A group of journalists working for the award-winning Central American independent news outlet El Faro have filed a lawsuit in U.S. court against NSO Group, the Israeli company that operates the Pegasus spyware used to monitor and track journalists, human rights activists and dissidents across the globe. The journalists of El Faro, which is based in El Salvador, allege that Pegasus software was used to infiltrate their iPhones and track their communications and movements. “We’re of course of the belief that it was the government of El Salvador who engaged in these attacks. This is weapons-grade software that is sold exclusively to governments,” says Roman Gressier, a French American staff reporter with El Faro English and one of 15 plaintiffs in the lawsuit. We also speak with Carrie DeCell, senior staff attorney at the Knight First Amendment Institute at Columbia University and the lead lawyer in the lawsuit, who says part of the goal is to force the courts to confirm who NSO Group’s client was. “That would send a signal to other government clients around the world that they can no longer rely on NSO Group’s assurances of secrecy when they … intimidate and persecute journalists, civil rights activists, human rights activists around the world,” says DeCell.
AMY GOODMAN: This is Democracy Now!, democracynow.org. I’m Amy Goodman, with Juan González, as we turn to look at a story about press freedom, hacking, surveillance, a secretive Israeli spyware company.
A group of journalists working for an award-winning Central American independent news outlet have filed a lawsuit in a U.S. court against the NSO Group. That’s the Israeli company that operates Pegasus spyware, which has been used to monitor and track journalists, human rights activists and dissidents across the globe. The journalists suing the NSO Group all work for El Faro, which is based in El Salvador, perhaps the oldest exclusively online Latin American newspaper. They allege that malicious Pegasus surveillance software was used to infiltrate their iPhones and track their communications and movements. The journalists believe the Salvadoran government and President Nayib Bukele were behind the surveillance. The lawsuit, which was filed by the Knight First Amendment Institute, states, quote, “The attacks have compromised Plaintiffs’ safety as well as the safety of their colleagues, sources, and family members.”
We’re joined now by two guests. Carrie DeCell is senior staff attorney at the Knight First Amendment Institute at Columbia University. She’s the lead lawyer in the lawsuit. And Roman Gressier is a French American staff reporter with El Faro English. He’s one of 15 plaintiffs in the lawsuit against the NSO Group. He’s joining us from Guatemala City.
Roman, let’s begin with you. Tell us what you found and why you joined with other reporters for El Faro to sue the NSO Group?
ROMAN GRESSIER: I’m so sorry. I was having some audio interference. I didn’t hear your first question.
AMY GOODMAN: I’m just asking why you sued the NSO Group, what you found on your phone and the consequences of that for you and your fellow reporters at El Faro.
ROMAN GRESSIER: Yeah. So, there were 15, including me, of — 15 members of El Faro who decided to bring this suit. There were 22 of us in total who tested positive for Pegasus on our phones. And that’s in a broader context where the Citizen Lab and Access Now found as many as 35 people who were surveilled using Pegasus between roughly June 2020 through November 2021. And El Faro, in particular, being that 22 of us were infected, it was the most systematic and, in the words of the Citizen Lab, “shocking” case that they had reviewed of Pegasus infections focused on one organization. In my case, there were four attacks against my phone in May and June of 2021 while I was doing investigative work in El Salvador.
And one of the reasons that — or, I would say the main reason that we decided to bring this suit is because of lack of legal avenues to obtain accountability in El Salvador, which is why we’re turning to U.S. courts, given that some of the servers that would have been used for these attacks are based in the U.S. And we’re hoping to — we’re asking the court to also order NSO Group to reveal its client. We’re of course of the belief that it was the government of El Salvador who engaged in these attacks. This is weapons-grade software that is sold exclusively to governments. And actually, throughout the course of the investigation, we discovered — or, the Citizen Lab discovered a live infection in one of the devices, that allowed them to ascertain that the infection on that device was carried out from El Salvador, which was an unprecedented case for them. But we also believe that it’s NSO’s obligation to reveal its client and that they cannot hide behind a shroud of arguing that this should be protected knowledge or protected information that’s, you know, national security. So we believe that they should be required to reveal who is their client concretely.
JUAN GONZÁLEZ: And, Roman Gressier, could you talk about the increasing restrictions on press freedoms in El Salvador? And weren’t some of the investigations that El Faro were working on were linking President Bukele to some of the street gang violence in El Salvador?
ROMAN GRESSIER: Yeah, that’s exactly — you’re exactly right that the infections against El Faro essentially formed a map to understand not only our investigative work but major political events in the country. So, we received a list of infections, basically just dates, just raw data. And then, from there, we were asked to fill in the blanks with what we were doing at that time. And we published a special on this, or an investigation on the findings of the report, where you can see the graphics, where, essentially, it lines up with major investigative reporting.
In one of the most emblematic cases — this is actually the month where we were most surveilled by Pegasus — there were a total of 149 infections in the month of September 2020. What was happening at that time was, at the beginning of the month, El Faro published an investigation that revealed for the first time to the public, with internal government documents and other proof, that the Bukele administration had been negotiating up to that point for up to a year with MS-13. Subsequent investigations found that it also included both factions of 18th Street gang. But at this point, the first installment was focused on MS-13 for a reduction in homicides. And the level of homicides has always been a sort of not only brutal day-to-day experience of Salvadorans, but also a sort of political barometer in terms of how people measure citizen security. And so, the investigation was very politically — it was a hot button for that reason. And so, the revelation of this happened in September 2020. There were the 149 confirmed infections in that month alone, and — or, sorry, cumulative days. Let me just correct that: There were 149 cumulative days of Pegasus infections against a variety of reporters. And toward the end of the month, Bukele himself, on live television, baselessly accused the newsroom of — well, he asserted that the newsroom was under investigation for serious money laundering.
