” in the Central American country.

The NSO Group says it licenses Pegasus only to vetted government clients — typically, law enforcement and intelligence agencies — to investigate terrorism and other serious crimes. Pegasus allows its operators to remotely control smartphones, allowing the collection of location records, files, photographs, recordings, contact lists, emails, passwords and encrypted communications.

The cases in El Salvador add to the findings of the Pegasus Project, an international consortium of 17 news organizations, including The Washington Post, on abuses of the spyware. Consortium members reported last year that NSO Group clients had, in some cases, used or attempted to use Pegasus against journalists, academics, political figures, human rights activists, diplomats and business leaders. The U.S. Commerce Department blacklisted the NSO Group in November because of the misuse of Pegasus.

Takeaways from the Pegasus Project

The NSO Group said in a statement Wednesday: “While we have not seen the report mentioned in your inquiry, and without confirming or denying specific customers, NSO’s firm stance on these issues is that the use of cyber tools in order to monitor dissidents, activists and journalists is a severe misuse of any technology and goes against the desired use of such critical tools.”

NSO said it “does not operate the technology” and doesn’t know the identities of customers’ targets. It added: “NSO has proven in the past it has zero tolerance for these types of misuse, by terminating multiple contracts.” A person familiar with company operations, speaking on the condition of anonymity to discuss sensitive matters, said El Salvador has no “active system” from the NSO Group, and the company will investigate the new allegations.

El Faro has produced some explosive exposes. In September 2020, the news site reported that the Bukele government had secretly negotiated a deal in which the MS-13 gang would refrain from bloody public murders and channel votes to the ruling party in exchange for benefits for its incarcerated leaders. The Biden administration recently made a similar allegation. It has been denied by Salvadoran authorities.

Bukele has regularly assailed El Faro. His government has accused the news site of tax evasion and money laundering — charges it denies — and deported a Mexican journalist, Daniel Lizárraga, working as its editor. Last year, the Inter-American Commission on Human Rights called for security measures to protect 34 journalists at El Faro, saying their “right to life and personal safety was at risk.”

Martínez, the news editor, said the journalists had endured two years of government harassment, and many of their relatives had urged them to quit. “People are very stressed,” he said. The reporters tried to meet in-person with sources and use encrypted messaging, but Martínez said the government always seemed to know what they were doing. “Now we have an explanation,” he said. “We were hacked.”

The investigation into the phone surveillance began last year, when journalists tested their devices using a tool provided by Amnesty International to detect possible hacks. The journalists then contacted Access Now. Front Line Defenders, another research group, also worked on the case. In November, Apple alerted 23 Salvadoran journalists and several civil society activists that their devices might have been targeted by state-sponsored attackers.

Martínez said the El Faro journalists were upset to learn of the cyberattacks, but no one had quit. “The whole newsroom is going to continue to investigate,” he said. “We will continue with this, have no doubt.”

Alejandra Ibarra Chaoul contributed to this report.

Read more:

How Mexico’s traditional political espionage went high-tech

Biden administration blacklists NSO Group over Pegasus spyware

Central American leaders resisting Biden’s anti-corruption efforts