Senior human rights officials have repeated calls for a ban on the powerful Israeli spyware Pegasus until safeguards are in place to protect civilians from illegal hacking by governments.
Calls for a moratorium on the sale and use of military-grade spyware were made Wednesday during an Inter-American Commission on Human Rights (IACHR) hearing into widespread illegal surveillance using Pegasus spyware. against journalists and activists in El Salvador.
“There’s no question that malware marketed for complex security threats is manipulated and used against the media and civil society…which has a chilling effect on democracy,” said Scott Campbell, senior intelligence officer. human rights and technology at the office of the United Nations High Commissioner. Commissioner for Human Rights.
“Pegasus malware should stop being marketed and used until there are better global and national safeguards.”
The IACHR hearing follows a joint investigation published in January by Access now and Citizen Lab which confirmed the use of the NSO group’s Pegasus spyware against 35 journalists and human rights defenders in El Salvador.
The hack took place over 18 months, from July 2020 to November 2021, and included 22 of the investigative newspaper El Faro. One journalist was hacked 49 times, another almost constantly for 269 days.
Amnesty International’s Safety Lab has peer-reviewed the results and independently verified forensic evidence showing that the military-grade spyware was operated by a single customer in the country, suggesting that the Salvadoran government was the likely operator.
“We urge El Salvador to put in place an immediate moratorium on the use of spyware technology,” said Likhita Banerji of Amnesty International, who calls for international standards and national legislation to limit surveillance, demand greater great oversight and transparency on contracts, as well as remedies. for illegally targeted victims.
El Salvador is one of the deadliest countries in the Americas where gangs, extrajudicial violence, corruption and poverty have forced hundreds of thousands of people to migrate over the past decade.
The unlawful cyber-surveillance took place amid growing attacks on independent news outlets and human rights groups following the election of self-proclaimed reformer Nayib Bukele in June 2019, the hearing said. This included the banning of El Faro from government press conferences, the withholding of information by ministries, an upsurge in online and in-person harassment, as well as threats and physical violence (including threats of violence sexual) against women journalists.
El Faro’s Carlos Dada said the hack coincided with investigations into controversial and potentially embarrassing stories about the president’s dealings with street gangs, dealings with Venezuelan officials, government corruption and the passage of the bitcoin as legal tender. “We fear for ourselves, our families and our sources,” said Dada, whose phone has been under surveillance for 167 days.
El Salvador’s cases add to the results of the Pegasus projectan international consortium of 17 news agencies, including The Guardian, on spyware abuses by the governments of at least 10 countries, including Mexico, Saudi Arabia and India.
The project, coordinated by the French non-profit group Forbidden Stories, reported last year on a leaked database containing tens of thousands of phone numbers of activists, lawyers, academics, journalists, politicians, business leaders, priests and dissidents believed to have been selected as persons of interest by NSO’s government clients.
Once infected with Pegasus, operators have full access to the phone, including the ability to intercept calls, read text messages and emails, control the microphone and camera, infiltrate encrypted apps, and to track an individual’s physical location.
During Wednesday’s hearing, the Salvadoran government denied any knowledge of the illegal hacks, arguing that officials had also been targeted by the Pegasus spyware. “An extensive investigation is underway,” said a representative from the attorney general’s office, who accused the victims of blocking the investigation by not sharing information, a charge vigorously denied by reporters.
NSO says it only sells its software to approved government customers to prevent “terrorism and serious crime.”
John Scott Railton, a senior fellow at Citizen Lab with years of experience tracking Pegasus, said it’s not uncommon for governments to spy on their own officials and questioned the so-called in-depth investigation of the government. “I am not aware of any government contact with my team.
Representatives of the IACHR also seemed unconvinced by the government’s investigation.
“It was a serious attack on democracy and democratic standards… we don’t want to keep a list but so many rights have been violated,” said Margarette May Macaulay, rapporteur on the rights of people of African descent and against racial discrimination. “The investigation must be as rigorous as possible and as quickly as possible… [But] there does not appear to be any urgency on the part of the state.