JUAN GONZÁLEZ: And I’d like to bring in Carrie DeCell also, from the Knight First Amendment Institute at Columbia. This idea of a lawsuit filed in the United States, when the violations or the surveillance occurred in El Salvador, can you talk about the legal basis for that?
CARRIE DECELL: I’d be happy to. Thank you. So, we are bringing this lawsuit in U.S. court because the bulk of the value of the spyware that was used against Roman and his colleagues at El Faro derives from its ability to infect as many smartphones as possible around the world. And that really relies on the U.S. infrastructure of U.S. technology companies. In this case, NSO Group abused the software and services of Apple, based in California, in order to create an exploit that served as a vehicle for the delivery of the spyware to Roman’s cellphone, to his colleagues’ cellphones and to many other Pegasus victims around the world. So, this case, and the cases of many other victims of Pegasus, has a very important nexus to the United States. And Apple itself has sued NSO Group based on the same underlying facts as those that support the case that we are bringing against NSO Group here.
I’ll just add to that that El Faro has a very significant readership in the United States, hundreds of thousands of readers in the U.S., and a significant majority of those, or at least plurality of those, in California, as well. And the Pegasus attacks that were launched against El Faro were a clear effort to intimidate this important news outlet into silence. And so, the effect of these attacks would be to diminish the ability of those of us in the United States who look to El Faro for independent news coverage of Central America.
AMY GOODMAN: Carrie, the lawsuit asks the court to require NSO Group to identify, return and then delete all information obtained through these attacks, to prohibit NSO Group from deploying Pegasus again against the plaintiffs and to require NSO Group to identify the client that ordered the surveillance. Talk about especially that last part. Who ordered this surveillance?
CARRIE DECELL: That’s exactly what we want a U.S. court to order NSO Group to disclose. The other key value of the services that NSO Group provides its clients, you know, secrecy is one of the most important pieces of that. So, NSO Group tells its clients that the spyware that it offers them to use against whichever targets they choose cannot be traced back to those clients. And in this case, although there’s a lot of circumstantial evidence to suggest that the government of El Salvador was behind these attacks, we don’t have proof of that yet. And so, one of the most important pieces of relief we’re seeking through this lawsuit is an order requiring NSO Group to identify its previously undisclosed client here. And that would send a signal to other government clients around the world that they can no longer rely on NSO Group’s assurances of secrecy when they seek to use NSO Group spyware to intimidate and persecute journalists, civil rights activists, human rights activists around the world.
AMY GOODMAN: Roman Gressier, I wanted to ask you about a related issue. The prominent investigative Guatemalan newspaper El Periódico has shut down its print edition after months of attack and harassment by the right-wing government of President Giammattei. The paper’s president and founder, José Rubén Zamora, remains in pretrial detention, for many months now, accused of money laundering and extortion, charges denounced by human rights and press freedom groups as political retaliation over exposés of Guatemalan government corruption. The paper, founded in 1996, unclear how it will survive just online with reduced staff. In a final editorial column written from his prison cell, Zamora, who’s been a journalist in Guatemala for decades, wrote, “It has been 30 years of struggle against corruption and impunity, against governmental abuses and terrorism, in favor of freedom, transparency, and accountability.” You’re talking to us from Guatemala City. How has the repression against journalists and government critics worsened not only in Salvador, under Bukele, but across Central America?
ROMAN GRESSIER: Yeah. So, the Guatemala case — Guatemala is advancing similarly to El Salvador. It’s hard to reduce — or, to compare which one is more severe, I think. Definitely across Guatemala what we’ve seen over the past year is that — and even two years, is that there has been systematic abuse, including criminalization of journalists. You could point to the El Estor mining case, where reporters from Prensa Comunitaria have been summoned to court and otherwise criminalized, and of course the case against José Rubén Zamora, who just before they published their last daily print edition on November 30th, the day before, I believe, he had spent four months officially in pretrial detention. And if I’m not mistaken, the first hearing that he’ll face in his case for the trial is set for December 8th, which is this week.
And also another aspect of what’s going on in Guatemala is that the challenges facing journalists outside of the capital can often be more challenging, because they’re not only dealing with the central government, but they’re also dealing with municipal authorities and others who are looking to criminalize them in different ways. And you could point to, for example, the case of Anastasia Mejía, who was reporting on the local mayor, and she faced potential — she was jailed briefly for her work.
JUAN GONZÁLEZ: And could you explain, or how do you analyze the fact that a person like President Bukele, who’s, by all accounts, an extreme right-wing populist, has so much high approval rating in El Salvador? What do you attribute this to? And what’s been the role of the media in shaping that public opinion?
ROMAN GRESSIER: Well, I think it’s certainly true. Everything, all of the public polling that we have over the past few years has pointed to very high levels of support for him. And I think that part of it comes — part of his political appeal from the onset has been his ability to communicate effectively with the public that he wants to — that his political project represents an alternative to the lack of other political parties. And that’s not to say that, you know, there have, of course, been — there’s been an abundance of corruption investigations and other things, but it’s more about the public perception of his communication has been very, very positive.