Dozens Of Journalists And Activists In El Salvador Are Hacked By Israeli's Spyware

With the internet, data can be transferred from one place to another in an instant. This allows communications and eases the sharing of information to a level that was never experienced before the advent of this technology.

And with internet-capable mobile devices in almost everyone's hands, data is so abundance.

This makes peeking into someone else's data a profitable business.

Human-rights group Amnesty International has collaborated with University of Toronto's Citizen Lab to find that a tool from Israeli's notorious NSO Group has been used to hack nearly three dozen journalists and activists in El Salvador.

Many of the people that were hacked, were investigating alleged state corruption.

The investigation found that the people have been hacked between July 2020 and November 2021, through a sophisticated spyware typically available only to governments and law enforcement, as explained by the Canadian research institute.

The spyware in question, is no other than the famous Pegasus.

Created and maintained by the NSO Group in Herzliya, near Tel Avi, the software has been purchased by many state actors worldwide, some of whom have used the tool to spy on journalists, activists, dissidents, diplomats, members of the clergy and more, according to internet security researchers.

And in this case, the El Salvador attack heavy focused on editors, reporters and activists working inside that single Central American country, said Scott-Railton, a senior researcher at Citizen Lab.

The hardest hit was the online news site El Faro.

Citizen Lab researchers said that they found tracks of the Pegasus infections on the smartphones of 22 of the agency's reporters, editors and administrative personnel. This is more than two-thirds of the company’s staff.

The research found evidence that data had been stolen from many of those devices, including a few that had several gigabytes of data extracted.

The agency was under constant attack for at least 17 months, with the phone of Editor-in-Chief Oscar Martinez infiltrated at least 42 times, Citizen Lab said.

"It is hard for me to think or conclude something other than the government of El Salvador was behind the alleged hacks," Martinez said, who explained that hackers had spent 269 days inside his phone.

"It’s evident that there is a radical interest in understanding what El Faro is doing."

Particularly, an unknown party is interested in the increasingly hostile environment in El Salvador for media and rights organizations under populist President Nayib Bukele.

The 40-year-old President who previously invested $4 million worth of El Salvador's Bitcoins to build a pet hospital, is known to once referred to himself as "the world’s coolest dictator."

During the time of the alleged hack with the Pegasus spyware, it is said that El Faro was reporting extensively on scandals involving Bukele’s government, including allegations that he was negotiating a financial deal with El Salvador’s street gangs to reduce the homicide rate to boost electoral support, as well as support for his New Ideas party.

But it should be noted that the government of El Salvador was not a client of NSO Group Technologies, at least according to Bukele's government.

Sofia Medina, spokeswoman for Bukele, said that “El Salvador is no way associated with Pegasus and nor is a client of NSO Group."

She continued saying that the government does not have licenses to use this type of software.

In fact, Medina also said that on November 23, she, too, received an alert from Apple as other victims did saying she might be a victim of state-sponsored hacking.

Following the revelation, it is said that the President's administration is investigating the alleged hacking and had information that some top administration officials also might have had their phones infiltrated.

"We have indications that we, government officials, are also victims of attacks,” the government statement said.

Despite that, while the researchers could not conclusively link the hacks to El Salvador's government, the report said that there is a "strong country-specific focus of the infections suggests that this is very likely."

In this case, Citizen Lab conducted a forensic analysis of 37 devices and found evidence of incursions on the phones that occurred between July 2020 and November 2021.

Their investigation, carried out with Access Now, was then reviewed by Amnesty International’s Security Lab.

John Scott-Railton, senior researcher at Citizen Lab and an author of the report, said the “aggressiveness and persistence of the hacking was jaw-dropping”.

"I’ve seen a lot of Pegasus cases but what was especially disturbing in this case was its juxtaposition with the physical threats and violent language against the media in El Salvador. This is the kind of thing that perhaps wouldn’t surprise you in a dictatorship, but at least on paper El Salvador is a democracy."

"It’s completely unacceptable to spy on journalists," said Carlos Dada, the founder and director of El Faro.

"It endangers our sources, it limits our work and it also endangers our families."

As for NSO, the company said that it only sells its products to legitimate intelligence and law enforcement agencies for use against terrorists and criminals, and once it sold its products to a client, the company can no longer operate the technology or know what the spyware is used for by the client.

NSO also does not identify its customers, with its CEO once said that people should not be afraid of being surveilled, unless they are doing something unlawful.

The news comes two months after the the U.S. government blacklisted NSO Group after determining the spyware company had acted "contrary to the foreign policy and national security interests of the U.S.."