El Salvador denies responsibility for hacking journalists after reports found Pegasus spyware on their phones

Denial comes after one report good From Access Now and Citizen Lab, two groups specializing in cyber security, claimed that the spying took place between 2020 and 2021. The report did not specify who was responsible for the hacking.

The report claims the hacking targeted at least 22 journalists from El Faro – the influential El Salvadoran digital news outlet – as well as journalists from several other outlets.

The founder and director of El Faro, Carlos Dada, alleges that the Salvadoran government is responsible for the hacking.

“We weren’t surprised to learn that we were hacked, but the amount, frequency and duration of hacking did. Almost everyone in El Faro has been hacked,” Dada said.

Access Now and Citizen Lab reports that the attacks first began in July 2020 and continued through mid-November 2021.

Independent experts from Amnesty International reviewed the report’s findings and agreed with its findings.

“The use of Pegasus to monitor communications in El Salvador reveals a new threat to human rights in the country,” Erica Guevara-Rosas, director of Amnesty International Americas, said in a statement on Thursday.

“The authorities must stop any attempts to restrict freedom of expression and conduct a thorough and impartial investigation to identify those responsible,” Guevara-Rosa said.

Julia Gavret was one of El Faro’s journalists whose phone was hacked. She said she was at a government press conference in 2020 when someone broke into her apartment and stole her computer and some belongings. She speculates that it may have something to do with hacking.

“You may feel scared, but in the end, you know you’re doing the right thing and you can’t give them the power to control your life,” Gavrett told CNN.

Gavrett said that although she could not directly prove that the government was responsible for the attacks, the timing of the attacks was clear because they seemed to neatly accompany the stories she and her allies were doing at the time. could prove harmful to the government.

Government denies spying

President Nayib Bukele’s administration has rejected claims that he was behind the hacking.

“The government of El Salvador has neither the resources nor the license to use this type of software,” Bukele’s communications secretary, Sofia Medina, said in a statement. Medina said that the government is not associated with the use of Pegasus software, nor is the company involved in making it, an Israeli company called NSO Group.

Medina said that in November, she received an alert from Apple — as did others in the government — about a possible hack into her cell phone.

El Salvador's President Nayib Bukele speaks at a news conference in San Salvador earlier this month.

“We have indications that members of the government were also victims of these attacks,” Medina said, adding that the government is already investigating the use of Pegasus and other systems to hack cell phones in the country.

CNN has asked the NSO group for comment on the findings of the new investigation, but has not yet received a direct response.

In a statement, the company said its systems were not currently active in El Salvador, but promised an investigation after obtaining the telephone numbers of the phones that were allegedly hacked, to determine whether Whether its system was misused in the past.

NSO Group said it only provides the software and it does not actively operate the technology – nor does it have access to the data that is then collected. The company said that using its cyber security tools to monitor dissidents, activists and journalists is a serious abuse of that technology.

US blacklists Israeli firm NSO Group for use of spyware

On its website, NSO Group says it only seeks customers who will use its product for “the legal and necessary needs of the prevention and investigation of terrorism and other serious crimes”.

NSO Group says that for this reason, it only licenses government intelligence and law enforcement agencies in what it calls a process of investigation and licensing by Israel’s Defense Ministry.

Responding to previous allegations of abuse of its products, NSO Group told CNN in an emailed statement: “We regret to see time and time again, how our company’s name is mentioned in the news, Which has nothing to do with NSO, directly or indirectly.”

El Salvador is one of 25 countries that acquired surveillance systems from Circles, a company affiliated with the NSO group, according to a study published in December of 2020 by Citizen Lab.

According to that report, the system started working in 2017 during the last administration. CNN attempted to reach then-Vice President Oscar Ortiz about those claims, but did not respond to a request for comment.

David von Blohn and CNN’s Hande Atay Alam contributed to this report.