Since Friday, July 19, over a dozen major U.S. technology companies and press organizations filed amicus curiae briefs in the Ninth Circuit Court of Appeals to voice support for 18 current and former members of El Faro currently appealing the March dismissal of the lawsuit against the Israel-based company NSO Group, developer and vendor of the spyware known as Pegasus. The digital surveillance tool was used extensively from 2020 to 2021 to hack the iPhones of at least 22 current and former journalists and employees of El Faro in an unprecedented attack against regional press freedom.
The Citizen Lab, of Toronto University, and Access Now documented in January 2022 a total of 35 Pegasus targets in this span against journalists, politicians, and human rights advocates in El Salvador, in what the former called “one of the most shocking and obsessive cases of targeting that we have investigated.” The deployment of the spyware against El Faro was the most egregious, with around two-thirds of the organization testing positive in independent analyses carried out in late 2021.
Represented by attorneys at the Knight First Amendment Institute at Columbia University, 18 members of El Faro filed the case against NSO Group in November 2022 in California, citing alleged violations of the U.S. Computer Fraud and Abuse Act (CFAA) and comparable state law, and petitioning the court to order NSO to return and delete information stolen from Apple servers and devices, as well as reveal its client in El Salvador.
NSO Group claims to only sell its signature spyware tool to governments under supervision of the Israeli Ministry of Defense, giving particular relevance to Citizen Lab and Access Now’s report of “a Pegasus customer operating almost exclusively in El Salvador since at least November 2019.”
On March 8 of this year, Judge James Donato, of the Northern District of California, dismissed the case on the grounds of forum non conveniens, stating that the litigation “belongs in a court in Israel or El Salvador, and not here.” “To conclude otherwise,” he continued, “would open the doors of the federal courts to lawsuits by foreign entities for conduct that occurred entirely outside the United States.”
“Burdening a jury in this District with all of this makes little sense,” wrote Donato. “[A] local jury would understandably struggle with being asked to sit for a long trial that involves purely foreign plaintiffs and defendants, and events in foreign lands.”
One amicus brief in support of members of El Faro, submitted on July 22 by companies including Microsoft and Google, rebutted the dismissal: “The United States and California have fundamental interests in protecting domestic technology companies from having NSO use their products and services as spyware vectors.”
Microsoft added in its own blog post that “[c]yber mercenaries like NSO Group have exploited our technology by attacking our users and we believe that those who have been victimized are entitled to legal recourse even if they are located outside the United States.”
A brief submitted Monday by press organizations including the Reporter’s Committee for Freedom of the Press, the National Newspaper Association, and The New York Times Company reads that “the decision below gives inadequate weight to the exceptionally strong federal policy favoring global press freedom.”
U.S. law professor Cassandra Burke Robertson, director of the Center for Professional Ethics at Case Western Reserve University in Ohio, drove the point further in her own amicus brief: “Plaintiff Nelson Rauda Zablah lived in the United States when this case was initiated and the amended complaint was filed; Plaintiff José Luis Sanz resides in the United States; and Plaintiff Roman Gressier is a U.S. citizen,” she noted in her own amicus.
“At stake are principles essential to democracy: the rights to privacy and freedom of expression and of the press without being curbed by tools so sophisticated and invasive that they are supposed to be exclusively used to fight issues as serious as terrorism,” says El Faro editor-in-chief Carlos Dada. “This goes much beyond the complaint of some members of El Faro against an Israeli company.”
Borderless spyware
The Electronic Privacy Information Center, a public-interest research center in Washington, D.C., pointed to the California location of servers violated in the Pegasus attacks on El Faro: “Failing to adequately enforce the CFAA against foreign hackers like NSO Group undermines the public trust in Apple’s infrastructure upon which most Americans rely.”
“The need to enforce the CFAA extraterritorially has only become more urgent as computer data and infrastructure has become increasingly borderless,” the center wrote in a Tuesday filing.
The Knight Institute filed its opening appeal brief on July 15, arguing the court had “directly contradicted its own analysis of the same factors in the Apple case.” Judge Donato has discarded NSO’s place-based defense in separate lawsuits presented by Apple and Meta —the parent company of WhatsApp— against the Pegasus developer.
Multiple briefs cited U.S. President Joe Biden’s declaration that countering illicit spyware is “a fundamental national security and foreign policy interest” or the Commerce Department’s 2021 sanctioning of NSO Group for “maliciously target[ing] government officials, journalists, businesspeople, activists, academics, and embassy workers.”
