Exposed: Civil society condemns use of Pegasus in El Salvador to spy on journalists and activists

We, the undersigned organizations, condemn the use of NSO Group’s Pegasus technology in El Salvador for the surveillance of journalists and civil society, as initially flagged by El Faro and Gato Encerrado, and confirmed through a joint investigation by Access Now, Front Line Defenders, The Citizen Lab, Amnesty International, Fundación Acceso, and SocialTIC. Although, to date, it has not been established who the perpetrator of this surveillance is, NSO Group has repeatedly claimed it only sells Pegasus technology to governments. 

These attacks are particularly alarming, as several of the infections occurred after the Pegasus Project revelations became public in July of 2021, indicating that those behind the spyware attacks were aware of, but ignored, the widespread denouncement of Pegasus use, including by international human rights NGOs and UN experts and officials.

Infecting journalists’ and activists phones: what happened

In September 2021, a group of independent journalists got in touch with Access Now’s Digital Security Helpline after testing their devices using Amnesty International’s Mobile Verification Toolkit to detect Pegasus spyware. SocialTIC, a civil society organization working in digital technology, also referred cases to Front Line Defenders for their investigation. All the infections were confirmed through a forensic analysis by The Citizen Lab, and later independently confirmed by Amnesty International. 

To date, 37 devices belonging to 35 individuals have been confirmed to be infected. Twenty three of those devices belong to professionals affiliated with the regional media group El Faro, and four to the national media group, Gato Encerrado. El Faro and Gato Encerrado are independent investigative outlets that have often published reporting that is critical of the Salvadoran government’s actions. Confirmed infected devices corresponding to other media outlets include: one device from staff of La Prensa Gráfica, one from Revista Digital Disruptiva, one from El Diario de Hoy, one from El Diario El Mundo, and two independent journalists. Confirmed infected devices corresponding to NGOs include: one from Cristosal, two from Fundación Democracia, Transparencia y Justicia (DTJ), and one from an NGO that wishes to remain anonymous.

The devices were infected between July 2020 and November 2021, some over 40 times,* reflecting one of the most persistent and intensive known uses of Pegasus to surveil journalists in the world. We are not ruling out the possibility that more individuals from independent media and civil society in El Salvador may be targets of Pegasus and other spyware. 

On November 23, 2021, El Faro announced that 12 of its journalists received an official notification from Apple, alerting them to the possibility that their devices may have been targeted by Pegasus spyware. The following day, the Association of Journalists of El Salvador (APES) announced that a total of 23 journalists from different newsrooms received the same information. Others who received Apple’s Pegasus targeting notifications include Jhonny Wright Sol, Parliamentarian (former member of Arena party, and founder of Nuestro Tiempo party), and Héctor Silva, a San Salvador local councilor.

A bully State and president

Nayib Bukele’s hostile treatment of the media began early in his presidency, when, during the first months of his term, he generally avoided giving press conferences. Instead, he used his personal Twitter account to issue orders, fire public officials, and harass journalists, who he often arbitrarily categorizes as “political activists.”

The Salvadoran government has repeatedly harassed El Faro and Gato Encerrado journalists in particular. In September 2019, El Faro and other media were blocked from a press conference for past “bad behaviour.” Since July 2020, El Faro reported being the victim of administrative harassment by the government in the form of disproportionate audits, accompanied by false accusations of tax evasion. In the same month, Julia Gavarrete, a Pegasus victim currently working at El Faro and previously working at Gato Encerrado, reported the theft of her work laptop — raising suspicion over whether authorities were involved. In February 2021, the Inter-American Commission on Human Rights (IACHR) granted precautionary measures in favor of 34 members of El Faro for “allegedly being subjected to harassment, threats, intimidation, and stigmatization, mainly through social networks, because of their work as journalists.” And in September 2021, Javier Argueta, legal advisor of the presidential house threatened Gato Encerrado with infractions if they did not reveal their source of information. President Bukele has made multiple allegations discrediting both media outlets on Twitter.

President Bukele has also contributed to diminishing and misrepresenting the work of some women journalists. After Bukele’s tweets, Twitter users hounded and harassed them, some even stating they wished the women were raped.

Alarmingly, the president’s harassment of civil society in El Salvador is being mimicked by other government officials. In June 2021, the Minister of Security stated that, “we live in freedom of expression, but as I always say, everything has its limits, and yes, we are following up with many journalists.” In October, the president’s party, Nuevas Ideas, discussed a “undercover digital agents” proposal, which ​​would allow the Attorney General’s Office to circumvent court orders and authorize the agents, seriously jeopardizing individuals’ privacy. And in December, the legal advisor of the presidential house recommended officials appointed for acts that might be related with corruption by the United States Department of the Treasury, to take legal action against those who write about it in El Salvador.

