Carlos Dada
This is the thing. When you start covering organized crime, almost always you start receiving some kinds of pressures to silence you.
Alex Abdo
This is Carlos Dada, a co-founder and editor of the investigative News website, El Faro, originally based in El Salvador. Founded in 1998, it was the first digital news outlet in Latin America. El Faro came into the world a few years after the end of the Salvadoran Civil War into a brand new democracy. Carlos didn't set out the start and use organization focused on covering organized crime and corruption, but that's what El Faro would eventually become known for, and that's where the trouble started.
Carlos Dada
We started receiving threats. I started actively looking for some training programs to protect ourselves, to help us navigate through these new perils. I found out that every single training program for journalists working under dangerous conditions was designed by and for developed countries journalists. These were training courses for US special work correspondents that were going to Iraq, how to protect themselves from explosive devices. This was basically for what we call parachuting journalists from the developed world. There was nothing for people like us.
Alex Abdo
El Salvador's postwar democracy is still fragile. Gang violence was rampant up until a few years ago when the government began a brutal crackdown that's still going on today, but journalists, especially those who are critical of the current government, have also been targeted. As a result, the job of a reporter here can be perilous with threats coming from all sides.
Carlos Dada
We live in the place. We cannot be extracted to go back to our families and our communities. This is our communities. We live there, and this has to do with everything, with your sources, with your family, with your neighbors, but also with the psychological effects. There are hundreds of state-of-the-art programs, particularly the United States for post-traumatic stress. I always ask what happens when there never comes the post stage of this problem
Alex Abdo
Without much in the way of outside help to protect El Faro's reporters and their sources, Carlos and his colleagues turned inward trying to protect themselves the best they could.
Carlos Dada
We had to look inside. We had to start reflecting among ourselves for ways to protect ourselves, to establish some protocols. That included not only the reporting, but also the editing of the publication and each stage.
Alex Abdo
Some of the steps that El Faro took, which we'll hear about in more detail later will probably sound extreme, but even they weren't enough. One day in 2021, a reporter on El Faro's staff started noticing that her phone was behaving weird.
Carlos Dada
Like windows opening and closing, this kind of stuff, and she thought it was just a phone problem, a problem with a phone software. She went to a friend who knows about these things and the guy said, “Look, this doesn't look good. I suggest you look for professional assistance on spyware.”
Alex Abdo
Spyware, something that even the most careful journalists can't evade. Something that if left unchecked threatens to enable authoritarians the world over. This is “Views on First: Speech & the Border,” at the frontiers of censorship and surveillance. I'm Alex Abdo and I'm the litigation director here at the Knight First Amendment Institute at Columbia University. Carlos Dada and his team at El Faro are just some of the brave journalists around the world working to deliver independent reporting about power and corruption. That role of the press of making sure the public knows what government officials are up to is one of its most important, but the job has become much harder.
New technology has made it easier than ever for government officials to spy on those who would challenge or undermine their authority, activists, dissidents and journalists. And without a doubt, the most sophisticated tool used by autocratic regimes around the world is spyware. The brutal murder of Saudi journalist, Jamal Khashoggi, is perhaps the most well-known example of what we are talking about. A columnist for the Washington Post, Khashoggi was a vocal critic of the Saudi ruling family. He eventually fled Saudi Arabia in 2017 when it became clear that his criticism would no longer be tolerated.
Jamal Khashoggi
Mohammed bin Salman, he's arresting intellectuals, arresting independent people who called for fighting corruption, and that's what made me choose to exile myself here in Washington.
Alex Abdo
The following year, he walked into a Saudi consulate in Istanbul and never came out. The world would eventually learn that he had been killed at the command of the Crown Prince of Saudi Arabia, and that the regime appears to have used spyware to track Khashoggi. It's not new for repressive governments to go after journalists. What is new is the ease with which they can do so. By turning journalists own phones against them.
Carlos Dada
We thought a new democratic country needed a new media, a new journalism, more independent and more rigorous and more detached from political agendas, and that's the reason behind El Faro's founding.