Members of the European Parliament have called the illicit use of commercial spyware a threat to democracy and made recommendations for legislation across Europe. Some four-dozen governments around the world have agreed to “guiding principles on the government use of surveillance technologies” and called for stronger regulation of the growing commercial spyware industry, including export controls.
“It is dubious how receptive Israeli courts would be to a lawsuit by foreign plaintiffs against their own corporate citizen, as NSO Group is based in Israel,” wrote the Electronic Frontier Foundation in its own submission on July 19. “[Israeli] courts have been very accommodating to NSO Group in particular. As such, U.S. courts must remain a viable forum for victims of unjustified digital surveillance to vindicate their human rights.”
“NSO Group’s technology has been implicated in hundreds of attacks on journalists, human rights advocates, and political dissidents,” said Jameel Jaffer, executive director of the Knight Institute. “These attacks took place around the world but many of them involved the subversion of American companies’ technology in the United States.”
Lack of guarantees
In the 26 years since its founding, El Faro has been recognized as one of the leading investigative news outlets in Latin America. Under the Nayib Bukele administration in El Salvador, and in addition to the Pegasus espionage, the organization has faced politicized tax audits, threats, and constant online harassment. In this context, El Faro moved its legal incorporation in April 2023 from San Salvador to San José, Costa Rica, registering under the non-profit Fundación Periódica.
“This is the culmination of a monthslong process driven by the lack of conditions for our company to remain in El Salvador,” wrote the editorial board after the transfer. “What chance for legal defense is there when the president makes accusations without evidence and controls the entire judicial apparatus and the three branches of government?”
While the newsroom continues to operate primarily in El Salvador, at the time of filing two plaintiffs lived in the United States, including a correspondent in Washington, D.C. and a student at the Columbia University Graduate School of Journalism. The plaintiffs are almost entirely Salvadoran, with the exception of Spanish citizen José Luis Sanz, the former editor-in-chief of El Faro; former Mexican editor Daniel Lizárraga; and U.S.-French citizen Roman Gressier, the current editor of El Faro English.
In April 2023, the Inter-American Commission on Human Rights called on the Salvadoran state to “reestablish rights and guarantees” stripped under the ongoing state of exception. President Nayib Bukele, who has maintained tight control over the judiciary since he illegally removed the Constitutional Chamber magistrates in May 2021, was elected to a second term in violation of the constitutional ban on reelection.
El Faro has denounced as baseless and politically motivated the multiple audits that in April 2021, during the window of Pegasus infections, accused the news organization of intentional tax evasion. In February of that year, the Inter-American Commission issued precautionary measures on behalf of 34 members of El Faro, citing “serious, urgent risk of suffering irreparable harm to their human rights.”
The editorial board has stated that “the only government interested in mounting such an espionage campaign against Salvadoran journalists is the government of El Salvador.”
Pegasus was deployed against the entire structure of El Faro, from the entire editorial board and top administrators to its newest reporters and photography, design, advertising, and accounting. 13 reporters were hacked at least five times, while current executive editor Óscar Martínez suffered 42 attacks.
Current editor-in-chief Carlos Dada and investigative reporter Carlos Martínez each suffered uninterrupted infections often for over a month. Dada was attacked 12 times for 167 days, while in the case of Martínez, who has bylined all of El Faro’s probes of the pacts between politicians and gangs since 2012, researchers detected an active intervention at the time of their analysis — an unprecedented finding that allowed them to pinpoint the location of the operator in El Salvador.
During the infections, El Faro journalists were working on investigations into a parallel cabinet of Venezuelan advisors, secret plans to create a state cryptocurrency, and embezzled pandemic relief. In September 2020, the month when Citizen Lab and Access Now documented the most infections, Bukele baselessly accused the outlet in a public television broadcast of being under investigation for “serious money laundering” — just days after the outlet published its first exposé into the government’s covert negotiations with gangs, which collapsed in 2022.
Columbia Journalism School recently awarded reporter Carlos Martínez, one of the journalists subject to the most extensive Pegasus hacks, the Maria Moors Cabot Prize. He is the third member to receive this prestigious recognition. The jury wrote that “his coverage of the expansion of gang activity is mandatory reading for anyone who wants to understand how criminal networks are devastating Central America, and how their influence is spreading across Mexico and the United States.”
Correction on July 25 at 4:45 ET: A previous version of this article misstated the filing date of the complaint submitted by members of El Faro against NSO Group as December 2021. It was in fact filed at the end of November 2022.
