Journalist Sues NSO After Being Hacked By Pegasus Spyware

December 5, 2022 TH Author headline,privacy,malware,phone,fraud,israel,spyware

I was warned in August 2020. A source told me to meet him at six o’clock at night in an empty parking lot in San Salvador. He had my number, but he contacted me through a mutual acquaintance instead; he didn’t want to leave a trace. When I arrived, he told me to leave my phone in the car. As we walked, he warned me that my colleagues at El Faro, the Salvadoran news organization, were being followed because of a story they were pursuing about negotiations between the president of El Salvador and the notorious MS-13 gang.

This may read like an eerie movie scene, but there are many Central American journalists who have lived it for real. The suspicion you’re being followed, ditching your phone before meetings, using encrypted messaging and email apps, speaking in code, never publishing your live location – these are ordinary routines for many in my profession.

I wouldn’t know until more than a year later what my source really meant. My colleagues weren’t just being trailed as they investigated that story. They, and at least 18 other members of El Faro – including me – had been the repeated targets of a weapons-grade espionage software called Pegasus. Pegasus is the gleaming toy of the Israel-based spyware firm NSO Group. Forensic analysis by the Citizen Lab and others found that Pegasus attacks in El Salvador started in June 2020 and continued until November 2021. In all, 35 journalists and members of civil society were spied on with this tool.

When you’re infected by Pegasus, spies effectively hold a clone of your phone. They can see everything, from your personal pictures and texts to your purchases and your selection and use of apps. When the spying was discovered I had to take measures that included exiting my family group chat and deleting my banking apps.

For journalists, this means spies can see every chat and phone call with our sources. I was hacked while I pursued and published private videos of two brothers of President Nayib Bukele negotiating over El Salvador’s Bitcoin Law with foreign businessmen before it came into effect. My colleagues Gabriela Cáceres and Carlos Martínez were hacked as they continued to reveal more details about the government’s dealing with gangs and a thwarted criminal investigation about it. I could go on and on.

Journalism has become even harder after the attacks. When news of the hacking broke, a few sources jokingly answered our calls by greeting the good people who might be listening. But many more picked up the phone only to say we should stop calling them, and most simply didn’t respond at all. In one instance, a source told me that he now understood why his wife had been fired from her government position. I felt horrible. Guilty. Powerless.

That’s how Pegasus makes you feel above all: powerless. We believe the infections in El Faro happened through a “zero-click exploit”, meaning we didn’t even click on a phony link to open a door for the spies. They just broke in. Change your number, get a new device – they’ll just break in there, too.

And yet we refused to be powerless. We told our story to news outlets all over the world. In El Salvador, we held press conferences, went on TV and filed a case before the attorney general’s office. None of this brought any kind of accountability for the illegal spying. So, represented by the Knight First Amendment Institute at Columbia University, 14 of my colleagues at El Faro and I have decided to sue NSO Group.

I can assure you we’re not in this for the money: if we wanted to be rich, we wouldn’t be independent journalists. We’re doing this as a progression of our everyday work in El Salvador to expose official wrongdoing. We’re doing this in the United States because we’ve exhausted all legal avenues in El Salvador’s co-opted institutions.

And we’re doing this not just for us. In April, the Israeli newspaper Haaretz assembled a list of more than 450 law-abiding men and women around the world whose devices had been hacked by NSO Group’s Pegasus. Many of them are not in countries or positions where they can sue.

But someone has to. NSO executives shouldn’t be able to wash their hands as their tools are used to persecute journalists. In a very real sense, NSO set the hounds on us. And now we’re fighting back.

Nelson Rauda Zablah is a Salvadoran journalist whose work has been featured in the New York Times, the BBC, the Los Angeles Times, and the Economist among other publications