Report: Dozens of El Salvador journalists, activists hacked

MEXICO CITY — Dozens of journalists and quality rights defenders successful El Salvador had their cellphones repeatedly hacked with blase spyware implicit the past twelvemonth and a half, an net watchdog said Wednesday.

Reporting connected its latest findings astir usage of the Israeli steadfast NSO Group’s Pegasus spyware, the University of Toronto’s Citizen Lab said it had identified a Pegasus relation moving astir exclusively successful El Salvador successful aboriginal 2020.

While the researchers could not conclusively nexus the hacks to El Salvador’s government, the study said “the beardown country-specific absorption of the infections suggests that this is precise likely.”

Sofía Medina, spokeswoman for President Nayib Bukele, said successful a connection that “El Salvador is nary mode associated with Pegasus and nor is simply a lawsuit of NSO Group.” She said the authorities does not person licenses to usage this benignant of software.

The authorities is investigating the usage of Pegasus to hack phones successful El Salvador, she said.

Medina said that connected Nov. 23 she, too, received an alert from Apple arsenic different victims did saying she mightiness beryllium a unfortunate of state-sponsored hacking. She said El Salvador’s justness and information curate received the aforesaid connection that day. The Citizen Lab probe did not see authorities officials, Medina said.

NSO, which was blacklisted by the U.S. authorities past year, says it sells its spyware lone to morganatic authorities instrumentality enforcement and quality agencies vetted by Israel’s Defense Ministry for usage against terrorists and criminals.

In a statement, NSO said it does not run the exertion erstwhile it is fixed to a lawsuit and cannot cognize the targets of its customers. But it said the usage of its tools to show activists, dissidents oregon journalists “is a terrible misuse of immoderate exertion and goes against the desired usage of specified captious tools.” It noted that it has terminated aggregate contracts successful the past owed to lawsuit misuse.

NSO does not place its customers. But radical acquainted with the institution said it does not presently person an progressive strategy successful El Salvador. The people, speaking connected information of anonymity due to the fact that they were discussing the company’s clients, said NSO is trying to get the telephone numbers that were tracked and volition analyse to spot if determination was immoderate misuse.

“The institution volition enactment with each measures astatine its disposal based connected the contractual agreements,” the radical said.

Bukele, a highly fashionable president, has railed against his critics successful El Salvador’s autarkic press, galore of whom were targeted successful the hacking attacks.

Citizen Lab conducted a forensic investigation of 37 devices aft the owners suspected they could beryllium the targets of hacking. Their probe carried retired with Access Now was reviewed by Amnesty International’s Security Lab.

John Scott-Railton, elder researcher astatine Citizen Lab and an writer of the report, said the “aggressiveness and persistence of the hacking was jaw-dropping.”

“I’ve seen a batch of Pegasus cases but what was particularly disturbing successful this lawsuit was its juxtaposition with the carnal threats and convulsive connection against the media successful El Salvador,” Scott-Railton said.

“This is the benignant of happening that possibly wouldn’t astonishment you successful a dictatorship but astatine slightest connected insubstantial El Salvador is simply a democracy,” helium said.

Citizen Lab has been identifying Pegasus victims since 2015, erstwhile abuses of the spyware against journalists and quality rights activists were discovered successful Mexico and autocratic Middle Eastern countries including Saudi Arabia. Dozens of cases person since been uncovered, including of a twelve U.S. State Department employees successful Uganda, British lawyers and a Polish legislator who led the opposition’s 2019 parliamentary campaign.

While Citizen Lab is not blaming the wide hack connected the Bukele government, Scott-Railton said each the circumstantial grounds points successful that direction. The victims are astir exclusively successful El Salvador.

The infrastructure utilized to infect Pegasus victims is planetary truthful the command-and-control servers managing the surveillance successful this lawsuit would not beryllium expected to beryllium local.

Twenty-two of those targeted enactment for the autarkic quality tract El Faro, which during the play of hacking was moving connected stories related to the Bukele administration’s alleged deal-making with El Salvador’s thoroughfare gangs to little the homicide complaint and enactment Bukele’s enactment successful mid-term elections successful speech for benefits to pack leaders.

Bukele has vehemently denied determination was immoderate dialog with the gangs. In December, the U.S. Treasury designated 2 officials from Bukele’s government, and alleged arsenic El Faro had that the medication made a woody with the gangs.

Julia Navarrete, 1 of the El Faro journalist’s whose telephone was hacked, said Wednesday that this bundle doesn’t conscionable let idiosyncratic to perceive successful each calls, it is “entered successful the instrumentality and extracts each of the information.”

Carlos Dada, El Faro’s director, said the precocious constituent of interventions successful their phones was successful September 2020, erstwhile El Faro broke the communicative astir the alleged negotiations betwixt Bukele’s authorities and the gangs.

“These coincidences successful the extremity are not truthful gratuitous,” helium said. “The highest strength of the telephone interventions against 22 radical astatine El Faro happened successful the months astir our astir delicate publications and astir captious of the government.”

Carlos Martínez, an investigative newsman with El Faro, said the investigation recovered that the hackers spent 269 days wrong his phone.

“That doesn’t halt being frightening,” helium said. “It’s hard to process.”

The spyware relation really tried to participate his telephone again portion it was being analyzed, allowing investigators to find that the relation was successful El Salvador.

Apple sued NSO successful November, trying to halt its bundle from compromising its operating systems. Facebook sued the institution successful 2019, alleging that it was hacking its WhatsApp messenger app.

Associated Press writer Christopher Sherman reported this communicative successful Mexico City and AP writer Frank Bajak reported from Boston. Correspondent Josef Federman reported from Jerusalem.