{"code":"25936","sect":"El Salvador","sect_slug":"el-salvador","hits":"2847","link":"https:\/\/elfaro.net\/en\/202201\/el_salvador\/25936","link_edit":"","name":"22 Members of El Faro Bugged with Spyware Pegasus","slug":"22-members-of-el-faro-bugged-with-spyware-pegasus","info":"A three-month expert analysis conducted by two international organizations concluded that over the last two years the cell phones of about two-thirds of El Faro staff were hacked using the spyware Pegasus. The iPhones of the editorial board, reporters, and administrative team were compromised, in some cases for as long as a year. The analysis identified a total of 226 intrusions gaining unfettered access to messages, calls, and all content stored on the devices. Leer en espa\u00f1ol","mtag":"Transparency","noun":{"html":"\u003Cspan class='tint-text--dark' data_href='\/user\/profile\/jgavarrete'\u003E Julia Gavarrete\u003C\/span\u003E, \u003Cspan class='tint-text--dark' data_href='\/user\/profile\/admin'\u003E Daniel Reyes\u003C\/span\u003E y \u003Cspan class='tint-text--dark' data_href='\/user\/profile\/omartinez'\u003E \u00d3scar Mart\u00ednez\u003C\/span\u003E","data":{"julia-gavarrete":{"sort":"jgavarrete","slug":"julia-gavarrete","path":"julia_gavarrete","name":"Julia Gavarrete","edge":"0","init":"0"},"daniel-reyes":{"sort":"admin","slug":"daniel-reyes","path":"daniel_reyes","name":"Daniel Reyes","edge":"0","init":"1"},"oscar-martinez":{"sort":"omartinez","slug":"oscar-martinez","path":"oscar_martinez","name":"\u00d3scar Mart\u00ednez","edge":"1","init":"0"}}},"view":"2847","pict":{"cms-image-000036903-jpg":{"feat":"0","sort":"36903","name":"cms-image-000036903.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036903.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036903.jpg","back":"","slug":"cms-image-000036903-jpg","text":"<p>Then-presidential candidate Nayib Bukele greets supporters in San Salvador on election day in February 3, 2019. The popular candidate went on to sweep the elections without a runoff, garnering 53 percent of the vote outright. Photo: V\u00edctor Pe\u00f1a\/El Faro<\/p>","capt":"\u003Cp\u003EThen-presidential candidate Nayib Bukele greets supporters in San Salvador on election day in February 3, 2019. The popular candidate went on to sweep the elections without a runoff, garnering 53 percent of the vote outright. Photo: V\u00edctor Pe\u00f1a\/El Faro\u003C\/p\u003E"},"cms-image-000036904-jpg":{"feat":"0","sort":"36904","name":"cms-image-000036904.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036904.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036904.jpg","back":"","slug":"cms-image-000036904-jpg","text":"<p>On Apr. 6, 2020, La Bermeja Cementary held its first burial under Covid-19 protocols. By then, the cementary had already prepared a special common burial ground to accommodate those who would die of the virus. The Salvadoran government quickly imposed a strict and popular lockdown and sealed off access to public information on pandemic-related spending. Nevertheless, the Salvadoran press uncovered widespread graft, self-dealing, and fraud in the government's pandemic response, leading to raids on various ministries. The San Salvador mayoral candidate \u2014 and current mayor \u2014 Mario Dur\u00e1n for President Bukele's party even diverted food relief for affected families to his 2021 political campaign, an El Faro investigation found.<\/p>","capt":"\u003Cp\u003EOn Apr. 6, 2020, La Bermeja Cementary held its first burial under Covid-19 protocols. By then, the cementary had already prepared a special common burial ground to accommodate those who would die of the virus. The Salvadoran government quickly imposed a strict and popular lockdown and sealed off access to public information on pandemic-related spending. Nevertheless, the Salvadoran press uncovered widespread graft, self-dealing, and fraud in the government's pandemic response, leading to raids on various ministries. The San Salvador mayoral candidate \u2014 and current mayor \u2014 Mario Dur\u00e1n for President Bukele's party even diverted food relief for affected families to his 2021 political campaign, an El Faro investigation found.\u003C\/p\u003E"},"cms-image-000036905-jpg":{"feat":"0","sort":"36905","name":"cms-image-000036905.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036905.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036905.jpg","back":"","slug":"cms-image-000036905-jpg","text":"<p>Vice Minister of Justice and Director of Prisons Osiris Luna alongside his mother, Alma Yanira Meza. An El Faro investigation found that Meza aided her son in embezzling $1.6 million in emergency Covid-19 food supplies. The U.S. Treasury blacklisted them both in December 2021 for their involvement in the scheme.<\/p>","capt":"\u003Cp\u003EVice Minister of Justice and Director of Prisons Osiris Luna alongside his mother, Alma Yanira Meza. An El Faro investigation found that Meza aided her son in embezzling $1.6 million in emergency Covid-19 food supplies. The U.S. Treasury blacklisted them both in December 2021 for their involvement in the scheme.\u003C\/p\u003E"},"cms-image-000036906-jpg":{"feat":"0","sort":"36906","name":"cms-image-000036906.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036906.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036906.jpg","back":"","slug":"cms-image-000036906-jpg","text":"<p>Borromeo Sol\u00f3rzano (Diablo de Hollywood) y Carlos Tiberio Valladares (Snyper), incarcerated senior leaders of MS-13 and two of the gang's negotiators with the Bukele administration, as revealed in a September 2020 El Faro investigation that made global headlines. That month, members of El Faro faced the longest cumulative period of surveillance using Pegasus, The Citizen Lab found. Photo taken in the Ciudad Barrios Prison in San Miguel by V\u00edctor Pe\u00f1a.<\/p>","capt":"\u003Cp\u003EBorromeo Sol\u00f3rzano (Diablo de Hollywood) y Carlos Tiberio Valladares (Snyper), incarcerated senior leaders of MS-13 and two of the gang's negotiators with the Bukele administration, as revealed in a September 2020 El Faro investigation that made global headlines. That month, members of El Faro faced the longest cumulative period of surveillance using Pegasus, The Citizen Lab found. Photo taken in the Ciudad Barrios Prison in San Miguel by V\u00edctor Pe\u00f1a.\u003C\/p\u003E"},"cms-image-000036907-jpg":{"feat":"0","sort":"36907","name":"cms-image-000036907.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036907.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036907.jpg","back":"","slug":"cms-image-000036907-jpg","text":"<p>Prison Bureau director Osiris Luna enters Zacatecoluca Prison in July 2020 to meet with incarcerated gang leaders. In August 2021, El Faro published evidence from the Attorney General's Office that senior prison officials in the Bukele administration removed logbooks and hard drives documenting their negotiations with El Salvador's three gangs amid a criminal probe. In December 2021, the U.S. Treasury blacklisted Luna and a top lieutenant, Carlos Marroqu\u00edn, for leading the talks on behalf of the Bukele administration.