Alex Abdo
When Carlos Dada and his friend Jorge Simán founded El Faro in 1998, El Salvador was still reeling from the atrocities of its civil war. Carlos and Jorge had both returned from exile to rebuild, and they decided that the country's new democracy needed a new press, but they drew an important line in the sand.
Carlos Dada
Actually in the beginning, we decided not to cover organized crime for one simple reason, because we couldn't protect our reporters from all the risks that covering organized crime entails. So we decided not to cover organized crime until we basically crashed against organized crime, and there was no other option than to start covering it.
Alex Abdo
Carlos says that happened as his reporters were covering the journeys of central American migrants through Mexico in 2008. Along the way, they uncovered human rights abuses as Mexican cartels preyed on those migrants.
Carlos Dada
This is when we had to make a decision, do we keep reporting on this or we stop because we don't cover organized crime? And we decided that we couldn't stop covering such an important thing that on the contrary, it was very important for Salvadorans to learn the new dangers of the migrants route that millions of Central Americans were taking to the United States. So that's where we started covering properly organized crime. And then of course, came the gangs in El Salvador, and the drug trafficking throughout Central America.
Alex Abdo
El Faro's coverage of the plight of Central American migrants resulted in a huge investigation called El Camino or on the road. They eventually formed an investigative team called Sala Negra Black Salon to specialize in covering gang violence and the government's efforts to combat it. But as El Faro's reporting dug deeper, it also grew riskier. When Salvadoran President Nayib Bukele assumed office in 2019, he promised a crackdown on gang violence. But the following year, El Faro broke news that the Bukele government was secretly negotiating with the gangs. This reporting in hindsight appears to have been what put El Faro on a collision course with its own government.
Nelson Rauda Zablah
I didn't drive the same way to my house from my job every day.
Alex Abdo
Nelson Rauda-Zablah is the digital content editor for El Faro. He started all the way back in 2015 as a reporter leaving for a stint and then returning in a more senior role.
Nelson Rauda Zablah
We held meetings with sources without phones and secret rendezvous points, the type of stuff that you see in movies. I remember I've been driving around with the radio on with the source around town to have a conversation.
Alex Abdo
El Faro knew its reporting might put it in the crosshairs of those in power, and so its journalists took all sorts of precautions. In many ways, they started to act like international spies covering their tracks, but that paranoia was justified. In 2021, a colleague started to complain about weird things happening on her phone. So she went to a specialist who told her to look for an expert on spyware.
Nelson Rauda Zablah
She took a test online. It's a test that you can take to see if your phone is infected, and it came back positive. So when she reported it to the heads of the newsroom, they said, "We should all be tested.”
Alex Abdo
They reached out to The Citizen Lab, a research group at the University of Toronto focused on digital threats to journalists and other non-profits. The lab with help from Access Now, a US-based digital rights group quickly discovered that the phone was indeed infected with spyware, and with a particularly sophisticated kind called Pegasus.
John Scott-Railton
I like to say spyware like Pegasus can do everything that you as a user can do on your phone and some things you can't.
Alex Abdo
This is John Scott-Railton. He usually goes by JSR, and he's a senior researcher at The Citizen Lab and one of the world's foremost experts on spyware.
John Scott-Railton
They're different kinds of spyware. People have probably heard that term before, but what we spend a lot of time working on at the lab is something that we like to call mercenary spyware. So this is pretty sophisticated technology that governments go out and acquire that gives them really easy access to people's devices, their phones, their computers, maybe their smartwatches.
Alex Abdo
Pegasus might be the most well-known mercenary spyware out there. It's made by an Israeli cyber intelligence firm called NSO Group, and at one point the FBI even considered using it. While our government eventually abandoned that effort, Pegasus has been used by other governments around the world. It was found on the phones of Jamal Khashoggi's wife and of one of his close collaborators, and it's what was used against El Faro. If one phone had been infected with Pegasus, others might have been infected too. So JSR asked the El Faro staff to send more phones and they obliged.
