Spyware Developer NSO Group Sued by Salvadoran Journalists

(Bloomberg) -- Fifteen staffers of El Faro, a Salvadoran online news outlet, sued the Israeli company NSO Group for allegedly providing spyware that was used to hack into journalists’ mobile phones.

“These spyware attacks were an attempt to silence our sources and deter us from doing journalism,” Carlos Dada, El Faro’s co-founder and director, said in a statement. “We are filing this lawsuit to defend our right to investigate and report, and to protect journalists around the world in their pursuit of the truth.”

NSO Group has been under intense scrutiny for years. Human-rights groups and digital forensics researchers such as Amnesty International and Citizen Lab have accused the company of selling its products to oppressive governments that use it to surveil and intimidate critics, journalists, human-rights workers and others.

NSO Group’s product, called Pegasus, can hack into phones without the target having to click on a link or download an attachment. The tool allows for the collection of data on the phone, including photos, location history, messages and other information. It can also surreptitiously capture audio and video from the phone’s microphone and camera. The lawsuit alleges that NSO Group and its clients, who aren’t identified, were behind the attacks.

Roman Gressier, an El Faro reporter who is a dual US and French citizen, was among those targets, according to the lawsuit.

The newspaper claimed that sources have expressed reticence to communicate with El Faro reporters as a result of the hacking and that advertisers have been deterred from doing business with the outlet.

Due to the hacks, reporters at El Faro have minimized contact with sources using their phones and have prioritized in-person meetings instead, according to the filing.

In a statement, an NSO spokesperson, Liron Bruck, said its critics “repeatedly recycle each other’s reports and knowingly release speculative, inaccurate and incomplete reports to the media.”

“These intentionally biased reports have repeatedly proven to be false, lack any independent verification and rely on probabilities and circumstantial protocols rather than on actual forensics and evidences,” Bruck said. NSO has previously asserted that its products are intended for law enforcement to combat terrorism and crime.

“We are proud that Pegasus remains in high demand by law enforcement and governments across the world for its proven ability to save lives,” he said.

Q Cyber Technologies Ltd. was also named as a defendant in the lawsuit. It is the parent company of NSO Group, according to the suit.

A representative for the Embassy of El Salvador in Washington didn’t respond to a request for comment.

The lawsuit, which was filed in San Jose, California on Wednesday, is the first filed by journalists against NSO Group in a US court, according to a press release by the Knight First Amendment Institute at Columbia University, which is representing the El Faro staffers. NSO has been sued by journalists abroad in at least one other instance: in January, Hungarian journalists who allege they were targeted by NSO spyware sued the Israeli firm, according to Deutsche Welle (DW), an international broadcaster based in Germany.

News of the lawsuit was previously reported by The New Yorker.

The lawsuit filed by El Faro staffers alleges the hacking of its staffers was part of a sprawling campaign by NSO Group and its clients that targeted 35 people working in or around El Salvador, including the leaders of civil-rights groups.

“These attacks went undetected at first, but subsequent analyses identified 226 Pegasus infections between June 2020 and November 2021 on devices used by El Faro employees,” according to the lawsuit. The attacks intensified around publication of major stories and resulted in the exfiltration of sensitive data, according to the lawsuit.

“Many of these attacks occurred when they were communicating with confidential sources, including US Embassy officials, and reporting on abuses by the Salvadoran government,” according to the lawsuit. A representative for the US State Department didn’t respond to a request for comment.

Carlos Martínez, a reporter at El Faro who was investigating negotiations between the Salvadoran government and the MS-13 gang, had his phone hacked by Pegasus at least 28 times, the lawsuit alleges.

The Israeli company has also been sued by Apple Inc. and WhatsApp, which is owned by Meta Platforms Inc. Both of those cases are still pending. The technology companies allege that NSO Group improperly used the companies’ servers to deploy its spyware product, among other claims. NSO Group has denied the allegations.

NSO Group was added to a US government export blacklist in November 2021. The company’s spyware was used to “maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers,” according to a statement by the US Department of Commerce.