El Salvador journalists and activists hacked with spyware, report says

The report says hackers spent 269 days inside the phone of journalist Carlos Martínez

Dozens of journalists and activists in El Salvador have had their phones hacked with the spyware Pegasus, which has been used by governments to monitor critics and dissidents, a report says.

Researchers said most of those targeted work at the El Faro news outlet, which has reported on alleged secret talks between the government and gangs.

They could not prove who was behind the hack, but said evidence pointed to government involvement.

The government has denied this.

Pegasus, which was designed by the Israeli company NSO Group, infects iPhones and Android devices, allowing operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras.

The investigation into the El Salvador hack was carried out by the University of Toronto's Citizen Lab and digital rights group Access Now. They said they had found evidence of incursions on 37 devices belonging to 35 individuals between July 2020 and November 2021.

Those who were allegedly hacked work at three human rights groups and six news publications, and one is an independent journalist. Amnesty International's Security Lab independently confirmed the findings.

The main target was El Faro, the country's leading independent news outlet, which had 22 people hacked including reporters and editors. That amounts to more than half of its staff. The report said it had evidence that data had been stolen from many of the devices affected.

The alleged hacks coincided with reports the outlet published about scandals involving President Nayib Bukele's administration, including allegations that the government secretly negotiated with gang leaders in prison in order to reduce the levels of crime. The government denied the claims.

Carlos Martínez, an investigative journalist who wrote those reports, said hackers had spent 269 days inside his phone. "For 269 days they invaded my privacy," he said on Twitter.

The revelations also come amid an increasingly hostile environment for media and rights groups under President Bukele, a populist who enjoys high approval ratings and often rails against his critics in the press.

El Faro's editor-in-chief Oscar Martínez had his phone infiltrated at least 42 times, according to Citizen Lab.

"It is hard for me to think or conclude something other than the government of El Salvador" was behind the alleged hacks, Mr Martínez was quoted by Reuters news agency as saying. "It's evident that there is a radical interest in understanding what El Faro is doing."

• BACKGROUND: Did El Salvador's government make a deal with gangs?

• CONTEXT: Pegasus spyware seller: Blame our customers, not us

Citizen Lab said it could not conclusively say who was behind the deployment of the spyware but that there was "circumstantial evidence pointing to a strong El Salvador government nexus".

John Scott-Railton, senior researcher at Citizen Lab and an author of the report, told the Associated Press that the "aggressiveness and persistence of the hacking was jaw-dropping".

"What was especially disturbing in this case was its juxtaposition with the physical threats and violent language against the media in El Salvador," he said. "This is the kind of thing that perhaps wouldn't surprise you in a dictatorship but at least on paper El Salvador is a democracy."

Sofía Medina, a spokeswoman for President Bukele, said in a statement that "El Salvador is no way associated with Pegasus and nor is a client of NSO Group", and that the government was investigating the possible use of the spyware in the country.

The allegations are the latest to hit NSO, which was blacklisted by the US government last year amid allegations that its spyware was being used by repressive governments to hack innocent people, including activists, politicians and journalists.

NSO said in a statement that it sold its products only to legitimate intelligence and law enforcement agencies for use against terrorists and criminals, and that it did not know who the targets of its customers were. The company declined to comment on whether El Salvador was a Pegasus customer.