“We’re pleased with today’s decision and look forward to seeking justice on behalf of El Faro journalists in U.S. court, where the case belongs,” said Carrie DeCell, senior staff attorney and legislative advisor at the Knight First Amendment Institute, who argued the case in the Ninth Circuit. “Spyware manufacturers that participate in the persecution of journalists shouldn’t be able to operate with impunity, and U.S. courts must ensure that they are held accountable for their actions where those actions violate U.S. law, as they did here.”

In November 2022, the Knight Institute filed the lawsuit alleging that NSO Group violated U.S. law by developing, selling, and assisting in the deployment of Pegasus against El Faro. Between June 2020 and November 2021, El Faro’s employees were subjected to at least 226 Pegasus infections. Through these attacks, their iPhones were accessed remotely and surreptitiously, their communications and activities were monitored, and their personal data was accessed and stolen. In recent years, NSO Group’s spyware has been used by authoritarian and rights-abusing regimes to target journalists, human rights activists, and political dissidents around the world. This case is the first filed by journalists against NSO Group in U.S. court.

“We are gratified by the appeals court’s decision and are eager for this case to proceed,” said Carlos Dada, co-founder and director of El Faro. “We continue to believe that unregulated trade in spyware poses a fundamental threat to press freedom around the world.”

Read today’s decision here.

Read more about the lawsuit, Dada v. NSO Group, here.

In addition to DeCell, lawyers on the case include Jameel Jaffer, Alex Abdo, Stephanie Krent, and Allie Schiele for the Knight First Amendment Institute, and Corey Stoughton, Alvaro Mon Cureño, and Jacob Grover for Selendy Gay PLLC.

For more information, contact: Adriana Lamirande, adriana.lamirande@knightcolumbia.org 

The following can be attributed to Carrie DeCell, senior staff attorney with the Knight First Amendment Institute.

“Spyware manufacturers that participate in the persecution of journalists shouldn’t be able to operate with impunity. U.S. courts must ensure that spyware manufacturers are held accountable for their actions where those actions violate U.S. law, as they did here. The court should deny NSO Group’s motion to dismiss this case.”

El Faro is an internationally renowned digital newspaper based in Central America. It is dedicated to in-depth, investigative journalism about human rights, inequality, violence, and government corruption. NSO Group is an Israel-based technology company that develops spyware and sells it to governments around the world—including governments that have been implicated in serious human rights abuses. NSO Group’s signature product, called Pegasus, can infect smartphones surreptitiously to give the spyware’s operators effectively unlimited access to, and control over, the devices. According to the lawsuit, El Faro members suffered 226 Pegasus attacks over the course of 18 months, and these attacks were part of a broader campaign against the press and civil society in El Salvador, in which at least nine organizations and 35 individuals were targeted.

The lawsuit alleges that NSO Group’s actions in developing spyware and assisting in its deployment against El Faro journalists violated, among other laws, the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act. In addition to asking the court to rule that the Pegasus attacks against the plaintiffs violated U.S. law, the lawsuit asks the court to require NSO Group to identify, return, and then delete all information it obtained through these attacks; to prohibit NSO Group from deploying Pegasus again against the plaintiffs; and to require NSO Group to identify the client that ordered the surveillance.

Read today’s brief here. 

Read more about the lawsuit, Dada v. NSO Group here.

In addition to DeCell, lawyers on the case include Jameel Jaffer, Alex Abdo, Stephanie Krent, Evan Welber Falćon, and Mayze Teitler of the Knight First Amendment Institute, and Paul Hoffman and John Washington of Schonbrun, Seplow, Harris, Hoffman & Zeldes LLP.

For more information, contact: Adriana Lamirande, adriana.lamirande@knightcolumbia.org. 

The following can be attributed to Carrie DeCell, senior staff attorney at the Knight First Amendment Institute at Columbia University.

