U.S. Citizen Sues NSO Group for Allegedly Helping El Salvador Plant Spyware on Journalist’s Phones

U.S. Citizen Sues NSO Group for Allegedly Helping El Salvador Plant Spyware on Journalist’s Phones

A number of El Salvador-based journalists are suing the notorious makers of the prolific Pegasus spyware suite in U.S. court, alleging the company sold the repressive Bukele regime spyware used to hack their phones.

In the lawsuit filed on Wednesday in federal court in San Jose, California, attorneys representing the journalists of the Central American outlet El Faro said the Isreal-based NSO Group sold the government of El Salvador Pegasus software which was used to hack at least 22 people associated with their digital newspaper between the middle of 2020 and November 2021. The reporters claimed that this allowed the government to listen in and record the journalists’ activities, even when they were communicating with U.S. Embassy officials and finding sources within the El Salvadoran government.

Dual U.S. and French citizen, and noted Central American journalist, Roman Gressier is just one of the names on the lawsuit. He told The New Yorker that he was especially concerned by the attacks as he is a member of the LGBTQ community. Gressier noted that pro-government activists could use those personal details to endanger his and others’ lives since these groups often experience threats and acts of violence in the country, according to Human Rights Watch. Gressier said he had been forced to leave El Salvador, fearing for his safety.

Pegasus software is notably dangerous due to the fact it can be installed remotely without the user being aware. The software then gives remote access to the user’s camera and voice input, allowing for practically unlimited surveillance even when the phone isn’t in use. The lawsuit claims one of the journalists, Carlos Martinez, had his phone hacked for at least 269 days. The lawsuit said Martinez had to purchase a new iPhone following the attacks.

The lawsuit cites a report from Citizen Lab from this January showing that NSO’s Pegasus software had indeed hacked 35 journalists’ phones from a variety of news outlets in the country. The lab confirmed their data with Amnesty International’s Security lab, finding that the phone hacks occurred around the time there were major investigations into El Salvadorian President Nayib Bukele, including reports he negotiated with the routinely violent MS-13 gang to reduce violence in the runup to elections. Journalists backed up that reporting with prison logs confirming meetings between government officials and MS-13 leaders.

The Citizen Lab report notes an operative who they named TOROGOZ had worked exclusively with El Salvador’s government through a separate NSO-linked company. NSO’s founder Shalev Hulio once tried to make the case to 60 Minutes for why it was A-OK to plant spyware on journalists’ phones, somehow claiming that’s partially how drug lord Joaquin “El Chapo” Guzman was caught.

Though there’s no such excuse for why Bukele wanted journalists’ phones bugged. The El Salvadoran president is a noted antagonist of the free press. Two years ago, he tweeted that El Faro and other news outlets publish “opposition content,” adding “if there was any journalism left there, it’s gone.”

The El Faro journalists are being represented by the Knight First Amendment Institute at Columbia University. The institute’s attorneys claim that this is the first time journalists have sued NSO Group in the U.S. for the company’s deployment of spyware. Alexander Abdo, the litigation director for the institute, told Gizmodo in a phone interview that one of the main hopes with the lawsuit is that the U.S. courts will force NSO Group, and by extension all mercenary spyware companies, to disclose which governments they’re working for. If that happens, it may mean such contracts would dry up.

“It would limit their ability to do business with authoritarian regimes,” Abdo said.

In an email statement, an NSO Group spokesperson told Gizmodo the Citizen Lab report was “biased” and that Citizen Lab and Amnesty International “recycle[d] each other’s reports and knowingly release[d] speculative, inaccurate, and incomplete reports to the media.” The mercenary spyware company further alleged the two groups can’t possibly differentiate between Pegasus and other spyware, though the company did not provide any proof to back up these claims.

The NSO spokesperson did not address the lawsuit in their email statement.

NSO Group has faced lawsuits from activists and other advocates who say they were targeted by governments deploying Pegasus spyware. Apple has also sued the spyware maker to try and block it from using its software to deploy its spyware. In 2021, the U.S. government effectively blackballed NSO Group by putting it on the “Entity List” for supplying spyware to foreign governments. The company’s finances are reportedly in dire straits as it has desperately tried to get back into American businesses’ good graces through a massive lobbying campaign.

Separately, Greek reporter Thanasis Koukakis, who said his phone was hacked with competing spyware Predator, is suing spyware maker Cytrox, which is owned by another Isreal-based company: Intellexa.