SAN SALVADOR, Jan 12 (Reuters) – The phones of nearly three dozen journalists and activists in El Salvador, some investigating alleged state corruption, have been hacked since the mid-2020s and implanted with sophisticated spyware normally only available to governments and governments faces prosecution, said a Canadian research institute that found it.
The alleged hacks, which took place amid an increasingly hostile environment in El Salvador for media and human rights organizations under populist President Nayib Bukele, were discovered late last year by The Citizen Lab, which studies spyware at the University of Toronto’s Munk School of Global Affairs. Human rights group Amnesty International, which worked with Citizen Lab on the investigation, said it later corroborated a sample of Citizen Lab’s findings through its own technology arm.
Citizen Lab said it found evidence of break-ins into the phones that took place between July 2020 and November 2021. It said it could not identify who was responsible for deploying the spyware developed by Israel. Known as Pegasus, the software has been bought by state actors worldwide, some of whom have used the tool to monitor journalists.
Sign up now for FREE unlimited access to Reuters.com
In the El Salvador attack, the heavy focus on editors, reporters and activists working in that only Central American country indicates a local client with a particular interest in their activities, said Scott-Railton, a senior researcher at Citizen Lab.
“I can’t think of a case where a near-exclusive Pegasus targeting in one country didn’t translate into a user in that country,” said Scott-Railton.
Citizen Lab released a report of its findings on Wednesday.
In a statement to Reuters, Bukele’s communications office said the El Salvador government is not a customer of NSO Group Technologies, the company that developed Pegasus. It said the administration was investigating the alleged hack and had information that some senior administration officials may have infiltrated their phones as well.
“We have evidence that we, government officials, are also victims of attacks,” the statement said.
Pegasus allows users to steal encrypted messages, photos, contacts, documents and other sensitive information from infected phones without users’ knowledge. It can also turn cellphones into listening devices by silently activating their cameras and microphones, according to product manuals reviewed by Reuters.
NSO, which has long kept its customer list confidential, declined to comment on whether El Salvador was a Pegasus customer. The company said in a statement that it only sells its products to “verified and legitimate” crime-fighting intelligence and law enforcement agencies and is not involved in surveillance operations. NSO said it has a “zero tolerance” policy for misusing its spyware for activities such as monitoring dissidents, activists and journalists and that it has terminated the contracts of some customers who have done so.
Citizen Lab researchers said they began a forensic analysis of the phones from El Salvador in September after being contacted by two journalists there who suspected their devices might be compromised.
The researchers said they eventually found evidence that spyware had been planted on a total of 37 devices by three human rights groups, six news publications and one independent journalist.
The online news site El Faro was hardest hit. Citizen Lab researchers said they found telltale signs of spyware infections on the cellphones of 22 reporters, editors and administrators — more than two-thirds of the company’s workforce — and evidence that data from many of those devices, including some had been stolen which had extracted several gigabytes of material.
El Faro was under constant surveillance for at least 17 months, between June 29, 2020 and November 23, 2021, with editor-in-chief Oscar Martinez’s phone being infiltrated at least 42 times, Citizen Lab claimed.
“It’s hard for me to think of or conclude anything other than the El Salvador government,” said Martinez, who is behind the alleged hacks. “It is evident that there is a radical interest in understanding what El Faro is doing.”
During the alleged infiltrations with Pegasus, El Faro reported extensively on scandals involving the Bukele government, including allegations that he brokered a financial deal with El Salvador’s violent street gangs to reduce the homicide rate and gain popular support for the New Raising the President’s Ideas Party.
Bukele, who frequently speaks to the press, publicly denounced El Faro’s coverage of these alleged talks as “ridiculous” and “false information” in a September 3, 2020 Twitter post.
According to Citizen Lab, phone sniffing is nothing new in El Salvador. A 2020 report claimed El Salvador was among at least 25 countries using mass surveillance technology from an Israeli company called Circles. Circles technology differs from Pegasus in that it siphons data from the global telephone network rather than placing spyware on specific devices. The report claimed the Circles system had been operational in El Salvador since 2017.
Circles could not be immediately reached for comment.
Noting that his government was not in power in 2017, Sofia Medina, Bukele’s communications secretary, claimed without providing evidence that the alleged Pegasus attacks appeared to be a continuation of surveillance launched by an unknown “powerful group”. would.
Citizen Lab’s recent investigation in El Salvador was conducted in collaboration with digital rights group Access Now, with investigative support from human rights groups Frontline Defenders, SocialTIC and Fundacion Acceso.
Sign up now for FREE unlimited access to Reuters.com
Reporting by Sarah Kinosian; additional reporting by Chris Bing; Editing by Marla Dickerson
Our standards: The Thomson Reuters Trust Principles.