<\/p>","capt":"\u003Cp\u003EPrison Bureau director Osiris Luna enters Zacatecoluca Prison in July 2020 to meet with incarcerated gang leaders. In August 2021, El Faro published evidence from the Attorney General's Office that senior prison officials in the Bukele administration removed logbooks and hard drives documenting their negotiations with El Salvador's three gangs amid a criminal probe. In December 2021, the U.S. Treasury blacklisted Luna and a top lieutenant, Carlos Marroqu\u00edn, for leading the talks on behalf of the Bukele administration.\u003C\/p\u003E"},"cms-image-000036908-jpg":{"feat":"0","sort":"36908","name":"cms-image-000036908.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036908.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036908.jpg","back":"","slug":"cms-image-000036908-jpg","text":"<p>President Nayib Bukele's brothers Yusef and Ibrajim (below, from left to right), who hold no formal public office, held private meetings with cryptocurrency businesspeople in late May and early June 2021 to discuss proposals to create a government Bitcoin wallet \u2014 now known as Chivo \u2014 and a government stablecoin currency. El Faro published an investigation in July revealing the covert talks.<\/p>","capt":"\u003Cp\u003EPresident Nayib Bukele's brothers Yusef and Ibrajim (below, from left to right), who hold no formal public office, held private meetings with cryptocurrency businesspeople in late May and early June 2021 to discuss proposals to create a government Bitcoin wallet \u2014 now known as Chivo \u2014 and a government stablecoin currency. El Faro published an investigation in July revealing the covert talks.\u003C\/p\u003E"},"cms-image-000036909-jpg":{"feat":"0","sort":"36909","name":"cms-image-000036909.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036909.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036909.jpg","back":"","slug":"cms-image-000036909-jpg","text":"<p>Xavi Zablah Bukele, President Nayib Bukele's cousin, a close confidant, and the president of the party Nuevas Ideas, greeted dozens of raucous supporters outside a San Salvador voting center on the day of the 2021 legislative elections on Feb. 28. 2021. In a landslide victory, the party won a two-thirds majority of the 2021-2024 legislature and, the day it took office in May, illegally removed and replaced the attorney general and Constitutional Court magistrates with Bukele loyalists. Foto de El Faro: Carlos Barrera<\/p>","capt":"\u003Cp\u003EXavi Zablah Bukele, President Nayib Bukele's cousin, a close confidant, and the president of the party Nuevas Ideas, greeted dozens of raucous supporters outside a San Salvador voting center on the day of the 2021 legislative elections on Feb. 28. 2021. In a landslide victory, the party won a two-thirds majority of the 2021-2024 legislature and, the day it took office in May, illegally removed and replaced the attorney general and Constitutional Court magistrates with Bukele loyalists. Foto de El Faro: Carlos Barrera\u003C\/p\u003E"},"cms-image-000036914-jpg":{"feat":"1","sort":"36914","name":"cms-image-000036914.jpg","link":"https:\/\/elfaro.net\/images\/cms-image-000036914.jpg","path":"https:\/\/elfaro.net\/images\/cms-image-000036914.jpg","back":"","slug":"cms-image-000036914-jpg","text":"","capt":""}},"pict_main__sort":36914,"date":{"live":"2022\/01\/12"},"data_post_dateLive_YY":"2022","data_post_dateLive_MM":"01","data_post_dateLive_DD":"12","text":"\u003Cp dir=\"ltr\"\u003EFrom September to December 2021 The Citizen Lab, an interdisciplinary laboratory focused on cybersecurity at the University of Toronto, ran a technical analysis on all the iPhones in El Faro, in collaboration with the digital rights organization Access Now. Their report, certified by Amnesty International, found conclusive evidence that the cell phones of 22 team members were infected with Pegasus, the software of Israeli spyware firm NSO Group. From the editorial board to reporters, board of directors, and administrative staff, El Faro remained under constant surveillance from at least Jun. 29, 2020 to Nov. 23, 2021. A total of 226 infections were detected, as well as evidence of the existence of a Pegasus operator in Salvadoran territory.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe detected infections affected two-thirds of El Faro\u2019s staff and coincided with the timeline of the newsroom\u2019s most sensitive investigative work during the last two years, major events in El Salvador\u2019s national politics, and peak moments of government attacks against the organization. In the cases of 11 employees, the report found conclusive evidence not only of surveillance, but also of extractions of information. While it wasn\u2019t possible to determine what information was stolen, the experts say Pegasus allows for the extraction of anything stored in the phone: photos, conversations, audio files, and contacts. The report doesn\u2019t rule out the theft of information in the other phones.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn December 2020, The Citizen Lab published a report on 25 countries in which it concluded that the Salvadoran government had acquired a surveillance system from the company Circles, an NSO affiliate. They also concluded that the system had been used in El Salvador since 2017, during the FMLN administration. According to John Scott-Railton, senior investigator at The Citizen Lab, the infections found on El Faro\u2019s phones are different from the findings of the 2020 report. This time, the devices tested positive specifically for Pegasus, not other spyware.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EPegasus, according to The Citizen Lab, is a more powerful spyware than that offered by Circles. \u201cPegasus installs a program on the phone, whereas Circles does not,\u201d said Scott-Railton. \u201cWith Circles, there\u2019s only monitoring and interception; with Pegasus, the phones are hacked. [In the case of Circles,] when the government listens to your calls, they\u2019re not hacking the phone, they\u2019re only listening.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cLearning of the spying against us hasn\u2019t come as a surprise, but the quantity, frequency, and duration of the infections have. Almost all of El Faro has been infected,\u201d said El Faro\u2019s founding director Carlos Dada. \u201cAccording to the expert reports we\u2019ve reviewed, everything points to the fact that it\u2019s the Salvadoran government who is responsible for these infections, that it\u2019s using the software to spy and to illegally obtain information kept on journalists\u2019 phones,\u201d he continued. \u201cIt\u2019s completely unacceptable.\u201d\u00a0\u00a0\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cAfter the \u003Ca href=\"https:\/\/forbiddenstories.org\/case\/the-pegasus-project\/\"\u003Erevelations of the Pegasus Project\u003C\/a\u003E, we hoped the owners of the software would keep their word and verify that it wasn\u2019t being used to persecute journalists. Obviously, they didn\u2019t,\u201d added Dada, in reference to The Citizen Lab\u2019s finding in 2016 of the mass use of Pegasus against journalists and human rights activists in Mexico, Morocco, Saudi Arabia, Hungary, India, and Azerbaijan. Leading papers like The Washington Post published the revelation.