“We’re pleased that the Supreme Court rejected NSO Group’s petition. Today’s decision clears the path for lawsuits brought by the tech companies, as well as for suits brought by journalists and human rights advocates who have been victims of spyware attacks. The use of spyware to surveil and intimidate journalists poses one of the most urgent threats to press freedom and democracy today.”

Late last year, the Knight Institute filed a lawsuit in U.S. federal court against NSO Group on behalf of journalists and other members of the leading Central American news organization El Faro, who were the victims of spyware attacks using NSO Group’s Pegasus technology. The case was the first filed by journalists against NSO Group in a U.S. court. The lawsuit alleges that NSO Group’s actions in developing spyware and deploying it against El Faro journalists violated, among other laws, the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act.

Read more about the Knight Institute’s case, Dada v. NSO Group, here.

For more information, contact: Adriana Lamirande, adriana.lamirande@knightcolumbia.org. 

“These spyware attacks were an attempt to silence our sources and deter us from doing journalism,” said Carlos Dada, El Faro’s co-founder and director. “We are filing this lawsuit to defend our right to investigate and report, and to protect journalists around the world in their pursuit of the truth.”

El Faro is an internationally renowned digital newspaper based in El Salvador. It is dedicated to investigative and in-depth journalism about human rights, inequality, violence, and government corruption. NSO Group is an Israel-based technology company that develops spyware and sells it to governments around the world—including governments that have been implicated in serious human rights abuses. NSO Group’s signature product, called Pegasus, can infect smartphones undetected to give the spyware’s operators access to contact lists, calendar entries, text messages, emails, search histories, GPS locations, and more. According to today’s complaint, the Pegasus spyware attacks against El Faro were part of a broader campaign against the press and civil society in El Salvador, in which at least nine organizations and 35 individuals were targeted.

“The use of spyware to surveil and intimidate journalists poses a truly urgent threat to press freedom,” said Carrie DeCell, senior staff attorney with the Knight First Amendment Institute. “American courts must ensure that spyware manufacturers are held accountable for their actions where those actions violate U.S. law, as they did in this case.”

The complaint filed today alleges that NSO Group’s actions in developing spyware and deploying it against El Faro journalists violated, among other laws, the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act. In addition to asking the court to rule that the Pegasus attacks against El Faro and its reporters violated U.S. law, the lawsuit asks the court to require NSO Group to identify, return, and then delete all information it obtained through these attacks; to prohibit NSO Group from deploying Pegasus again against the plaintiffs; and to require NSO Group to identify the client that ordered the surveillance. The plaintiffs are filing the lawsuit in the same district in which two other lawsuits have been filed against NSO Group: one by Apple, and one by WhatsApp. The Supreme Court is expected to decide imminently whether to grant a cert petition filed by NSO Group in the WhatsApp case.

“NSO Group and other mercenary spyware manufacturers are supplying authoritarian governments with the tools to stifle dissent and crush press freedom,” said Jameel Jaffer, the Knight Institute’s executive director. “Courts must ensure that spyware manufacturers and their clients do not enjoy impunity for unlawful practices that have profound implications for democracy and human rights around the world.”

The Pegasus attacks on the plaintiffs’ phones were undetectable at first, but analyses conducted by the Citizen Lab at the University of Toronto’s Munk School of Global Affairs & Public Policy identified 226 Pegasus infections on devices used by El Faro employees between June 2020 and November 2021. The attacks intensified around the publication of major El Faro stories, damaged devices used by employees for both professional and personal purposes, and exposed the journalists’ sensitive information to NSO Group and its unidentified client.

“NSO Group has supplied government clients with powerful surveillance capabilities that have been widely abused worldwide to target civil society, lawyers, and journalists,” said Ron Deibert, professor of political science and director of the Citizen Lab. “Hopefully, this type of litigation will contribute to deterring such a callous disregard for human rights by both NSO Group as well as all companies in the mercenary spyware industry.”

Read today’s complaint here.

Read this press release in Spanish here.