Furthermore, the new Foreign Agents bill, if signed into law, could contribute to a climate of fear and censorship by limiting  and controlling the activity of civil society organizations whose activities “are directly or indirectly funded by, a foreigner.” This increased authority includes government inspections, 40% tax on foreign funding, and the opening of doors to censorship by prohibiting political activities. Similar laws that were enacted in Russia and Nicaragua have been used to harass and silence human rights organizations, independent media, journalists, bloggers, and activists.

What’s next: call for action to protect journalists and civil society from spyware

We encourage journalists and activists in El Salvador, no matter their affiliation, to contact Access Now’s Digital Security Helpline to confirm if their devices have been infected. As we already know, NSO Group’s Pegasus spyware can silently infect a person’s device, without the need to click on a link, or pick up a phone call. When infected, Pegasus has full access to its host’s device, including photos, contacts, conversations, and more. 

We reiterate our calls on states to implement an immediate moratorium on the sale, transfer, and use of such surveillance technology until adequate human rights safeguards are in place.

We demand the authorities of El Salvador take the following urgent actions:

• Stop harassing journalists and human rights defenders in any fashion, protect the freedom of expression, opinion, and the press, and respect the privacy of its citizens; 

• Start an investigation, through the Attorney General of the Republic of El Salvador, into Pegasus use in the country;

• Fully comply with the recommendations recently made by the IACHR in its report, specially regarding Chapter 6: the right to freedom of expression; and

• Fully comply with precautionary measures granted in favor of journalists from El Faro by the IACHR.

We call on the international and regional organizations to take the following urgent actions:

• The UN: to denounce the unfolding and unprecedented scale of human rights violations by States facilitated by the use of the NSO Group’s Pegasus spyware, and offer robust support for impartial and transparent inquiries into the abuse;

• Organization of American States (OAS): to continue monitoring the situation in El Salvador, particularly around journalists and civil society, in relation to the use of the NSO Group’s Pegasus spyware; and convene an urgent Permanent Council meeting on the human rights implications of the use of spyware, and invite the IACHR’s Special Rapporteur on Freedom of Expression to attend; and

• The Inter-American Commission on Human Rights: to request the state complies with the precautionary measure granted to El Faro; and continue to monitor the situation, and to reactivate the Integration and Timely Integrated Crisis Response Room (SACROI) mechanism for this purpose. 

The world is witnessing an unprecedented explosion of the use of government-mandated surveillance, supported by private companies like NSO Group. The lack of accountability for such egregious conduct by public authorities and private companies allows the surveillance culture to flourish, and destroy human rights. We must act now. 

Signatories

Organisations:

• Access Now

• Alianza Regional por la Libre Expresión e Información 

• Amnesty International

• ARTICLE 19 Oficina México y Centroamérica

• ARTIGO19 Brasil e América do Sul

• Asociación de Periodistas de El Salvador (APES)

• Asociación por los Derechos Civiles (ADC) – Argentina

• Associação Data Privacy Brasil de Pesquisa (Data Privacy Brasil)

• Association for Progressive Communications (APC)

• CELE

• Colectiva Feminista para el Desarrollo Local

• Committee to Protect Journalists (CPJ)

• Comun.al, Laboratorio de resiliencia digital – México 

• Conexo

• Cooperativa Tierra Común – México

• Derechos Digitales 

• El Faro

• Espacio Público

• Free Press Unlimited

• Front Line Defenders

• Fundación Acceso

• Fundación InternetBolivia.org

• Futuro Abierto

• Gato Encerrado

• Hiperderecho

• IPANDETEC Centroamérica

• ISICRI

• Karisma

• ONG Acción Constitucional

• Paradigm Initiative (PIN)

• Radios Libres, Ecuador

• Red en Defensa de los Derechos Digitales (R3D)

• SocialTIC

• Sula Batsú

• Sursiendo, Comunicación y Cultura Digital (Mx)

• TEDIC

• Usuarios Digitales de Ecuador

Individuals:

• Ron Deibert, Professor of Political Science and Director, the Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy

• Siena Anstis, Senior Legal Advisor, the Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy

• John Scott-Railton, Senior Researcher, the Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy

* The phones were repeatedly infected because when the device is turned off, Pegasus does not remain on the device. As such, the persistent targeting demonstrates clear intention to maintain surveillance.