Carlos Dada
In the end, we sent every single phone we had.
John Scott-Railton
And The Citizen Lab found that almost all of them were infected. The El Faro case is astonishing. I think what really struck us as researchers was not just the fact that yet again, a ruler with authoritarian tendencies was targeting journalists, but the apparent obsessiveness of the targeting. At the time, we had never seen people who had been reinfected so many times. Now, why would there even be reinfections? Well, it's our understanding that most Pegasus infections are designed not to persist across the phone being restarted. That's a feature, not a bug, and it makes Pegasus a lot harder to find for researchers and investigators and others. But that also creates an interesting dynamic, which is if you can analyze a person's phone who is targeted by Pegasus and you see that they were reinfected many times, you can make certain guesses about how much that person was in the crosshairs of an autocrat. And I remember the looking through the list of targeting dates for some of the folks from El Faro and just being astonished.
Alex Abdo
How is it possible that someone managed to install spyware on the phones of 22 of El Faro's 34 member team? The answer to that question is perhaps the scariest thing about Pegasus. If you're targeted with it, there's not much you can do. Even worse, you probably won't ever know. In other words, Pegasus is unstoppable and invisible. It's a nearly perfect surveillance tool. It's worth understanding, at least generally how it works. Here's JSR again. Keep in mind that he's giving us a very simplified explanation because spyware like Pegasus is constantly evolving.
John Scott-Railton
Let's imagine that somebody walks into the Pegasus control room at a Pegasus customer site in some country. They've got a piece of paper, and that piece of paper has the name of a journalist and she has apparently been causing a lot of trouble for the dear leader of that country. Paper gets handed to an operator, “Do something about this person.” On that paper, it's a journalist's phone number. So the operator is going to take that paper and probably will start by entering in that person's phone number into a console.
Alex Abdo
That console will talk to some servers, and those servers will try to confirm three things.
John Scott-Railton
That the phone is on, that it has an operating system that can be targeted, and perhaps that it's in that country or a country where they have a license to do some targeting from NSO. The answers to those questions are yes, an exploit will be sent to the target's phone. Now, she's not going to notice anything if this works. One moment, her phone will be hers entirely private, and the next minute a digital door that her phone manufacturer doesn't even know about will be used to place a piece of malicious code onto her phone. What's it going to do? Well, the exploits, which is what we're talking about, if we're talking about her not having to place any interaction, not have to click anything, then we're talking about what's called a zero-click exploit. So once that infection process happens, once the targeting happens, once some implant is put on this journalist's phone.
Alex Abdo
At that point, the Pegasus operator has essentially free reign over the phone to do whatever they want.
John Scott-Railton
Maybe they want to take a look at all of her past WhatsApp chats that are recorded in her WhatsApp database. Maybe they're interested in her contact lists or her call logs. Maybe they want to peek at her emails, or her voice notes, or her private and intimate photographs. For them, it's really more a menu of what achieves their aims. And if the goal is to silence and shut that journalist down, maybe they want personal stuff. If the goal is to figure out her sources, maybe they want to see who she's texting on an encrypted chat app. If the goal is to try to get in front of her story, maybe they're going to look at her inbox. Maybe they're going to try to see what documents she's been browsing.
Alex Abdo
In order to work on the kinds of sensitive stories El Faro was publishing, its journalists had to build trust with their sources by promising to protect their identities. The Pegasus hack meant that those journalists could no longer guarantee that protection. Carlos immediately felt that the public needed to know what had happened.
Carlos Dada
We decided that we needed to go public with this, and we started thinking about the publication of this, the journalistic part of making it public. How do we do it? What do we say about this? And we decided to do well, a basic thing, which was crossing all the data that Citizen Lab gave us, which included all the logs of the hacking into everybody in El Faro's phones, dates, telephone numbers, and we crossed this information with our publications, and we found the big red dots around the dates of our most sensitive publications.