In addition to DeCell and Jaffer, lawyers on the case include Alex Abdo, Stephanie Krent, Evan Welber Falćon, and Mayze Teitler of the Knight First Amendment Institute, and Paul Hoffman and John Washington of Schonbrun, Seplow, Harris, Hoffman & Zeldes LLP.

For more information, contact: Adriana Lamirande, adriana.lamirande@knightcolumbia.org. 

“Estos ataques de programas espía fueron un intento de silenciar nuestras fuentes y disuadirnos de hacer periodismo”, denunció Carlos Dada, cofundador y director de El Faro. “Presentamos esta demanda para defender nuestro derecho a investigar e informar, y para proteger a los periodistas de todo el mundo en su búsqueda de la verdad”.

El Faro es un periódico digital de renombre internacional con sede en El Salvador. Se dedica al periodismo de investigación y de fondo que aborda asuntos de derechos humanos, desigualdad, violencia y corrupción gubernamental. NSO Group es una empresa tecnológica con sede en Israel que desarrolla programas espía y los vende a Gobiernos de todo el mundo, incluidos aquellos que han estado implicados en graves abusos de derechos humanos. El producto estrella de NSO Group, llamado Pegasus, puede infectar los teléfonos inteligentes sin ser detectado y dar a los operadores del programa espía acceso a las listas de contactos, entradas de calendario, mensajes de texto, correos electrónicos, historiales de búsqueda, ubicaciones del GPS y mucho más. Según la denuncia presentada hoy, los ataques con el programa espía Pegasus contra El Faro formaban parte de una campaña más amplia en contra de la prensa y la sociedad civil en El Salvador, en la que fueron atacadas, al menos, 9 organizaciones y 35 personas.

“El uso de programas espía para vigilar e intimidar a periodistas representa una amenaza en verdad urgente para la libertad de prensa”, declaró Carrie DeCell, abogada principal en el Knight First Amendment Institute “Los tribunales estadounidenses deben garantizar que los desarrolladores de programas espía rindan cuentas de sus acciones cuando estas violen la legislación de los Estados Unidos, como ocurrió en este caso”.

La demanda presentada hoy alega que las acciones de NSO Group al desarrollar el programa espía y utilizarlo contra los periodistas de El Faro violaron, entre otras leyes, la Ley de Fraude y Abuso Informático y la Ley Integral de Fraude y Acceso a Datos Informáticos de California. Además de pedir al tribunal que dictamine que los ataques con Pegasus contra El Faro y sus periodistas violaron la legislación estadounidense, la demanda solicita al tribunal lo siguiente: que exija a NSO Group que identifique, devuelva y luego borre toda la información que obtuvo mediante estos ataques; que prohíba a NSO Group utilizar Pegasus de nuevo contra los demandantes, y que exija a NSO Group que identifique al cliente que ordenó la vigilancia. Los demandantes presentan la petición en el mismo distrito en el que se han presentado otras dos demandas contra NSO Group: una de Apple y otra de WhatsApp. Se espera que el Tribunal Supremo decida de forma inminente si acepta la solicitud de revisión que NSO Group ha presentado en el caso de WhatsApp.

“NSO Group y otros desarrolladores mercenarios de programas espía están suministrando a los Gobiernos autoritarios las herramientas para sofocar la disidencia y aplastar la libertad de prensa”, acusó Jameel Jaffer, director ejecutivo del Knight Institute. “Los tribunales deben garantizar que los desarrolladores de programas espía y sus clientes no disfruten de impunidad por cometer prácticas ilegales que tienen notables repercusiones para la democracia y los derechos humanos en todo el mundo”.

Los ataques de Pegasus a los teléfonos de los demandantes eran indetectables al principio, pero los análisis realizados por el Citizen Lab de la Escuela Munk de Asuntos Globales y Políticas Públicas de la Universidad de Toronto identificaron 226 infecciones de Pegasus en los dispositivos utilizados por los empleados de El Faro entre junio de 2020 y noviembre de 2021. Los ataques se intensificaron en torno a la publicación de las principales historias de El Faro, dañaron los dispositivos utilizados por los empleados tanto para fines profesionales como personales, y expusieron información sensible de los periodistas a NSO Group y a su cliente no identificado.

“NSO Group ha suministrado a clientes gubernamentales capacidades de vigilancia poderosas de las que se ha abusado ampliamente en todo el mundo para atacar a la sociedad civil, abogados y periodistas”, dijo Ron Deibert, profesor de Ciencias Políticas y director del Citizen Lab. “Esperemos que este tipo de litigio contribuya a disuadir este desprecio insensible por los derechos humanos tanto por parte de NSO Group como de todas las empresas de la industria mercenaria de programas espía”.

Lea la denuncia de hoy aquí.

Lea este comunicado de prensa en inglés aquí.

Además de DeCell y Jaffer, los abogados del caso son Alex Abdo, Stephanie Krent, Evan Welber Falcón y Mayze Teitler, del Knight First Amendment Institute, y Paul Hoffman y John Washington, de Schonbrun, Seplow, Harris, Hoffman & Zeldes LLP.

CONTACTO: Adriana Lamirande, adriana.lamirande@knightcolumbia.org. 

In particular, NSO’s letter advances the company’s push for removal from the U.S. Department of Commerce’s “Entity List,” a blacklist that restricts the transfer of certain kinds of technology and information between the United States and foreign entities involved in “activities contrary to U.S. national security and/or foreign policy interests.” The Biden administration added NSO to the Entity List in 2021, citing a desire to “stop the proliferation and misuse of digital tools used for repression.” The designation has reportedly posed a serious financial threat to NSO, which underwent restructuring earlier this year. To obtain a reversal of the designation, the company enlisted a number of lobbyists and white shoe law firms to court Congressional representatives and administration officials, spending $1.5 million on lobbying in 2022 alone.

These lobbying efforts appear to have fallen flat with the Biden administration. In May, the White House issued an executive order prohibiting federal agencies from using spyware that has been linked to human rights abuses, which includes NSO’s products. When asked about NSO’s recent letter, one senior U.S. official told Politico that the administration “is not contemplating any changes” to NSO’s blacklist status—not least because “revelations of misuse” of NSO’s spyware have “continued unabated” since the executive order. Just last September, researchers reported Pegasus infections on the phone of an employee of a Washington, D.C.–based civil society organization and on the phone of journalist Galina Timchenko, head of the independent Russian news outlet Meduza.

These recent revelations follow years of reports linking Pegasus to spyware attacks “maliciously target[ing] government officials, journalists, businesspeople, activists, academics, and embassy workers.” Pegasus enables its operators to obtain near-total control of a smartphone, including access to contact lists, text messages, search histories, and GPS locations. The spyware can even turn on a smartphone’s microphone and camera, all without detection.

In the hands of repressive governments, Pegasus has dangerous implications for lawful dissent, freedom of the press, and democracy. Indeed, researchers and journalists have documented uses of the spyware against Thai activists, French cabinet ministers, and family members of Jamal Khashoggi, a journalist assassinated in the Saudi Arabian consulate in Istanbul, Turkey, among hundreds of other victims.

To hold NSO and its clients to account for these abuses, spyware victims have filed lawsuits around the world—including in the United States. The Knight First Amendment Institute, a nonprofit organization based at Columbia University where we work, represents journalists and other members of the Salvadoran news outlet El Faro in one such suit. Between June 2020 and November 2021, at least twenty-two people associated with El Faro were targeted with repeated Pegasus attacks, which intensified around the publication of major stories exposing criminal activity and human rights abuses by the Salvadoran government. The case, Dada v. NSO Group, seeks to hold NSO accountable for its role in those spyware attacks and to force it to disclose the client who ordered them. Apple and WhatsApp have also sued NSO in federal court, alleging that the firm deployed Pegasus through their U.S.-based infrastructure, thereby injuring their users and their businesses.