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ENSO Group has publicly stated that it only sells Pegasus spyware to governments, and only with the authorization of Israel\u2019s Ministry of Defense. When the international organizations who produced the report on El Faro led similar processes for journalists, activists, and opposition figures in countries such as Poland, Hungary, Egypt, and Mexico, they found that the respective governments were behind the infections. According to John Scott-Railton, senior researcher at The Citizen Lab, \u201cIf you find Pegasus, you know that a person has been targeted by a government.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe expert report on El Faro concluded that the Pegasus infections reached every area of the organization: the newsroom (including the departments of photography and digital strategy), administration, and the executive board. The report concluded that Pegasus not only surveilled El Faro phones in El Salvador, but also in Mexico. \u201cThis is one of the most shocking and obsessive cases of targeting that we have investigated,\u201d said Scott-Railton.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOn Nov. 23, 2021, the U.S. tech firm Apple \u003Ca href=\"\/en\/202111\/el_salvador\/25862\/Apple-Warns-Journalists-of-State-Surveillance-in-El-Salvador.htm\"\u003Esent emails to journalists, politicians, and activists in El Salvador\u003C\/a\u003E \u2014 among them 14 members of El Faro \u2014 warning that \u201cstate-sponsored attackers may be targeting your iPhone.\u201d The company sent the alerts on the same day it sued NSO Group in federal court in California for allegedly hacking its operating system to conduct espionage.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EWhen El Faro team members received those notifications, this news outlet had already been alerted by other sources that its devices were being surveilled with Pegasus. The external analysis of the phones conducted by Access Now and The Citizen Lab had been underway for two months. Apple\u2019s message was entirely unrelated to the analysis that El Faro had already begun.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EEl Faro undertook the external analysis in parallel with Salvadoran digital news outlet GatoEncerrado, whose iPhones\u2019 data reveals that three of its journalists \u2014 the editor-in-chief, politics editor, and a reporter \u2014 were infected with Pegasus 17 times from Sep. 10, 2020 to Nov. 4, 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn El Faro, The Citizen Lab and Access Now determined a range of dates in which a person may have been infected but in some cases was unable to conclude if in that range there was one event, multiple, or continuous spying. The organization doesn\u2019t rule out that other members of El Faro were also victims of cyber espionage, but was unable to conduct the same analysis for those with the Android operating system or who had performed certain recent updates on their devices.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EDue to NSO Group\u2019s privacy policy, it\u2019s unclear how much money was invested in the espionage. \u201cPegasus costs millions of dollars [in the case of El Faro],\u201d said Scott-Railton, adding that any estimate must include an installation fee, costs for training and fees for the team that runs and maintains the software. \u201cWhen a government acquires Pegasus, it acquires a concrete number of licenses per infection,\u201d he added. \u201cIf license A infects you on Monday, I can\u2019t use that same license to infect three other people.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cInstead of being used to fight crime, the licenses were used hundreds of times to surveil journalists,\" Scott-Railton said.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cstrong\u003E\u201cLegitimate Intelligence Agencies\u201d\u003C\/strong\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAccording to the analysis conducted by The Citizen Lab and Access Now, thirteen staff members of El Faro were infected with Pegasus at least five times each from June 2020 to November 2021. Such is the case of the entire editorial board: editor-in-chief \u00d3scar Mart\u00ednez (co-author of this article) suffered 42 attacks; deputy editor-in-chief Sergio Arauz, 14 attacks; and Jos\u00e9 Luis Sanz, editor of El Faro English, 13 attacks in only six months, all during his tenure as director of El Faro before Jan. 1, 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EMexican editor Daniel Liz\u00e1rraga suffered eight attacks, including once while he was in Mexico after the administration of President Nayib Bukele \u003Ca href=\"https:\/\/mailchi.mp\/elfaro.net\/el-faro-english-caso-daniel-lizarraga-6213056?e=3e101df639\"\u003Eexpelled him from El Salvador\u003C\/a\u003E on Jul. 7, 2021. At the time, Liz\u00e1rraga was communicating on his work phone about a publication on the third wave of Covid-19 in El Salvador.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAmong the El Faro reporters with 10 or more attacks are: Gabriel Labrador, with 20; Julia Gavarrete (co-author of this article) with 18, including 15 targeting her personal phone; Gabriela C\u00e1ceres, with 13; Roxana Lazo, with 12; and Efren Lemus, with 10. When the hacks occurred, the journalists were working on investigations, for example, into the Bukele administration\u2019s negotiation with gangs, the theft of pandemic-related food relief by the director of prisons and his mother, the Bukele brothers\u2019 secret negotiations related to the implementation of Bitcoin, the financial holdings of officials in the current government, the government pandemic response, or a profile of President Nayib Bukele.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe Citizen Lab and Access Now highlighted two cases as unprecedented: the director and president of El Faro\u2019s board of directors, Carlos Dada, and reporter Carlos Mart\u00ednez each suffered infections for uninterrupted periods of time often surpassing a month. Thus, even though Dada suffered 12 instances, the infections remained active approximately 167 days between July 8, 2020 and June 9, 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn the case of Mart\u00ednez, who has bylined all of El Faro\u2019s investigations into the pacts between politicians and gangs since 2012, The Citizen Lab detected an active intervention at the time of their analysis on Nov. 15, 2021 \u2014 a situation they had never seen before. \u201cIt\u2019s rare to catch an infection when it\u2019s live,\u201d said Scott-Railton.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe beginning of the interventions of Mart\u00ednez\u2019s phone coincides with the first days of June 2020, when the state-controlled media outlet Diario La P\u00e1gina published an anonymous text, promoted on social media by the president himself, falsely accusing him of sexual agression. The defamation was included in the February 2021 \u003Ca href=\"\/es\/202102\/el_salvador\/25215\/CIDH-emite-medidas-de-protecci%C3%B3n-para-todo-el-personal-de-El-Faro.htm\"\u003Ereport by the Inter-American Commission on Human Rights\u003C\/a\u003E, which listed a long series of government attacks against El Faro and its journalists to decree precautionary measures for all of the outlet\u2019s employees. 