More than a dozen journalists sue NSO Group in U.S. court over alleged spyware targeting

The lawsuit is the third against the Israeli firm in the U.S., but the first brought by journalists.

More than a dozen journalists and staff at the Salvadoran news outlet El Faro filed suit against the embattled Israeli spyware firm NSO Group on Wednesday, alleging that the company violated U.S. state and federal laws by enabling the illegal surveillance of their phones.

At least 22 staffers at the news outlet were targeted by an unknown party using NSO Group’s Pegasus spyware between June 2020 and November 2021, according to the complaint filed in U.S. federal court. If successfully implanted on targeted devices, the malware allowed the attacker to access contact lists, calendar entries, text and instant messages, notes, emails, search histories and GPS locations, the complaint alleges.

The suit — the first of its kind brought by journalists against NSO Group — asks a federal judge to rule that the Israeli firm violated state and federal hacking laws and to require the company to “identify, return, and then delete all information it obtained through these attacks; to prohibit NSO Group from deploying Pegasus again against the plaintiffs; and to require NSO Group to identify the client that ordered the surveillance,” according to a statement from the Knight First Amendment Institute at Columbia University, the group representing the journalists.

The Pegasus attacks occurred as the reporters were reporting on “abuses by the Salvadoran government,” the complaint alleges, and while the reporters were communicating with confidential sources, “including U.S. Embassy officials.”

The State Department did not immediately respond to a request for comment.

A joint investigation by the Toronto-based Citizen Lab and digital civil rights group Access Now published in January 2022 alleged that journalists at El Faro and other outlets, along with two independent journalists, were targeted with Pegasus while investigating Salvadoran President Nayib Bukele and the Salvadoran government. The investigation tied the attacks to a “Pegasus customer operating almost exclusively in El Salvador since at least November 2019” dubbed “TOROGOZ.”

Bukele’s administration has repeatedly attacked independent media in the country, and in 2021 the State Department issued a lengthy report outlining what it called “significant human rights issues” in the country, including “serious restrictions on free expression and media, including violence or threats of violence against journalists and censorship.”

The Pegasus infections targeting El Faro were part of a broader campaign against civil society organizations and people in El Salvador, the suit alleges, including at least nine organizations and 35 people.

In November 2021, Apple notified people in El Salvador and others around the world that they’d likely been “targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID.” Apple notified the targets the same day it filed suit against NSO Group.

Meta, the parent company of WhatsApp, the messenger service used across the world, is also suing the spyware vendor. NSO Group has asked the U.S. Supreme Court to recognize the company as a foreign government agent in the WhatsApp case, which would limit legal recourse for WhatsApp.

The U.S. government blacklisted NSO Group and another Israeli spyware vendor, Candiru, in November 2021, causing a major disruption to the company. The company has in recent weeks reportedly slashed its expenses and hiked prices in an attempt to weather the financial pressure caused by U.S. sanctions. The company explored a sale to the U.S. defense contractor L3 Harris earlier this year, but that acquisition appears to have collapsed.

NSO Group did not immediately respond to a request for comment Wednesday.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

One House Democrat is pressing Commerce on the government’s spyware use

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems