The cell phones of nearly three dozen journalists and activists in El Salvador, some of whom have investigated alleged state corruption, have been hacked since mid-2020 and equipped with sophisticated spyware usually only available to governments and law enforcement, the Canadian research institute said. found.
The alleged hacks, which came amid an increasingly hostile environment in El Salvador for media and human rights organizations under populist President Naib Bukele, were uncovered late last year by Citizen Lab, a spyware study at the University of Toronto’s Munch School of Global Relations. Human rights group Amnesty International, which collaborated with Citizen Lab in the investigation, says it later confirmed a sample of Citizen Lab’s findings through its own technology arm.
Citizen Lab said it found evidence of phone intrusions that occurred between July 2020 and November 2021. She said she could not establish who was responsible for deploying Israel-developed spyware. The software, known as Pegasus, was bought by government agencies around the world, some of which used the tool to monitor journalists.
During the attack in El Salvador, the close scrutiny of editors, reporters and activists working in that only Central American country indicates a local client with a particular interest in their work, according to Scott-Railton, a senior fellow at Citizen Lab.
“I can’t think of a time in which near-exclusive targeting of Pegasus in one country wasn’t a user in that country,” said Scott-Railton.
Released by Citizen Lab report according to his findings on Wednesday.
In a statement to Reuters, Bukele’s public relations department said the El Salvadorian government is not a client of NSO Group Technologies, the company behind Pegasus. It says the administration is investigating the alleged hack and has information that some senior administration officials may have also entered their phones.
“We have indications that we government officials are also victims of attacks,” the statement said.
Pegasus allows users to steal encrypted messages, photos, contacts, documents and other confidential information from infected phones without the user’s knowledge. It can also turn phones into eavesdropping devices by silently activating their cameras and microphones, according to product guidelines reviewed by Reuters.
NSO, which has long kept its client list confidential, declined to comment on whether El Salvador was a Pegasus client. The company said in a statement that it only sells its products to “trusted and legitimate” intelligence and crime-fighting law enforcement agencies and that it does not participate in surveillance operations. The NSO said it has a zero-tolerance policy for the misuse of its spyware for activities such as tracking dissidents, activists and journalists, and that it has terminated contracts with some of the clients who did so.
Citizen Lab researchers said they began forensic investigations of phones in El Salvador in September after they were contacted by two journalists who suspected their devices might be compromised.
The researchers said they ultimately found evidence that spyware was installed on 37 devices belonging to three advocacy groups, six news outlets and a freelance journalist.
The online news site El Faro was hit hardest. Citizen Lab researchers said they found traces of spyware infections on the mobile phones of 22 reporters, editors and administrative staff – more than two-thirds of the company’s staff – and evidence that data had been stolen from many of these devices, including several. from which several gigabytes of material have been extracted.
According to Citizen Lab, El Faro was under constant surveillance for at least 17 months, from June 29, 2020 to November 23, 2021, with editor-in-chief Oscar Martinez’s phone tapped at least 42 times.
“I find it hard to think or conclude that there was something other than the El Salvadorian government behind the alleged break-ins,” Martinez said. “There is clearly a radical interest in understanding what El Faro is doing.”
During the alleged infiltration of the Pegasus, El Faro reported extensively on scandals involving the Bukele government, including allegations that he was negotiating a financial deal with El Salvador’s violent street gangs to lower the murder rate to boost popular support for the president’s New Ideas party “. …
Bukele, who often argues with the press, publicly denounced El Faro’s coverage of these alleged negotiations as “laughable” and “false information” in a September 3, 2020 Twitter post.
Phone tracking is nothing new in El Salvador, according to Citizen Lab. It is stated that in 2020 report that El Salvador was among at least 25 countries using mass surveillance technology developed by Israeli company Circles. Circles technology differs from Pegasus in that it collects data from the global telephone network rather than installing spyware on specific devices. The report claims that the Circles system has been operating in El Salvador since 2017.
Circles may not be immediately available for comment.
Sofia Medina, Bukele’s public relations secretary, noted that his administration was not in power in 2017 and said without providing evidence that the alleged Pegasus attacks appear to be a continuation of surveillance launched by an unknown “powerful group.”
The latest Citizen Lab investigation in El Salvador was carried out in collaboration with Digital Rights Advocacy Group Access Now with assistance from advocacy groups Frontline Defenders, SocialTIC and Fundacion Acceso.
Get the latest news from the Consumer Electronics Show at Gadgets 360 at our CES 2022 center.