19 of the 22 staff members of El Faro surveilled using Pegasus are currently listed in the precautionary measures.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAt the time, Mart\u00ednez was already investigating the Salvadoran government\u2019s secret negotiations with MS-13, culminating in a story revealing the talks in September of 2020 that echoed around the world. In the following months, he continued investigating the process until he co-published a follow-up in August of 2021 showing that the negotiations included not just MS-13, but the country\u2019s three gangs. Last December, the U.S. Treasury \u003Ca href=\"\/en\/202112\/centroamerica\/25893\/Treasury-Dept-Salvadoran-Government-Pacted-with-MS-13.htm\"\u003Eblacklisted two Salvadoran officials leading the talks\u003C\/a\u003E.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cbr\/\u003E \u003Cfigure class=\"pict pict_land pict_move_posc 0 cs_img cs_img--curr rule--ss_c\" data-shot=\"pict\" data-hint=\"pict\"\u003E \u003Cdiv class=\"pict__pobj text-overflow\"\u003E\u003Cimg src=https:\/\/elfaro.net\/get_img?ImageWidth=2000&ImageHeight=1352&ImageId=36903 class=\"pobj\" style=\"max-width: 100%\" rel=\"resizable\" alt=\"Then-presidential candidate Nayib Bukele greets supporters in San Salvador on election day in February 3, 2019. The popular candidate went on to sweep the elections without a runoff, garnering 53 percent of the vote outright. Photo: V\u00edctor Pe\u00f1a\/El Faro\" \/\u003E\u003C\/div\u003E \u003Cfigcaption class=\"pict__text cs_img_caption folk_content typo_buttons line--ss_s0c line--ss_s0c--auto block full-width text-overflow rule--ss_l relative\"\u003E \u003Cdiv class=\"__content block-inline full-width align-top tint-text--idle relative\"\u003E Then-presidential candidate Nayib Bukele greets supporters in San Salvador on election day in February 3, 2019. The popular candidate went on to sweep the elections without a runoff, garnering 53 percent of the vote outright. Photo: V\u00edctor Pe\u00f1a\/El Faro \u003Cdiv class=\"photographer text_italic rule--ss_l tint-text--idle\"\u003E \u003C\/div\u003E \u003C\/div\u003E \u003C\/figcaption\u003E \u003C\/figure\u003E\u003Cbr\/\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EMart\u00ednez, with 28 hacks detected, is the member of El Faro who experienced the most days of spying on his phone using Pegasus: an estimated 269 days between Jun. 29, 2020 and Nov. 15, 2021. \u201cWhat\u2019s remarkable about this case is the intensity of monitoring. What it really highlights is just how much some government wants to get deep into his life,\u201d\u00a0 underscored Scott-Railton. \u201cIt\u2019s an intense pressure against a single person, which also tells me that whatever he\u2019s doing is very important.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn other cases analyzed, the interventions enter the phones and remain for hours, leading The Citizen Lab to conclude that the reason for the intrusion was to extract information from the device. This form of surveillance wielded against Dada, Mart\u00ednez, and other members of El Faro is, in the experts\u2019 opinion, uncommon and reveals an obsessive use of the tool.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAsked for comment from El Faro on the use of Pegasus against journalists from this outlet, NSO Group offered a response via email to be attributed to a spokesperson:\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cNSO provides its software only to vetted and legitimate intelligence agencies as well as to law enforcement agencies, who use these systems under warrants by the local judicial system to fight criminals, terrorists and corruption. These systems are sold following a vetting and licensing process by the Israeli MOD [Ministry of Defense].\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cNSO is a software provider. The company does not operate the technology [n]or is [it] privy to the collected data. The company does not and cannot know who the targets of its customers are, yet implements measures to ensure that these systems are used solely for the authorized uses. While we have not seen the report mentioned in your inquiry, and without confirming or denying specific customers, NSO\u2019s firm stance on these issues is that the use of cyber tools in order to monitor dissidents, activists and journalists is a severe misuse of any technology and goes against the desired use of such critical tools. The international community should have [a] zero tolerance policy toward such acts, therefore a global regulation is needed. NSO has proven in the past it has zero-tolerance for these types of misuse, by terminating multiple contracts.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ENSO added a second part to its answer and asked to be cited only \u201con background, attributed to sources familiar with the company.\u201d El Faro never reached such an agreement with NSO Group and thus decided to publish the Israeli company\u2019s full reply:\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cThere is no active system in El Salvador. When the company will receive [sic] the numbers related to the allegations, it will perform an investigation to determine if a misuse of its system occurred in the past in the country. If the numbers will be received [sic], and the investigation will show [sic] that the system was misused in the past by any of its customers, the company will act with all measure[s] at its disposal based on the contractual agreements.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EEl Faro also requested an interview via email with a representative of Apple about the message that the company sent to members of El Faro in November. By the time of publication, the company did not respond.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOn Jan. 12, El Faro wrote an email to both the Press Secretariat and the Communications Secretariat of the Salvadoran President\u2019s Office explaining that the outlet had irrefutable proof of Pegasus surveillance against 22 staff members and requesting an interview with a government representative on the subject. By the time of publication there was no reply.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAfter ten years of studying surveillance of this kind, Scott-Railton says he has seen a pattern in government responses about the use of Pegasus: \u201cIn my experience, it\u2019s the norm for them to deny it.\u201d\u00a0\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cstrong\u003EHunting Pegasus\u003C\/strong\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAt the end of September 2021, The Citizen Lab and Access Now detected the first case of a Pegasus attack against the iPhone of a member of El Faro: the personal cell phone of Julia Gavarrete. Alongside GatoEncerrado reporter Xenia Oliva, who was also warned of espionage by the organizations, both journalists submitted their phones to a deeper analysis that entailed submitting a copy of the files stored in them.