- BBC News World
The cell phones of nearly three dozen journalists and activists in El Salvador were hacked with the sophisticated Pegasus spyware, according to the Canadian Citizen Lab institute and confirmed by Amnesty International.
The hack affected 37 devices of 35 people between July 2020 and November 2021, Citizen Lab said Wednesday. Most of the hacked phones belong to journalists from the Salvadoran media The lighthouse, which has exposed the links between the Nayib Bukele government and the gangs of that country.
So far it has not been verified who is behind the hack, although journalists from The lighthouse they point to the government, something the government denies.
The research was conducted by the University of Toronto’s Citizen Lab and digital rights group Access Now.
The Amnesty International Security Laboratory independently confirmed the findings.
“Forensic analysis confirmed that each device was infected with the NSO Group’s Pegasus spyware,” Amnesty International noted, noting that “the first signs of attack on the devices in the sample occurred around July 30, 2020” and “The signs of threat or attempted attack continued until November 15, 2021,” the Efe news agency was quoted as saying.
Amnesty International detailed that “the targets included journalists from The lighthouse, CatClosed, The printing press, Disruptive Digital Magazine, El Mundo newspaper, Today’s Diary, and two independent journalists “, in addition to members of the organizations Fundación DTJ and Critosal.
What is Pegasus?
Pegasus is a sophisticated software designed by the Israeli company NSO Group. It infects devices that have iOS and Android systems, which allows you to extract messages, photos, emails, record calls and secretly activate microphones and cameras.
According to some sources, around the world more than 600 politicians and officials, 189 journalists, 64 business executives and 85 activists, among others, have been victims of this espionage. Some 50,000 phone numbers have been leaked.
And since then it has been in the crosshairs. Pegasus is blacklisted in the US. since last year after allegations that repressive governments were using spyware to hack innocent people, including activists, politicians and journalists.
NSO Group denies the accusations, indicating that he does not put these tools in the hands of just anyone and that his customers are carefully valued.
Through a statement, the company said it sold its products only to legitimate intelligence agencies and law enforcement for use against terrorists and criminals, and he did not know who his clients’ targets were.
The company declined to comment on whether El Salvador was a Pegasus customer.
Citizen Lab investigators stated that they began a forensic analysis of El Salvador’s phones in September, after being contacted by two journalists from that country who suspected their devices could be compromised.
Citizen Lab said it found telltale traces of spyware infections on the mobile phones of 22 reporters, editors and administrative staff and evidence that data had been stolen from many of those devices, including several gigabytes.
In a statement to Reuters, Bukele’s communications office said that the government of El Salvador is not a client of NSO Group Technologies. He noted that the administration is investigating the alleged hacking and that it has information that the phones of some high-level officials may also have been infiltrated.
“We have indications that we, government officials, are also being the victims of attacks,” he said in a statement.
“The interventions and espionage of which we have been victims in The lighthouse they imply that those responsible have had access to everything about our communications and the information stored on our cell phones, “denounced the media’s chief information officer, journalist Óscar Martínez.
“It is difficult for me to think or conclude anything other than the government of El Salvador” behind the alleged attacks, Martinez said. “It is clear that there is a radical interest in understanding what it is that The lighthouse is doing, “he added.
Carlos Martínez, an investigative journalist for the publication, said the hackers spent 269 days inside his phone. “For 269 days they invaded my privacy,” he denounced on Twitter.
During the time of the alleged Pegasus infiltrations, The lighthouse reported on scandals related to the Bukele government, including allegations that it was negotiating a deal with violent street gangs to reduce the murder rate in order to boost popular support for President Bukele’s New Ideas party.
Bukele, who frequently argues with the press, publicly condemned the information from The lighthouse about those alleged conversations as “ridiculous” and “false information” on his Twitter account on September 3, 2020.
Telephone espionage is not new in El Salvador, says Citizen Lab.
In a 2020 report, El Salvador was claimed to be one of 25 countries using mass surveillance technology manufactured by an Israeli company called Circles, whose technology differs from Pegasus in that it collects data from the global telephone network rather than install spyware on specific devices.
Remember that you can receive notifications from BBC Mundo. Download the new version of our app and activate them so you don’t miss out on our best content.
Eddie is an Australian news reporter with over 9 years in the industry and has published on Forbes and tech crunch.