{"id":203173,"date":"2022-01-17T12:00:30","date_gmt":"2022-01-17T12:00:30","guid":{"rendered":"https:\/\/www.transcend.org\/tms\/?p=203173"},"modified":"2022-01-14T04:27:09","modified_gmt":"2022-01-14T04:27:09","slug":"jaw-dropping-targeting-how-pegasus-was-used-against-critical-journalists-in-el-salvador","status":"publish","type":"post","link":"https:\/\/www.transcend.org\/tms\/2022\/01\/jaw-dropping-targeting-how-pegasus-was-used-against-critical-journalists-in-el-salvador\/","title":{"rendered":"\u2018Jaw-Dropping\u2019 Targeting: How Pegasus Was Used against Critical Journalists in El Salvador"},"content":{"rendered":"

13 Jan 2022 – A new report by <\/em>Citizen Lab and <\/em>Access Now, shared with <\/em>Forbidden Stories, shows how investigative journalists at El Faro and GatoEncerrado, two independent media outlets in El Salvador, were repeatedly and aggressively targeted with Pegasus spyware<\/span>.<\/em><\/p><\/blockquote>\n

\"\"<\/a>

President Nayib Bukele at the bicentennial of El Salvador\u2019s independence.
Photo: AFP PHOTO \/ EL SALVADOR’S PRESIDENCY PRESS OFFICE<\/p><\/div>\n

\n
\n
\n
\n

Carlos Mart\u00ednez thought a call to his brother \u00d3scar on the encrypted messaging app Signal was safe. In July 2020, the investigative journalist was getting ready to publish a major scoop and had called his brother, the editor in chief of independent news outlet El Faro, to discuss new material he had received.<\/p>\n

For the past decade, Carlos had reported on criminal gangs operating in El Salvador and their connections to corrupt politicians. Through his reporting, he had uncovered proof that the newly-elected president of El Salvador, Nayib Bukele, had negotiated with MS-13, one of the most violent gangs in the region, in exchange for political favors.<\/p>\n

But an event three days before publication nearly stopped Carlos in his tracks: three days before publication, a colleague of his was sent an audio recording of the private conversation between Carlos and \u00d3scar by a government source. It was the first time Carlos suspected his phone might be tapped.<\/p>\n

\u201cIt was a conversation that only the two of us were aware of,\u201d he said.<\/p>\n

El Faro went ahead and published the piece<\/a>. But a year and a half later, his suspicions were confirmed: starting sometime between in late June or early July 2020, Carlos\u2019s phone was under near-constant surveillance.<\/p>\n

\"\"<\/a>

El Faro journalist Carlos Mart\u00ednez. Photo: El Faro \/ V\u00edctor Pe\u00f1a<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

He\u2019s not the only one.<\/p>\n

A government suspected to be El Salvador has aggressively and regularly hacked top investigative journalists in that country, according to a new report<\/a> released Wednesday by digital rights advocacy groups Citizen Lab and Access Now and shared with Forbidden Stories. The report is based on forensic analyses of the phones of journalists mostly working at El Faro and GatoEncerrado, independent media outlets that have come under increasing pressure from the government of President Nayib Bukele.<\/p>\n

Citizen Lab and Access Now found that Pegasus was successfully installed on 37 phones between July 2020 and November 2021. In a peer-review, Amnesty International\u2019s Security Lab confirmed the findings.<\/p>\n

\u201cWhat we found is just a jaw-dropping amount of targeting of media organizations and civil society in El Salvador,\u201d said John Scott-Railton, a Senior Researcher at Toronto\u2019s Citizen Lab, which co-authored the report.<\/p>\n

\u201cThe extensive use of Pegasus to spy on journalists and civil society in general is disproportionate and you can almost say unprecedented,\u201d said Paolo Nigro, Digital Security Helpline Shift Manager at Access Now.<\/p>\n

According to the report, more than half of El Faro\u2019s staff was infected with Pegasus, with some journalists\u2019 phones tapped over long periods of time and others on numerous occasions. Hacking often coincided with the outlet\u2019s investigations into government corruption, negotiations with criminal gangs, and mismanagement of Covid-19 relief funds, according to editor in chief \u00d3scar Mart\u00ednez, who himself was hacked 42 times \u2013 the most of any individual journalist on staff.<\/p>\n

\u201cThis was more than one year of sustained, obsessive targeting of the newsroom using Pegasus,\u201d Mart\u00ednez told Forbidden Stories. \u201cAll areas of the newspaper have been targeted, that is, the administrative staff, editorial staff, management, the board of directors of the newspaper, its commercial team.\u201d<\/p>\n