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOnce the use of Pegasus on her phone was verified beyond any doubt, Gavarrete alerted El Faro, who then ordered the analysis of the devices of 11 more of its journalists. The analysis found that all of them had been infected. By December, El Faro had submitted 30 iPhones of its staff to the technical analysis.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe Citizen Lab soon commented that the use of Pegasus against the organization was unprecedented. Scott-Railton has led investigations of this type for ten years, but says he was shocked to find that almost all of the phones in El Faro were testing positive for Pegasus. \u201cI remember calling my colleagues and expressing shock. We all expressed shock and surprise at how dramatic this targeting was, how much it was happening and how many people were targeted at the organization,\u201d said the University of Toronto researcher. He added: \u201cIt was like opening a door.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ETo reach their \u201chigh-confidence\u201d conclusions, in the words of Citizen Lab, they began by analyzing forensic indicators from devices. This included close examination of backups from devices to identify forensic traces uniquely identified with a Pegasus spyware infection. These indicators have been validated and developed since Citizen Lab first began investigating Pegasus in 2016. Researchers at Amnesty International\u2019s Security Lab independently peer reviewed a selection of the cases and confirmed the infections using their own analysis techniques and tools.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EPaolo Nigro Herrero, digital security helpline shift manager at Access Now, said that in the case of El Faro \u201cthe investigations show that there\u2019s an intensive and sustained use of Pegasus.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cbr\/\u003E \u003Cfigure class=\"pict pict_land pict_move_posc 0 cs_img cs_img--curr rule--ss_c\" data-shot=\"pict\" data-hint=\"pict\"\u003E \u003Cdiv class=\"pict__pobj text-overflow\"\u003E\u003Cimg src=https:\/\/elfaro.net\/get_img?ImageWidth=1600&ImageHeight=1066&ImageId=36914 class=\"pobj\" style=\"max-width: 100%\" rel=\"resizable\" alt=\"\" \/\u003E\u003C\/div\u003E \u003Cfigcaption class=\"cs_img_caption folk_content typo_buttons line--ss_s0c line--ss_s0c--auto block full-width text-overflow rule--ss_l relative hidden\"\u003E \u003Cdiv class=\"__content block-inline full-width align-top tint-text--idle relative\"\u003E\u003C\/div\u003E \u003C\/figcaption\u003E \u003C\/figure\u003E\u003Cbr\/\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cHow do you know if a phone is infected with Pegasus?\u201d El Faro asked the Access Now expert.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cPegasus has different points or vectors of infection,\u201d Nigro Herrero replied. \u201cThey exploit vulnerabilities in the operating system or the apps installed in the phone.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cAre there people behind the scenes directly operating Pegasus?\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cYes, there are people,\u201d Nigro Herrero said. \u201cBut they\u2019re not usually watching your data in real time or reading your messages one by one. What they look to do with Pegasus is take out all the information they can, in a short period of time, to use it.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cWhat do they have access to?\u201d El Faro asked.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cEverything, everything. It\u2019s as if they were using an unlocked phone. Basically, it\u2019s a program that permits remote access to practically all of the information on your device.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ENigro Herrero explains that a Pegasus attack offers unfettered access to the phone, including extraction of messages, images or any other stored file, activation of the camera and microphone, and access to the attachments of text messages, messaging apps, emails, geolocation, call logs, and internet browser history.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EHe adds that a new feature of Pegasus is the theft of credentials or \u201ctokens\u201d saved in the device, allowing the attacker to continue accessing accounts even when the device is no longer infected.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAccording to the expert, entry methods vary: it can occur when the user clicks on an infected link, but also through a \u201czero-click\u201d attack \u2014 for example, \u201cFORCEDENTRY,\u201d a form of intrusion that The Citizen Lab began detecting in February of 2021, allows the attacker to remotely take control of the phone without needing its owner to click on a link.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cFORCEDENTRY has been used against you extensively,\u201d underscored Scott-Railton. He doesn\u2019t rule out, though, that some of the infections in El Faro may have occurred by clicking on fraudulent links.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cstrong\u003EObsession with El Faro\u003C\/strong\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe Pegasus attacks against members of El Faro were not only constant for more than a year, but also coincided with the publication of important investigations, transcendent government actions, and moments in the personal lives of the targeted staff members.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe first of the registered infections, according to the technical report received by El Faro, happened to journalist Carlos Martinez on Jun. 29, 2020, three days before an anonymous publication in the government-controlled website La P\u00e1gina accusing him of sexual aggression. The last known Pegasus attack happened to photojournalist Victor Pe\u00f1a on Nov. 23, 2021, the same day Apple sent the emails about the possible espionage \u201con behalf of the State\u201d to 14 members of El Faro and others in El Salvador.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EJuly 2020 was the first of 17 months of generalized and systematic espionage against El Faro journalists. That month, El Faro devices were compromised for a cumulative total of 85 days. July 4 marked the first Pegasus attack against Jos\u00e9 Luis Sanz, director of El Faro at the time and now Washington correspondent. It happened just two days after La P\u00e1gina published its anonymous and defamatory article against Mart\u00ednez. On the day the article was published, two individuals broke into the home of Julia Gavarrete and stole her computer while she was covering a presidential press conference. Gavarrete reported the theft to the Attorney General\u2019s Office, but to date has received no updates about the investigation. At the time, Gavarrete was working for GatoEncerrado. She joined El Faro in January of 2021, and has since suffered 18 Pegasus attacks lasting a total of 25 days.