More than a dozen journalists sue NSO Group in U.S. court over alleged spyware targeting

More than a dozen journalists and staff at the Salvadoran news outlet El Faro filed suit against the embattled Israeli spyware firm NSO Group on Wednesday, alleging that the company violated U.S. state and federal laws by enabling the illegal surveillance of their phones.

At least 22 staffers at the news outlet were targeted by an unknown party using NSO Group’s Pegasus spyware between June 2020 and November 2021, according to the complaint filed in U.S. federal court. If successfully implanted on targeted devices, the malware allowed the attacker to access contact lists, calendar entries, text and instant messages, notes, emails, search histories and GPS locations, the complaint alleges.

The suit — the first of its kind brought by journalists against NSO Group — asks a federal judge to rule that the Israeli firm violated state and federal hacking laws and to require the company to “identify, return, and then delete all information it obtained through these attacks; to prohibit NSO Group from deploying Pegasus again against the plaintiffs; and to require NSO Group to identify the client that ordered the surveillance,” according to a statement from the Knight First Amendment Institute at Columbia University, the group representing the journalists.

The Pegasus attacks occurred as the reporters were reporting on “abuses by the Salvadoran government,” the complaint alleges, and while the reporters were communicating with confidential sources, “including U.S. Embassy officials.”

The State Department did not immediately respond to a request for comment.

A joint investigation by the Toronto-based Citizen Lab and digital civil rights group Access Now published in January 2022 alleged that journalists at El Faro and other outlets, along with two independent journalists, were targeted with Pegasus while investigating Salvadoran President Nayib Bukele and the Salvadoran government. The investigation tied the attacks to a “Pegasus customer operating almost exclusively in El Salvador since at least November 2019” dubbed “TOROGOZ.”

Bukele’s administration has repeatedly attacked independent media in the country, and in 2021 the State Department issued a lengthy report outlining what it called “significant human rights issues” in the country, including “serious restrictions on free expression and media, including violence or threats of violence against journalists and censorship.”

The Pegasus infections targeting El Faro were part of a broader campaign against civil society organizations and people in El Salvador, the suit alleges, including at least nine organizations and 35 people.

In November 2021, Apple notified people in El Salvador and others around the world that they’d likely been “targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID.” Apple notified the targets the same day it filed suit against NSO Group.

Meta, the parent company of WhatsApp, the messenger service used across the world, is also suing the spyware vendor. NSO Group has asked the U.S. Supreme Court to recognize the company as a foreign government agent in the WhatsApp case, which would limit legal recourse for WhatsApp.

The U.S. government blacklisted NSO Group and another Israeli spyware vendor, Candiru, in November 2021, causing a major disruption to the company. The company has in recent weeks reportedly slashed its expenses and hiked prices in an attempt to weather the financial pressure caused by U.S. sanctions. The company explored a sale to the U.S. defense contractor L3 Harris earlier this year, but that acquisition appears to have collapsed.

NSO Group did not immediately respond to a request for comment Wednesday.