In all, 22 staff members of El Faro were infected with Pegasus.<\/p>\n

While the report does not explicitly name the Salvadoran government as the author of the attacks, \u201call signs point toward one of the most obvious conclusions, which is that the government is involved,\u201d Mart\u00ednez added.<\/p>\n

Contacted by Forbidden Stories, the office of the Salvadoran president and the Salvadoran embassy in Paris did not respond to multiple requests for comment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

After Pegasus Project investigation, Apple strikes back at NSO Group<\/h3>\n

El Faro journalists first learned that their phones may have been compromised in late November<\/a>, 2021.<\/p>\n

Gabriela C\u00e1ceres was working from her home office when she received a message from Apple\u2019s threat notification team around 3 pm on November 23.<\/p>\n

\u201cApple believes you are being targeted by state sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID,\u201d the message read, adding: \u201cThe attackers are likely targeting you individually because of who you are or what you do.\u201d<\/p>\n

After C\u00e1ceres, who was the first to receive the message, other staff members began to see the notification pop up on their devices: \u00d3scar Mart\u00ednez, Nelson Rauda Zablah, Valeria Guzm\u00e1n, and so on. In all, 12 journalists from El Faro received the notification, according to a report published later that day by the newspaper\u2019s editorial staff.<\/p>\n

\u201cIt was like what we had suspected was coming true,\u201d C\u00e1ceres said.<\/p>\n

\"\"<\/a>

From left to right, El Faro journalists Gabriela C\u00e1ceres, Mar\u00eda Luz Nochez and Jimmy Alvarado in the El Faro newsroom.
Photo: El Diario de Hoy \/ J\u00e9ssica Orellana<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

At least 28 journalists around the world \u2013 including in Bahrain, Ghana, Lebanon, South Africa and Uganda \u2013 received a message from Apple\u2019s threat notification team in late November, according to social media posts seen by and testimonies given to Forbidden Stories.<\/p>\n

The messages were sent just hours after Apple announced that it had sued Israel-based spyware company NSO Group \u2013 which sells its remote phone hacking tool Pegasus to more than 40 governments around the world \u2013 in a California court.<\/p>\n

\u201cWhile these cybersecurity threats only impact a very small number of our customers, we take any attack on our users very seriously,\u201d Apple\u2019s senior vice president of Software Engineering Craig Federighi said in a statement<\/a>.<\/p>\n

Apple\u2019s lawsuit and notifications came months after Forbidden Stories and 16 media organizations, with the technical support of Amnesty International\u2019s Security Lab, published the Pegasus Project<\/a>, detailing widespread abuse of Pegasus by more than 10 government clients, including in India, Hungary, Mexico and Saudi Arabia. In its press release, the company cited Citizen Lab\u2019s discovery of a new exploit, called FORCEDENTRY, which was used by Pegasus clients to remotely infect mobile devices.<\/p>\n

\n

About the Pegasus Project<\/h3>\n<\/div>\n

\u201cThese notifications from Apple to journalists in El Salvador once again prove that the Pegasus Project revelations were the tip of the iceberg,\u201d said Danna Ingleton, Deputy Director of Amnesty Tech. \u201cWith more targets and client countries surfacing we need, more than ever, accountability for these violations and a moratorium on spyware until regulations are in place that protect human rights.\u201d<\/p>\n

Contacted by Forbidden Stories, an NSO Group spokesperson wrote in an email: \u201cNSO\u2019s firm stance on these issues is that the use of cyber tools in order to monitor dissidents, activists and journalists is a severe misuse of any technology and goes against the desired use of such critical tools. The international community should have zero tolerance policy towards such acts, therefore a global regulation is needed.\u201d<\/p>\n

Sources familiar with the company told Forbidden Stories that there is \u201cno active system in El Salvador,\u201d adding: \u201cWhen the company will receive the numbers related to the allegations, it will perform an investigation to determine if a misuse of its system occurred in the past in the country.\u201d<\/p>\n

\"\"<\/a>

El Faro journalist Nelson Rauda Zablah and APES director C\u00e9sar Fagoaga at a press conference on November 23, 2022. Photo: APES<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

One tool in the authoritarian playbook<\/h3>\n

Journalists who spoke with Forbidden Stories for this article said that they had long suspected their phones may have been tapped by the government.<\/p>\n

Surveillance of journalists at El Faro, \u00d3scar Mart\u00ednez said, often peaked during key political moments, such as May 1, 2021 when Bukele dismissed the country\u2019s Attorney General and Supreme Court judges<\/a>, giving him unprecedented control over the three branches of government.<\/p>\n