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cbr\/\u003E \u003Cfigure class=\"pict pict_land pict_move_posc 0 cs_img cs_img--curr rule--ss_c\" data-shot=\"pict\" data-hint=\"pict\"\u003E \u003Cdiv class=\"pict__pobj text-overflow\"\u003E\u003Cimg src=https:\/\/elfaro.net\/get_img?ImageWidth=2000&ImageHeight=1333&ImageId=36904 class=\"pobj\" style=\"max-width: 100%\" rel=\"resizable\" alt=\"On Apr. 6, 2020, La Bermeja Cementary held its first burial under Covid-19 protocols. By then, the cementary had already prepared a special common burial ground to accommodate those who would die of the virus. The Salvadoran government quickly imposed a strict and popular lockdown and sealed off access to public information on pandemic-related spending. Nevertheless, the Salvadoran press uncovered widespread graft, self-dealing, and fraud in the government's pandemic response, leading to raids on various ministries. The San Salvador mayoral candidate \u2014 and current mayor \u2014 Mario Dur\u00e1n for President Bukele's party even diverted food relief for affected families to his 2021 political campaign, an El Faro investigation found.\" \/\u003E\u003C\/div\u003E \u003Cfigcaption class=\"pict__text cs_img_caption folk_content typo_buttons line--ss_s0c line--ss_s0c--auto block full-width text-overflow rule--ss_l relative\"\u003E \u003Cdiv class=\"__content block-inline full-width align-top tint-text--idle relative\"\u003E On Apr. 6, 2020, La Bermeja Cementary held its first burial under Covid-19 protocols. By then, the cementary had already prepared a special common burial ground to accommodate those who would die of the virus. The Salvadoran government quickly imposed a strict and popular lockdown and sealed off access to public information on pandemic-related spending. Nevertheless, the Salvadoran press uncovered widespread graft, self-dealing, and fraud in the government's pandemic response, leading to raids on various ministries. The San Salvador mayoral candidate \u2014 and current mayor \u2014 Mario Dur\u00e1n for President Bukele's party even diverted food relief for affected families to his 2021 political campaign, an El Faro investigation found. \u003Cdiv class=\"photographer text_italic rule--ss_l tint-text--idle\"\u003E \u003C\/div\u003E \u003C\/div\u003E \u003C\/figcaption\u003E \u003C\/figure\u003E\u003Cbr\/\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn the case of Sanz, a Spanish national, The Citizen Lab found an important incident: on July 4, 2020, the day that first intrusion against him was detected, he received three text messages of unknown origin, which simulated news alerts from sites that ended up being fake. They had deceiving headlines, such as: \u201cProsecutor going after journalists from El Faro,\u201d or \u201cPresident comes out in defense of his political godson.\u201d It\u2019s unclear whether these messages were the source of infection, but The Citizen Lab notes that the series of infections of his device began right after these messages, lasting approximately 22 days on different dates and stopping when he moved to the United States in January 2021. Sanz did not open the messages, but with Pegasus it\u2019s not necessary to open them for an infection to occur.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ETwo months later, September 2020 was the month when the phones of El Faro staff were most compromised, with approximately 149 cumulative days infected. There was not a single day that month without at least one El Faro employee surveilled using Pegasus. Five employees were surveilled for at least 20 days that month.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ESeptember 3 marked the publication of the investigation titled, \u201c\u003Ca href=\"\/en\/202009\/el_salvador\/24785\/Bukele-Spent-A-Year-Negotiating-with-MS-13-for-a-Reduction-in-Homicides-and-Electoral-Support.htm\"\u003EBukele has been Negotiating with MS-13 for a Reduction in Homicides and Electoral Support\u003C\/a\u003E.\u201d Following the revelation, as documented in a second investigation published in 2021, Prisons Bureau officials \u003Ca href=\"\/en\/202108\/el_salvador\/25670\/Criminal-Investigation-Found-the-Bukele-Administration-Hid-Evidence-of-Negotiations-with-Gangs.htm\"\u003Etried to cover up the talks\u003C\/a\u003E by removing critical logbooks and hard drives from public offices, right when the Special Antimafia Group in the Attorney General\u2019s Office began investigating the matter. Three of the four authors of the investigation were infected throughout the month, according to The Citizen Lab. The fourth author didn\u2019t have an iPhone at the time, making it impossible to know if he was also targeted.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe month of attacks against El Faro by President Bukele ended with an escalation. On Sept. 24, during a national television broadcast the president baselessly announced \u2014 while displaying a photo of director Carlos Dada on a giant screen \u2014\u00a0 that the media outlet was under investigation for money laundering: \u201cNow they face an investigation for serious money laundering,\u201d Bukele said.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ESimilarly, every day the following October, at least one El Faro reporter was surveilled using Pegasus. Carlos Mart\u00ednez\u2019s phone was hacked for each of the 31 days of the month, according to the expert report. Another three employees were hacked for at least 20 days.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EA new spike in hacks took place in April and May of 2021, when El Faro\u2019s phones were infected a total of 52 times. On May 1, the Bukele-controlled Legislative Assembly took office and illegally removed and replaced the attorney general and Constitutional Court magistrates with Bukele loyalists. On May 17, the United States cited the legislative coup in naming Bukele\u2019s chief of cabinet Carolina Recinos, and others involved in the affair, in a list of \u003Ca href=\"\/es\/202105\/el_salvador\/25486\/Estados-Unidos-incluye-a-Carolina-Recinos-en-una-lista-de-funcionarios-corruptos.htm\"\u003Ecorrupt officials\u003C\/a\u003E.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe espionage wasn\u2019t limited to the editorial team. The administrative staff was also infected at key moments. The general manager of El Faro, Carlos Salamanca, was hacked in September and October 2020, just as \u003Ca href=\"\/en\/202104\/columns\/25412\/Government-Fabricates-a-New-Case-against-El-Faro.htm\"\u003Ethe Treasury Ministry audits were in their most intense phase\u003C\/a\u003E and government inspectors were working in person at El Faro\u2019s offices. The administrative manager, Mauricio Sandoval, was also infected several times. One of them was on July 2, 2021, as he was returning from international meetings to ensure El Faro\u2019s stability in the face of government attacks. He was also infected July 6, the same day he received the letter from immigration authorities \u003Ca href=\"https:\/\/mailchi.mp\/elfaro.net\/el-faro-english-caso-daniel-lizarraga-6213056?e=3e101df639\"\u003Eordering editor Daniel Liz\u00e1rraga to leave the country\u003C\/a\u003E within 24 hours. Marketing manager Ana Bea Lazo was also infected once in October 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EEl Faro\u2019s Chief Technology Officer Daniel Reyes (and one of the authors of this article) was hacked twice for a total of 11 days. One of the interventions happened in October 2020 while he was preparing the graphics for the investigation titled: \u201c\u003Ca href=\"\/es\/202010\/el_salvador\/24920\/Empresa-de-candidato-de-Nuevas-Ideas-gan%C3%B3-un-mill%C3%B3n-de-d%C3%B3lares-en-contratos-de-la-emergencia.htm\"\u003ECompany of Nuevas Ideas candidate won a million dollars in contracts for the Pandemic\u003C\/a\u003E.