While NSO seeks to rehabilitate its image in the U.S. government, it scrambles to avoid accountability in U.S. courts. In Dada and the other cases brought against NSO in the United States, the firm has moved for dismissal on a number of grounds. Indeed, NSO goes so far as to argue that the very fact of its placement on the Entity List makes the United States an inconvenient forum for litigation. One court has rightly rejected that argument.

The cases brought against NSO and similar spyware companies represent a crucial step toward protecting the press and the public from the urgent threat of surveillance technology. But, despite preliminary victories, the outcome of these cases is still uncertain. In the meantime, governments continue to use NSO’s spyware to malicious and dangerous ends. It is therefore crucial that NSO remain on the Entity List, as the designation is among the few sanctions on the spyware company for its role in repressing free speech and other human rights around the world.

This may read like an eerie movie scene, but there are many Central American journalists who have lived it for real. The suspicion you’re being followed, ditching your phone before meetings, using encrypted messaging and email apps, speaking in code, never publishing your live location—these are ordinary routines for many in my profession.

I wouldn’t know until more than a year later what my source really meant. My colleagues weren’t just being trailed as they investigated that story. They, and at least 18 other members of El Faro—including me—had been the repeated targets of a weapons-grade espionage software called Pegasus. Pegasus is the gleaming toy of the Israel-based spyware firm NSO Group. Forensic analysis by the Citizen Lab and others found that Pegasus attacks in El Salvador started in June 2020 and continued until November 2021. In all, 35 journalists and members of civil society were spied on with this tool.

When you’re infected by Pegasus, spies effectively hold a clone of your phone. They can see everything, from your personal pictures and texts to your purchases and your selection and use of apps. When the spying was discovered I had to take measures that included exiting my family group chat and deleting my banking apps.

For journalists, this means spies can see every chat and phone call with our sources. I was hacked while I pursued and published private videos of two brothers of President Nayib Bukele negotiating over El Salvador’s Bitcoin Law with foreign businessmen before it came into effect. My colleagues Gabriela Cáceres and Carlos Martínez were hacked as they continued to reveal more details about the government’s dealing with gangs and a thwarted criminal investigation about it. I could go on and on.

Journalism has become even harder after the attacks. When news of the hacking broke, a few sources jokingly answered our calls by greeting the good people who might be listening. But many more picked up the phone only to say we should stop calling them, and most simply didn’t respond at all. In one instance, a source told me that he now understood why his wife had been fired from her government position. I felt horrible. Guilty. Powerless.

That’s how Pegasus makes you feel above all: powerless. We believe the infections in El Faro happened through a “zero-click exploit”, meaning we didn’t even click on a phony link to open a door for the spies. They just broke in. Change your number, get a new device—they’ll just break in there, too.

And yet we refused to be powerless. We told our story to news outlets all over the world. In El Salvador, we held press conferences, went on TV and filed a case before the attorney general’s office. None of this brought any kind of accountability for the illegal spying. So, represented by the Knight First Amendment Institute at Columbia University, 14 of my colleagues at El Faro and I have decided to sue NSO Group.

I can assure you we’re not in this for the money: if we wanted to be rich, we wouldn’t be independent journalists. We’re doing this as a progression of our everyday work in El Salvador to expose official wrongdoing. We’re doing this in the United States because we’ve exhausted all legal avenues in El Salvador’s co-opted institutions.

And we’re doing this not just for us. In April, the Israeli newspaper Haaretz assembled a list of more than 450 law-abiding men and women around the world whose devices had been hacked by NSO Group’s Pegasus. Many of them are not in countries or positions where they can sue.

But someone has to. NSO executives shouldn’t be able to wash their hands as their tools are used to persecute journalists. In a very real sense, NSO set the hounds on us. And now we’re fighting back.