Non-newsroom staff members were targeted extensively after the government opened up an audit against El Faro for potential tax evasion<\/a>, he added.<\/p>\n

In El Salvador, spyware attacks constitute just one form of harassment of the independent press.<\/p>\n

Salvadoran journalists and press freedom advocates describe increasingly bold attacks under president Nayib Bukele, who took power in 2019, including<\/a> physical surveillance of journalists using drones and an attempted car bombing of the El Faro office.<\/p>\n

\u201cIt seems like the powers that be in El Salvador are just looking for different ways to try to intimidate the journalists there and see which of these strategies seem to be more effective,\u201d said Natalie Southwick, the Latin America and Caribbean program coordinator at the Committee to Protect Journalists. Salvadoran journalists, she added, \u201chave cause for concern about both kinds of more traditional forms of physical surveillance and monitoring and then also some of these newer tools.\u201d<\/p>\n

After publishing an investigation into how Covid relief funds were redirected into Bukele\u2019s campaign coffers<\/a>, C\u00e1ceres received numerous rape and death threats online, she told Forbidden Stories. Other journalists at El Faro have reported being monitored by drones and video cameras.<\/p>\n

In February 2021, the Interamerican Human Rights Commission put in place protective measures for 34 journalists at El Faro because of \u201csufficient proof that the personal rights of the staff were at risk.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n

The El Faro office. Journalists have mostly worked from home for the past two years because of the pandemic. Photo: El Faro \/ V\u00edctor Pe\u00f1a<\/p>\n<\/div>\n

\n
\n
\n
\n

According to C\u00e9sar Fagoaga, the president of press freedom watchdog APES and an investigative journalist for the past 20 years, El Faro was an obvious target for the Bukele government because of the types of investigations they do.<\/p>\n

\u201cI think it\u2019s probably the most important investigative outlet in the country,\u201d he said. \u201cThe journalists at El Faro showed how millions of pesos dedicated to pandemic relief are being wasted on other things. Perhaps most critically, they showed how the president has been negotiating with criminal gangs.\u201d<\/p>\n

The goal of putting El Faro journalists under surveillance, according to Nelson Rauda Zablah, an investigative reporter at El Faro and a member of the outlet\u2019s leadership team, was simple.<\/p>\n

\u201cThey want to know who I speak with and where and how I get the information that I get,\u201d he said. \u201cIt\u2019s pretty blatant.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n

A wide surveillance net<\/h3>\n

According to the report published today by Citizen Lab and Access Now, Pegasus may have been operated in El Salvador as early as November 2019. Previous reporting by Citizen Lab<\/a> and others<\/a> found that El Salvador is also a \u201clikely\u201d customer of Circles, an NSO affiliate based in Bulgaria.<\/p>\n

\u201cClearly, El Salvador is a pretty technical and technologically enabled surveillance power at this point,\u201d Scott-Railton said.<\/p>\n

However, exactly how many people were targeted by Pegasus across the country remains unknown, Access Now\u2019s Nigro said, noting: \u201cThis is clearly a political use aimed at civil society.\u201d<\/p>\n

According to sources who spoke with El Diario de Hoy on a condition of anonymity<\/a>, the potential target list may have exceeded 500 people, including journalists, opposition politicians, and even a staff member at the US Embassy. Forbidden Stories was unable to independently confirm whether US Embassy staff was targeted by Pegasus.<\/p>\n

Despite the widespread interventions into their phones, journalists at El Faro reiterated that they would continue to report on critical issues.<\/p>\n

\u201cThis confirms a strong fact. There is a huge interest in knowing what investigations this newspaper is doing,\u201d \u00d3scar Mart\u00ednez said. \u201cAnd that\u2019s only for one reason: that the journalism that this newspaper is doing is very uncomfortable to a big group of corrupt people in this country.\u201d<\/p>\n

The message was reiterated by his brother Carlos. \u201cWe believe that in these times, more than ever, journalism is indispensable to carrying out and safeguarding what is left of democracy,\u201d he said. \u201cWe\u2019re not intimidated, we\u2019re going to keep doing our jobs.\u201d<\/p>\n

***************<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n

EL FARO\u2019S FIVE MOST EXPLOSIVE INVESTIGATIONS<\/b><\/h3>\n

El Faro, an independent media outlet in El Salvador, has published numerous investigations holding truth to power in the Central American country. Their investigative team \u200b\u200bSala Negra<\/a> (Black Room) investigates corruption, human rights violations and rising violence in the region.<\/i><\/p>\n