\u201d The other hack happened that same year, on a day that Reyes discussed over the phone and by email with the editorial board how to handle threats on social media that proposed attacking El Faro with a car bomb.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EIn the case of editor-in-chief \u00d3scar Mart\u00ednez, his phone was breached 42 times over 49 days. The phone of Sergio Arauz, deputy editor-in-chief, suffered 14 interventions lasting approximately 28 days. The attacks against Mart\u00ednez and Arauz occurred near the publication dates of a number of complex investigations such as the government negotiations with gangs, various corruption cases, or political decisions about the implementation of Bitcoin. It also matches with numerous days in which they held sensitive editorial meetings and calls.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAs for El Faro\u2019s reporters, Gabriela C\u00e1ceres, who \u003Ca href=\"\/en\/202108\/el_salvador\/25670\/Criminal-Investigation-Found-the-Bukele-Administration-Hid-Evidence-of-Negotiations-with-Gangs.htm\"\u003Erevealed Operation Cathedral\u003C\/a\u003E \u2014\u00a0 one of the most significant corruption cases published by El Faro last year \u2014 received 13 Pegasus attacks on 13 different days, starting on June 6, 2021, just as she began working on the investigation. Nelson Rauda was victim of six attacks, one of them in April 2021, on the last day of his coverage in San Francisco Gotera of \u003Ca href=\"\/en\/202104\/el_salvador\/25441\/US-Government-Hid-Presence-of-US-Advisor-in-El-Mozote-Massacre-Expert-Says.htm\"\u003Eexpert testimony for the El Mozote trial\u003C\/a\u003E. Roxana Lazo\u2019s phone received 12 attacks and Efren Lemus\u2019 received 10 attacks, as they collaborated together on an investigation showing that former Minister of Security and Justice was fired in 2021 for \u003Ca href=\"\/es\/202104\/el_salvador\/25419\/Rogelio-Rivas-fue-despedido-porque-el-OIE-inform%C3%B3-que-constru%C3%ADa-una-candidatura-presidencial.htm\"\u003Esecretly mounting his own presidential candidacy\u003C\/a\u003E without Bukele\u2019s support. Lazo was infected on April 19, 2021, one day after publishing; five days later, on the first day he received an iPhone from El Faro for his work, Lemus was infected. After publication, one of Lemus\u2019 sources wrote to him hinting that their conversations had been discovered by the government.\u003Cbr\/\u003E \u003Cfigure class=\"pict pict_land pict_move_posc 0 cs_img cs_img--curr rule--ss_c\" data-shot=\"pict\" data-hint=\"pict\"\u003E \u003Cdiv class=\"pict__pobj text-overflow\"\u003E\u003Cimg src=https:\/\/elfaro.net\/get_img?ImageWidth=2000&ImageHeight=1135&ImageId=36908 class=\"pobj\" style=\"max-width: 100%\" rel=\"resizable\" alt=\"President Nayib Bukele's brothers Yusef and Ibrajim (below, from left to right), who hold no formal public office, held private meetings with cryptocurrency businesspeople in late May and early June 2021 to discuss proposals to create a government Bitcoin wallet \u2014 now known as Chivo \u2014 and a government stablecoin currency. El Faro published an investigation in July revealing the covert talks.\" \/\u003E\u003C\/div\u003E \u003Cfigcaption class=\"pict__text cs_img_caption folk_content typo_buttons line--ss_s0c line--ss_s0c--auto block full-width text-overflow rule--ss_l relative\"\u003E \u003Cdiv class=\"__content block-inline full-width align-top tint-text--idle relative\"\u003E President Nayib Bukele's brothers Yusef and Ibrajim (below, from left to right), who hold no formal public office, held private meetings with cryptocurrency businesspeople in late May and early June 2021 to discuss proposals to create a government Bitcoin wallet \u2014 now known as Chivo \u2014 and a government stablecoin currency. El Faro published an investigation in July revealing the covert talks. \u003C\/div\u003E \u003C\/figcaption\u003E \u003C\/figure\u003E\u003Cbr\/\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EJournalist Gabriel Labrador, with 20 attacks totaling about 101 days, was infected six times in April 2021, while contacting sources, including relatives of Nayib Bukele, his former high school and university classmates, and former government officials, for a \u003Ca href=\"\/es\/202109\/el_salvador\/25753\/Bukele-el-autoritario-cool.htm\"\u003Eprofile\u003C\/a\u003E of the president for the Colombian magazine Malpensante. Labrador\u2019s phone was infected again on Jun. 1, 2021, when he arrived \u2014 accompanied by U.S. journalist Jon Lee Anderson, from the magazine The New Yorker \u2014 at the Legislative Assembly to cover the session in which Bukele gave his second annual state-of-the-nation address.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EFrench-American journalist Roman Gressier, of El Faro English, was targeted four times with Pegasus, in attacks lasting four days. Two of the infections happened in June 2021: on the 21, the day he traveled to National Civil Police headquarters to submit to a background check; and on the 23, the day after he presented himself before immigration authorities to file for a work permit. Shortly after, he left El Salvador, and, despite the issuance of a temporary permit allowing him to enter and exit the country while his paperwork was under review, the government denied the permit under the argument that he left Salvadoran territory.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOpinion coordinator Mar\u00eda Luz N\u00f3chez was victim of three hacks on three different days in 2021; reporter Valeria Guzm\u00e1n had eight infections of Pegasus lasting 18 days; digital strategy coordinator Rebeca Monge, in charge of El Faro\u2019s social media, was infected one day in 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cstrong\u003EOther Cases of Espionage in El Salvador\u003C\/strong\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAfter Apple \u003Ca href=\"\/en\/202111\/el_salvador\/25862\/Apple-Warns-Journalists-of-State-Surveillance-in-El-Salvador.htm\"\u003Esent out its warning messages\u003C\/a\u003E on Nov. 23, 2021, about possible \u201cstate-sponsored attackers,\u201d El Faro interviewed eight people who received the alert in El Salvador. Two of them claim they underwent technical analyses similar to that of this outlet, allowing them to conclude that their devices had been compromised by Pegasus.