On Wednesday, 15 members of El Faro filed suit against the Israel-based surveillance company NSO Group in U.S. federal court for allegedly designing and deploying the spyware Pegasus to infiltrate the phones of 22 members of the news organization. The plaintiffs, 13 journalists and two other staff members, based their case on a series of violations of the U.S. Computer Fraud Abuse Act —which prohibits accessing computers without authorization— and the California state-level equivalent Comprehensive Computer Data Access and Fraud Act. The case was filed by the New York City-based Knight First Amendment Institute at Columbia University.
“NSO Group violated that law when it hacked into the plaintiffs’ phones,” said Carrie DeCell, senior staff attorney at the Knight Institute, adding that the case is emblematic of how the spyware has been used to surveil, intimidate, and persecute journalists. “Their devices were accessed remotely and surreptitiously, their communications and activities monitored, and their personal data accessed and stolen.”
A joint investigation released in January by Citizen Lab and Access Now found that between June 2020 and November 2021 the communications of 22 members of El Faro were targeted with Pegasus, an invasive spyware able to extract anything stored on a telephone device: images, videos, text messages as well as geolocation or passwords. The plaintiffs are asking that the federal court require NSO Group to identify, return, and delete all information obtained through these attacks, prohibit the firm from using Pegasus on the plaintiffs, and order them to reveal their client behind the spying in El Salvador.
Among the plaintiffs are U.S. American journalist Roman Gressier, Washington correspondent and Spanish national José Luis Sanz, and Salvadoran journalist Nelson Rauda, who currently resides in the United States and collaborates with El Faro English.
This is the first time that journalists targeted by Pegasus file suit against NSO in U.S. court. El Faro director Carlos Dada, whose phone was bugged with the spyware for at least 167 days, describes the suit as “an effort to defend our rights.” He added, “Unfortunately, we have had to seek out the court of another country, because there is no possibility for us to obtain justice in El Salvador or even government information on how and which government agency spied on us and has in its power the contents of our cell phones.”
The suit was filed in the Northern District of California, where the tech giant Apple sued NSO in November 2021 for “creat[ing] sophisticated, state-sponsored surveillance technology” that infected devices produced by the company, and asked the court to ban them from using Apple software, services, or devices to conduct espionage.
Impunity for “obsessive” spying
In January, an analysis conducted by Access Now and the University of Toronto’s Citizen Lab, organizations who defend digital rights, concluded that at least 35 people were infected with Pegasus in El Salvador. The researchers also located an operator of the spyware in the country.
The organizations asserted that the case of El Faro is unprecedented. “This is one of the most shocking and obsessive cases of targeting that we have investigated,” Citizen Lab researcher John Scott-Railton, who led the investigation, said at the time.
The communications of editors, reporters, and administrative staff were compromised by almost constant and remotely generated infections without the knowledge of those targeted or any need for them to click on a fraudulent link. This intrusion method is known as “FORCEDENTRY,” an exploit mentioned in the plaintiffs’ complaint. “Their cell phones were hacked remotely and covertly,” said DeCell.
Citizen Lab and Access Now’s exhaustive analysis offered precise information on the days and duration of the Pegasus attacks. In the most extreme case, that of journalist Carlos Martínez, the infections of his phone lasted at least 269 days. Others like that of journalist Gabriel Labrador, exceeded 100 days.
The researchers found a close correlation, as also noted in the complaint, between the days that each journalist was targeted and their investigative work, like reporting into the Bukele administration’s covert gang negotiations or the implementation of bitcoin. “Many of the attacks occurred while they were communicating with confidential sources, including U.S. Embassy officials, and while they were informing the public on abuses committed by the Salvadoran government,” said DeCell, adding that the case of EL Faro could be considered “one of the most deliberate, sustained, and highly-sophisticated spyware attacks to date.”
NSO argues that it only sells Pegasus to governments and their respective security agencies, though the Salvadoran government has denied having purchased a license to operate the product. In February, one month after the revelations, the Salvadoran President’s Office sponsored legal reforms to create “undercover digital agents” who would become a sort of digital patrol using “information technology programs” to obtain information for use in criminal investigations. Civil society organizations denounced the bill as an effort to “legalize spyware.”
The suit against NSO, according to the director of El Faro, is the next step in denouncing the espionage against journalists given the non-response from the Salvadoran government. “NSO is the company responsible for this spying against journalists and human rights defenders around the world and we want them to take responsibility for it, transparently informing the public when their programs have been wrongfully used. It puts us at risk and violates citizens’ right to be informed,” said Dada.
DeCell says that another objective of the lawsuit is to change the behavior of companies in the spyware industry. “The producers of spyware who participate in the persecution of journalists should not be allowed to operate with impunity,” she asserted, echoing the position of prominent rights groups like Amnesty International and challenging the assertion of an industry that, under the argument of “combating crime,” generates revenue from human rights violations and attacks and persecution of dissident voices and journalists.
Dada says that the suit communicates to companies like NSO that attacks against press freedom have consequences. “I’d like to believe that if more cases are opened in other parts of the world against these firms they would think twice before permitting their products to be used [to attack journalists].” He added, “As journalists and as private citizens, we will continue striving to defend our rights that have been violated by the most invasive spying system in the world.”
