By CHRISTOPHER SHERMAN and FRANK BAJAK, Associated Press
MEXICO CITY (AP) — Dozens of journalists and human rights defenders in El Salvador have had their cellphones repeatedly hacked with sophisticated spyware over the past year and a half, a state watchdog said Wednesday. Internet.
Reporting on its latest findings on the use of Israeli company NSO Group’s Pegasus spyware, the University of Toronto’s Citizen Lab said it identified a Pegasus operator working almost exclusively in El Salvador in early 2020.
Although the researchers could not conclusively link the hacks to the Salvadoran government, the report said that “the high concentration of infections on countries suggests that this is very likely”.
Sofía Medina, spokesperson for President Nayib Bukele, said in a statement that “El Salvador is in no way associated with Pegasus, nor is it a customer of NSO Group.” She said that the government does not have licenses to use this type of software.
Political cartoons about world leaders
political cartoons
The government is investigating the use of Pegasus to hack phones in El Salvador, she said.
Medina said that on Nov. 23, she, too, received an alert from Apple, as did other victims, saying she might be the victim of a state-sponsored hack. She said the Salvadoran justice and security minister received the same message that day. The Citizen Lab investigation did not include government officials, Medina said.
NSO, which was blacklisted by the US government last year, says it only sells its spyware to legitimate government law enforcement and intelligence agencies approved by Israel’s Defense Ministry for use against terrorists and criminals.
Bukele, a hugely popular president, exposed his critics in the independent Salvadoran press, many of whom were targets of hacking attacks.
Citizen Lab conducted a forensic analysis of 37 devices after owners suspected they might be the target of a hack. Their investigation with Access Now has been reviewed by Amnesty International’s Security Lab.
John Scott-Railton, senior researcher at Citizen Lab and author of the report, said “the aggressiveness and persistence of the hack was breathtaking”.
“I’ve seen a lot of Pegasus cases, but what was particularly troubling about this case was its juxtaposition with the physical threats and violent language against the media in El Salvador,” Scott-Railton said.
“It’s the kind of thing that might not surprise you in a dictatorship, but at least on paper El Salvador is a democracy,” he said.
Citizen Lab has uncovered the use of Pegasus to target journalists, human rights defenders, diplomats and dissidents in recent years. The targets came from Saudi Arabia, the United Arab Emirates, Mexico and the United States.
While Citizen Lab does not blame the mass hacking on the Bukele government, Scott-Railton said all of the circumstantial evidence points in that direction. The victims are almost exclusively in El Salvador.
The infrastructure used to infect Pegasus victims is global, so the command and control servers handling the surveillance in this case should not be local.
Twenty-two of those targeted work for the independent news site El Faro, which during the hack period was working on stories related to the Bukele administration’s alleged deal with street gangs in El Salvador. to reduce the homicide rate and support Bukele’s party in the mid-term elections in exchange for benefits for gang leaders.
Bukele vehemently denied that there were any negotiations with the gangs. In December, the US Treasury named two Bukele government officials and alleged, like El Faro, that the administration had struck a deal with the gangs.
Julia Navarrete, one of the El Faro reporters whose phone was hacked, said Wednesday that the software not only allows someone to listen to all calls, it is “grabbed into the device and extracted all of the information”.
Carlos Dada, the director of El Faro, said the high point of interventions in their phones was in September 2020, when El Faro exposed the story of the alleged negotiations between Bukele’s government and the gangs.
“These coincidences are ultimately not so gratuitous,” he said. “The highest intensity of telephone interventions against 22 people in El Faro occurred in the months around our most sensitive and government-critical publications.”
Carlos Martínez, an investigative reporter for El Faro, said the analysis revealed the hackers spent 269 days inside his phone.
“It just keeps being scary,” he said. “It’s hard to deal with.”
The spyware operator actually attempted to enter his phone again while it was being scanned, which allowed investigators to determine that the operator was in El Salvador.
Apple sued NSO in November, trying to prevent its software from compromising its operating systems. Facebook sued the company in 2019, alleging it hacked into its WhatsApp messaging app.
Associated Press writer Christopher Sherman reported this story in Mexico City and AP writer Frank Bajak reported from Boston.
Copyright 2022 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
Comments are closed.