An Intensifying Danger
Hundreds gathered in Tijuana, Mexico, to denounce the killing of three Mexican journalists. Tijuana was one of dozens of cities nationwide where protesters gathered. Jan. 25, 2021 Photo by Zaydee Sanchez for palabra.
More than a year before learning his iPhone was infected with the invasive Pegasus spyware, Carlos Dada, founder of the Salvadoran news site El Faro, had two separate close encounters with drones that flew into his apartment through a window.
The same thing happened to other journalists in El Salvador, including some of his staff, Dada said in a recent interview with palabra, recalling the incidents from early 2020. After nearly 30 years as a journalist, Dada knows the threats and potential for spying that come with reporting and writing about autocratic governments who view the press with distrust and disdain.
Bewildering as the drones were, though, they only foreshadowed what Dada and other Salvadoran journalists would soon learn: The surveillance they strongly believed they were under was much broader and more sinister than they ever imagined.
Pegasus was created by the Israeli cyber-intelligence firm NSO Group. The company has publicly insisted it sells its software exclusively to governments that agree to use it only on criminals, but it’s a condition that appears to be routinely violated. The spyware gives users anonymous, unprecedented access to someone’s phone – recording a target’s activities using the microphone without the owner’s knowledge, tracking their location, and collecting their emails, text messages, and browsing history.
In the decade the spyware has been around, there have been numerous allegations of governments wrongfully using it to target dissidents and journalists.
But what happened in El Salvador is a particularly disturbing example of the escalating threats against press freedom in Latin America, and the increasingly toxic and dangerous conditions journalists in the region face.
IN EL SALVADOR: “THIS IS A DIFFERENT GAME.”
In the summer of 2021, El Faro reporters suspected that President Nayib Bukele’s administration was listening to their calls because the government always seemed to know what they would write ahead of time, Dada said. Using Amnesty International’s Security Lab Pegasus-detection tool, they confirmed their phones were hacked.
That September, Dada and other journalists asked two cyber-security groups for a more thorough analysis of their phones. What they found was that from July 2020 to November 2021, Pegasus spyware infected the phones of at least 35 individuals, 22 of them journalists from El Faro, according to an investigation published last month by researchers from the University of Toronto’s Citizen Lab, and Access Now, a nonprofit digital civil rights group.
One editor at El Faro had his phone hacked with Pegasus 42 times over the span of less than 16 months, the investigation found. The same probe found Dada’s phone was hacked a dozen times.
The spyware does not leave a trace of who was behind a hack. The investigation, however, did find one unidentified Pegasus customer operating almost exclusively in El Salvador since November 2019. While the probe did not prove the Salvadoran government was the user, it found: “The strong country-specific focus of the infections suggests that this is very likely.”
The NSO Group and President Bukele’s press office did not respond to palabra’s request for comment. The Salvadoran government has repeatedly denied that it used Pegasus or that it even has the resources to use it.
Dada doesn’t believe it.
When Citizen Lab and Access Now analyzed their phones, he said they were able to cross reference the dates of the hacks with the publication of stories critical of Bukele’s administration. One such story from September 2020 described a deal between the government and MS-13 gang leaders, who received special prison privileges in exchange for agreeing to a reduction in homicides and pledging electoral support.
Weeks after the MS-13 story, Bukele went on national television and attacked the press for almost two hours, accusing Dada in particular of money laundering.
“What would really surprise me, what I find right now impossible, is that there is anyone else but the Salvadoran government who was surveilling us through Pegasus,” Dada said.
Reporters from five other media organizations in El Salvador were also targeted with Pegasus hacks, along with two independent journalists and people who worked for human rights groups, the investigation found.
“This is a different game,” Dada said. “It's not that they may be listening to your conversations. It's that they have all the data, they can geolocate you.”
Dada said he felt as if he had someone living with him the entire time his phone was compromised, listening to all his conversations and following him everywhere.
“They have all my photos. They know the people I love. They know the people I frequently see, the people I’m frequently in contact with,” he said. “They know my sources. They know everything.”
The threat to privacy Pegasus poses is so great that one of the world’s largest phone makers is taking the NSO Group to court to stop its use. Apple sued the Israeli company in November 2021 and sent El Faro staffers an alert saying that “state-sponsored attackers may be targeting your iPhone.”