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ERicardo Avelar, politics editor at El Diario de Hoy, claims to have confirmed his Pegasus infection in December 2021 thanks to the same international organizations that ran the technical analysis for El Faro. Avelar wasn\u2019t surprised to find ten infections, as the notification from Apple had only increased his preexisting suspicions. \u201cI wanted to live in denial, though I already suspected it and tried to take precautions,\u201d he told El Faro. \u201cIf they already broke into journalists\u2019 phones, then you understand that they have no inhibitions. You start to feel a sort of anxiety about what will happen with your information, and why they want it,\u201d he said.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EEl Faro asked Avelar what state he thought of when Apple alerted him that he was potentially a target of state sponsored espionage. \u201cI thought of this government. I don\u2019t know who else would want to,\u201d he responded. \u201cI don\u2019t know for certain, but I don\u2019t see why another state would want to know about me.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u003Cbr\/\u003E \u003Cfigure class=\"pict pict_land pict_move_posc 0 cs_img cs_img--curr rule--ss_c\" data-shot=\"pict\" data-hint=\"pict\"\u003E \u003Cdiv class=\"pict__pobj text-overflow\"\u003E\u003Cimg src=https:\/\/elfaro.net\/get_img?ImageWidth=2000&ImageHeight=1333&ImageId=36906 class=\"pobj\" style=\"max-width: 100%\" rel=\"resizable\" alt=\"Borromeo Sol\u00f3rzano (Diablo de Hollywood) y Carlos Tiberio Valladares (Snyper), incarcerated senior leaders of MS-13 and two of the gang's negotiators with the Bukele administration, as revealed in a September 2020 El Faro investigation that made global headlines. That month, members of El Faro faced the longest cumulative period of surveillance using Pegasus, The Citizen Lab found. Photo taken in the Ciudad Barrios Prison in San Miguel by V\u00edctor Pe\u00f1a.\" \/\u003E\u003C\/div\u003E \u003Cfigcaption class=\"pict__text cs_img_caption folk_content typo_buttons line--ss_s0c line--ss_s0c--auto block full-width text-overflow rule--ss_l relative\"\u003E \u003Cdiv class=\"__content block-inline full-width align-top tint-text--idle relative\"\u003E Borromeo Sol\u00f3rzano (Diablo de Hollywood) y Carlos Tiberio Valladares (Snyper), incarcerated senior leaders of MS-13 and two of the gang's negotiators with the Bukele administration, as revealed in a September 2020 El Faro investigation that made global headlines. That month, members of El Faro faced the longest cumulative period of surveillance using Pegasus, The Citizen Lab found. Photo taken in the Ciudad Barrios Prison in San Miguel by V\u00edctor Pe\u00f1a. \u003Cdiv class=\"photographer text_italic rule--ss_l tint-text--idle\"\u003E \u003C\/div\u003E \u003C\/div\u003E \u003C\/figcaption\u003E \u003C\/figure\u003E\u003Cbr\/\u003E\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ELike Avelar, independent journalist Mariana Belloso received expert confirmation that she had been targeted using Pegasus. She wrote on Twitter on Nov. 26, three days after Apple sent out the alert, that international organization Frontline Defenders had analyzed her device and confirmed the breach. The Citizen Lab later verified the result: her phone was infected with Pegasus once, on Sep. 5, 2021.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cAs a journalist, I feel indignant. It tells me that today more than ever we need to fortify our work,\u201d Belloso told El Faro. \u201cAs a person, I feel violated and intimidated.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOn the evening of Apple\u2019s announcement, messages from individuals claiming to have received the alert trickled onto social media in El Salvador. Those who spoke out include Spanish national Arnau Baulenas, legal coordinator for the Central American University\u2019s Human Rights Institute (Idhuca) who also works as one of El Faro\u2019s lawyers; U.S. citizen Noah Bullock, director of the Lutheran human rights organization Cristosal; Jos\u00e9 Marinero, president of the Foundation for Democracy, Transparency, and Justice (DTJ); Arena party legislator Marcela Villatoro; and San Salvador city councilman H\u00e9ctor Silva, a member of minority party Nuestro Tiempo.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAt least four ruling party legislators also wrote on social media that they had received the same notification from Apple, claiming that the attacks reported by El Faro, civil society members, and opposition politicians hadn\u2019t come from the Salvadoran government.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ENobody else argued that the attacks denounced by Apple were launched by a state other than El Salvador. \u201c[Apple\u2019s message] confirmed to me something that we already knew,\u201d said Baulenas. \u201cI\u2019ve never doubted that this is President Bukele. I\u2019ve never doubted the threats. I never doubted that this was a matter of espionage with funds from the Salvadoran people \u2014 funds used illegally,\u201d he underscored.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003E\u201cIt\u2019s no accident,\u201d said Marinero, of DTJ. \u201cIt\u2019s a deliberate effort to spy, to intercept the communications of civil society,\u201d he continued. Xenia Hern\u00e1ndez, the executive director of DTJ, also received Apple\u2019s alert.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EAccording to Marinero, they both implemented security measures after he received information about the use of Pegasus in El Salvador. \u201cIn September someone confirmed to me that the government had Pegasus or that they possibly had another way [to conduct espionage],\u201d he said.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ENeither does Silva believe that any attack against him could come from outside of El Salvador: \u201cThere was a clear pattern, because Apple specifies that it is sponsored by a state, and I can\u2019t think of anyone in the world that would be interested in this spying other than the government of El Salvador.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003ECristosal\u2019s Bullock was the only one in his organization to receive the alert, he says, because he\u2019s the only one with an iPhone. He doesn\u2019t believe another government could be behind this. \u201cIt\u2019s not like the government of Uganda took an interest in me,\u201d he quipped, adding that it\u2019s concerning that there is concerted investment in \u201cconstructing, through the [public] communications apparatus, a collective belief that criminalizes human rights.\u201d\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EOther members of Salvadoran society received Apple\u2019s alert, including at least six executives of the Salvadoran Association of Private Enterprise (ANEP), according to executive director Leonor Silva.\u003C\/p\u003E\u003Cbr\/\u003E\u003Cbr\/\u003E\u003Cp dir=\"ltr\"\u003EThe Citizen Lab\u2019s researcher John Scott-Railton, who led the investigation into the use of Pegasus in El Salvador, says urgent steps must be taken: \u201cWe really need to understand who\u2019s doing this, what was done with all of the information that was taken, and it\u2019s so important that there be an independent investigation once this becomes public knowledge.\u201d\u003C\/p\u003E"}