Alex Abdo
The Citizen Lab was not able to pinpoint exactly who was responsible for using Pegasus against El Faro, but they did have evidence that the operator of the spyware was located within El Salvador itself. This plus the timing of the attacks suggested that the culprit was the Salvadoran government.
Carlos Dada
We were reporting, and we ended up publishing an explosive story about El Salvador's Bukele's government negotiating with the criminal gangs for political benefits. So we were reporting this, which was a very damaging story for the government, and that's where the government started to harass us and to try to delegitimize us, way before we published. They already knew about this, and this is when they intensified their hacking with Pegasus.
Alex Abdo
On January 12th, 2022, El Faro published a story detailing the hack. It served two purposes. First, Carlos says, the public needed to know how its government was treating its press. But second, Carlos says that El Faro's sources deserve to know, and this was a way to inform them that they too had been compromised. Nelson Rauda Zablah, El Faro's digital editor says that after the story came out, things changed.
Nelson Rauda Zablah
There's people who just wouldn't talk to us after the fact because they knew that what they were facing. And we live under a government that routinely and systematically conducts polygraph tests, lie detection tests to its employees. So we know this is part of the culture here, but people know that the price of talking to a photojournalist has increased. This is not an attack on journalists. This is an attack on the people right know. Because when we are limited from the ability that we have to gather and collect information freely doing so without consequences, it's a damage on the society and how much the society can know about what the government is doing that the government doesn't want them to know.
Alex Abdo
Nelson says that the hack didn't just kill El Faro's sources. It also killed the reporters, learning that someone somewhere was in and out of his phone for the better part of a year felt deeply violating to Nelson.
Nelson Rauda Zablah
I remember the first things I did, I did two things. I deleted all of the banking apps from my phone out of shock or some emotional reaction because I thought, “Wow. They have all my information in my messages. They better not have access to all my accounts and see the $52 that I have in my savings account.” And then the other thing I did was that I exited my family chat group and I said, “Listen, I'm going to exit. I'll explain to you later.” And then I did because I was concerned that they would find access to pictures of my family, especially the little children in my family.
Alex Abdo
Carlos says other people on staff also faced personal fallout after El Faro went public about the hack.
Carlos Dada
In the case of some of our colleagues, some relatives were furious. Some relatives were demanding them to quit journalism because since they were practicing journalism, they were putting their families at risk. The partner of one of our colleagues told one of our colleagues, “You cross the red line. If you want to take risks, you take all the risks you want, but they have the pictures of my daughter, and that's a red line.”
Alex Abdo
Carlos and his team didn't stop at going public. They sought justice first in El Salvador, but-
Nelson Rauda Zablah
We ran out of options rapidly in El Salvador. So when the Knight Institute approached to us with this possibility, we jumped on it. I personally was very enthusiastic about it, not because I was optimist on the result or whatever, but because I felt that for once we would stop complaining or defending ourselves and go on the attack, go on trying to take the narrative, take the protagonist side of the story.
Alex Abdo
Here is where we come into the story. Nelson is referring to a lawsuit that we filed in US Federal Court on behalf of him, Carlos, and over a dozen of their colleagues. We filed the suit against NSO Group in California in November, 2022, arguing that the company's role in the attacks on El Faro violated the US laws that forbid hacking. This wasn't the first suit filed against NSO Group and US Court, but it was the first filed by journalists who had been attacked using the company's services. You might be wondering though, why is a Salvador Newsroom suing an Israeli company in US court? The reason is actually pretty straightforward.
One of Pegasus signature functions is the ability to infect an Apple iPhone without any interaction by the phone's owner. To build that capability, NSO Group has to target and exploit Apple software and services. It has to study the way Apple iPhones work, how those phones interact with Apple servers and services, and where there might be hidden vulnerabilities in the system. And once it discovers those vulnerabilities, NSO has to figure out how to exploit them to deliver Pegasus, to infect a specific iPhone in a way that can't be prevented or detected, at least not easily. All of that, as you might've noticed, involves Apple, a US company based in California, which we argued in our case, opened NSO Group up to being sued here. In fact, by the time we filed our case, apple itself had already sued NSO Group in the same court. Nelson and El Faro says he got involved in the case to seek accountability.
Nelson Rauda Zablah
I want to know who was behind this. I want someone to take responsibility. They're profiting from harassing and pursuing people like me and my colleagues and my friends and my family, even if just for the legal fees that it would cost them, I want them to lose money because they have already made money out of me. So it's pursuing some retaliation that I know wasn't going to come in my country, and it just turned a light on that we didn't think existed.
John Scott-Railton
Here's the thing. Despite all these abuses and a lot of publicity growing around them, not a lot was impacting the fortunes of these companies.
Alex Abdo
JSR says spyware companies operate without any accountability, and so it was up to their targets to take control of the narrative. Unfortunately, whether US Courts will play any role in holding spyware manufacturers to account is still very much up in the air. In March of 2024, a federal judge dismissed our case saying that it doesn't belong in US Court, even though the same judge allowed the Apple lawsuit against NSO Group to go forward on the same theory, that NSO deliberately targeted a US company and so exposed itself to being sued in the US.
And while Apple's suit was allowed to go forward, the company recently withdrew it's case saying it was worried it would have to reveal sensitive information about its security systems. But still there are promising signs. WhatsApp is pursuing its own case against NSO Group. And while that case has not been without its own difficulties, it is still progressing. And we filed an appeal in our case on behalf of El Faro, which will probably be decided next summer. We're hopeful that the appeals court will agree with us that spyware manufacturers that target the infrastructure of US technology companies can be sued in the US.
While the litigation against NSO unfolds, there have also been promising developments in spyware policy. A few years ago, the US Commerce Department added NSO and a few other spyware companies to its entity list, which has the effect of restricting the export of the company's. Around the same time, a group of human rights experts at the United Nations called for a global moratorium on the sale of spyware until countries around the world put in place rigorous regulations on its use. And then last year, the Biden administration issued a joint statement with 11 other countries committing to do just that, supporting what the statement called, “Strict domestic and international controls on the proliferation and use of commercial spyware.”
Since then, 10 more countries have joined the list for a total of 21. President Biden also signed an executive order restricting the purchase and use of spyware by federal agencies. And earlier this year, the State Department announced a new policy that allows visa restrictions to be placed on people involved in the misuse of commercial spyware. Of course, this forward momentum comes with a giant orange asterisk. The incoming president may very well abandon the Biden administration's commitment to regulate spyware, and the authoritarian slide around the world is likely to favor the makers of spyware rather than its regulators, which is why at the end of the day is crucial that the targets of spyware like Carlos, Nelson, and the rest of their colleagues at El Faro continue to fight for their day in court.
Carlos Dada
It's about time to let NSO know, first of all, that we are not frozen out of fear in a corner, that we are ready to respond to these threats against us. But second, to let NSO know that their impunity will not last forever.
Alex Abdo
On the next episode of “Views on First,” TikTok and the effort by the US government to ban it from the country.
Anupam Chander
It seems exactly the opposite of everything that the United States stands for, and it looks alarmingly and ironically much more like the Chinese Internet.
Alex Abdo
That's next time. I'm Alex Abdo at the First Amendment Institute. Thank you for listening to this episode. My colleague, Carrie DeCell, interviewed Nelson Rauda Zablah and John Scott-Railton for this episode, and she's the lead on our litigation against NSO Group. “Views on First: Speech & the Border” is co-produced by Ann Marie Awad and Kushal Dev. Our executive producer is Candace White. Our engineer is Patrice Mondragon. Fact-checking by Kushal Dev. The art for our show was created by Nash Weerasekera. Our theme music was composed by Grayton Newman with additional music from Epidemic Sound. “Views on First” is available on Apple, Spotify, and wherever you listen to podcasts. Please subscribe and leave a review. We'd love to know what you think. To learn more about our work and to listen to previous seasons of this podcast, visit knightcolumbia.org, that's Knight with a K, and follow us on social media. Thanks for listening.