Apple’s lawsuit begins by calling the NSO Group “notorious hackers – amoral 21st-century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse.”
For its part, the NSO Group has sought to highlight the positive ways their product has been used, saying in an annual report that Pegasus has helped governments capture criminals and thwart “numerous major terrorist attacks.” Still, the company acknowledged “the potential misuse of our products against people and groups that act to promote or protect human rights in a peaceful manner,” specifically citing journalists as possible targets.
The obstacles journalists face in El Salvador are all too familiar to reporters in other countries in the region. Across Latin America, reporters who strive to hold the powerful accountable do so at great personal risk from both government officials and members of organized crime who wish to silence them.
IN MEXICO: “JOURNALISTS ARE FED UP.”
As news of the Pegasus in El Salvador broke, reporters in Mexico were experiencing a different trauma. At least six Mexican journalists have been killed in the first two months of the year, including four in January – astonishing even in a country where reporting has always been dangerous. The death toll is already more than half of last year’s total of nine, according to figures from the Committee to Protect Journalists.
The first journalist killed this year was José Luis Gamboa Arenas, founder and editor of Inforegio and La Noticia. He was stabbed to death in Veracruz on Jan. 10.
Seven days later, freelance photographer Alfonso Margarito Martínez Esquivel was fatally shot in his house in Tijuana.
Then María Guadalupe Lourdes Maldonado López, a freelance broadcast journalist, was fatally shot in her car in Tijuana on Jan. 23. Roberto Toledo Barrera, a camera operator and video editor at el Monitor Michoacán, was at a residence to record an interview in the town of Zitácuaro on Jan. 31 when he was fatally shot.
Heber López, director of the online news site Noticias Web, was killed on Feb. 10. The sixth journalist, television host, and model Michelle Pérez Tadeo, who used the name Michell Simon, was found dead on Feb. 22 outside of Mexico City.
As this story was being finalized, there were new reports of yet another murder. Jorge Camero, of El Informativo, a Facebook-based local outlet in the northern state of Sonora, was killed by gunmen at a gym on Feb. 24.
The only arrests have come in the case of Maldonado, who three years ago during a press conference told President Andrés Manuel López Obrador that she didn’t feel safe reporting in her country.
Earlier this month, López Obrador announced the arrests of suspects in Maldonado’s death. “We are working, they are not forgotten,” he said during a news conference.
Since 1992, 142 journalists have been killed in Mexico, according to the Committee To Protect Journalists.
“It has affected us a lot,” Jorge Carrasco, editor of the investigative magazine Proceso, said of the recent spate of homicides. Carrasco added that there had been hope for change after the country transitioned from the seven-decade rule of the Institutional Revolutionary Party (PRI) in 2000.
But it has only gotten worse for journalists since then, said Carrasco, who has decades of experience at several Mexican publications.
“There’s a lot of weariness. Journalists are fed up seeing there is no will to address this problem and no desire to stop this from continuing to happen from any of the administrations we’ve elected,” he said in an interview.
Carrasco said journalists are under a lot of pressure working under the current administration.
“The president considers the press an enemy and so he dedicates himself to discrediting us, and what the president says has great influence,” he said.
Only a few journalists practice the “noble craft” of informing the public, López Obrador said during a news conference last month, just as reporters were demanding justice for their slain colleagues.
Carrasco said it’s often difficult to know who is responsible for a journalist’s death because most of the murders go unsolved.
“We don’t have clarity, whether it’s true to say it’s organized crime, if it’s criminals, or if it’s a combination of criminals and elected officials,” he added.
A challenge for Mexican journalists has been the constant assertion from the country’s elected officials that if a reporter is critical of the government, they must have personal or political motivations.
“The Mexican political class has never understood how the press works, the role journalists play in society,” Carrasco said.
So state and local officials in Mexico tried to bribe journalists over the years, or threatened them to stop a story’s publication, Carrasco said. Before Pegasus began being used in Mexico during President Enrique Peña Nieto’s administration, it was common for journalists to be followed in their cars or have police monitor who they meet with and where. “Surveillance of journalists in Mexico has always existed,” Carrasco said.
In 2018, a Citizen Lab investigation found that Mexico was one of the countries where Pegasus was being deployed the most – not just against journalists, but also with human rights watchdog groups, attorneys, and anti-corruption advocates. The investigation found that 24 individuals had “been abusively targeted with Pegaus in Mexico” and subsequent reporting has shown the number to be much higher.
Last year, an investigation by The Guardian and other international news outlets found that 15,000 Mexicans had been targeted with Pegasus, including journalists, activists, judges, and at least 50 people close to President López Obrador.
Carrasco is among those whose phone was infected.
Pegasus is a “tremendous digital weapon” designed to make journalists live in fear, Carrasco said. “When you know you’re being spied on, or you suspect or fear that you’re being spied on, that someone is finding out things about you and your life – because they’re not only watching what you’re working on but also your personal life – obviously you feel very vulnerable.”
All of Mexican society, from the public and all levels of government, needs to make a genuine commitment to improving conditions for the country’s journalists, Carrasco added.
“My hope is that at some point Mexican society will come out in defense of its journalists. We haven’t experienced that.”
IN HONDURAS: “WE LEARN TO SPEAK IN CODE.”
Dangerous as Mexico is for journalists, Honduras is even worse, according to the Reporters Without Borders World Press Freedom Index, which last year ranked the country 151 out of 180 countries. Mexico is ranked 143. El Salvador is 82. And for those curious about where the U.S. stands: It’s ranked 44.
For Dunia Orellana, co-founder, and director of the media outlet Reportar Sin Miedo in Honduras, Pegasus is no longer a novelty because it’s been in the country for years, she said.
“We’ve learned to live with Pegasus,” she said, adding that she now has more than one phone.
“We know that they’re listening,” Orellana said of the Honduran government. “We know we’re monitored. We know it. So what do we do? We learn to speak in code.”
She said journalists have to learn to live with fear to do their jobs. Still, she considers herself lucky because she’s in the capital city of Tegucigalpa and has access to the Internet and phone lines. But it’s rare for journalists in rural areas to be able to afford two cell phones.
Honduran journalists frequently receive death threats and have few options to protect themselves.
For journalist Thirzia Karina Galeas Núñez, the death threats eventually forced her to move to the U.S. to seek asylum in Georgia, where she now lives with a sibling. Her application is pending.
“There are no institutions in Honduras that ‘protect’ journalists, that protect defenders of human rights,” she said.
Galeas, who for nearly a decade worked at the Comité por la Libre Expresión, a publication about human rights and press freedom, said a turning point came when her employer told her the government had a bounty on her and other reporters.
“Because we confronted the government. We documented their aggressions against journalists,” she said.
She herself had been assaulted by someone she believes was sent by the government. Her case was never solved. She said that when she received death threats, she didn’t get support from non-governmental groups, so she decided to leave the country.
ACROSS LATIN AMERICA, LEADERS WHO SUBVERT THE PRESS
Natalie Southwick, Latin America and Caribbean program coordinator for the Committee to Protect Journalists, said the “rise of increasingly authoritarian leaders” has led to a “global backsliding in democratic norms.”
“One of the things that’s interesting about Latin America compared to other regions where CPJ works is that the majority of countries in the region since we've been doing this work have been at least nominally democracies and so there is a bit of an expectation that there will be more adherence to human rights norms,” she said.
“And yet we’re seeing leaders at the national and even at local levels that either don’t understand the role of the press or are actively trying to limit the ability of the press to do their jobs,” she continued.
Southwick notes that Pegasus isn’t the only spyware available to governments – it’s simply the one that’s received the most attention. She said there should be more pressure from the international community for companies such as the NSO Group to not sell their software to governments with records of human rights violations.
“There’s very little oversight and regulation of these technologies,” she said.
Southwick said perhaps the place to start is investigating and prosecuting those responsible for killing journalists. When no one is arrested and punished, it sends a message to anyone who wants to harm a journalist that they can get away with it, she said.
“Honestly, there are so few cases where we see any sort of progress in solving them. That really has to be where it starts,” she said.
In El Salvador, the hacks appear to have stopped sometime after Apple’s alert to El Faro late last year, Dada said, adding they will eventually run another analysis.
But the strain on their lives remains. Dada said some of his staff is being pressured by their families to quit their jobs, and some have.
“It’s not only how do you report like this, it’s how do you live like this? I mean, knowing that every time you see your family members you’re putting them at risk. Knowing that every time you take a picture you’re putting them at risk,” he said. “Your friends, your family, your social circle, they never asked for this.”
