SAN JOSE, Calif.–Represented by the Knight First Amendment Institute at Columbia University, 15 journalists and other members of El Faro, one of the leading sources of independent news in Central America, today filed suit in U.S. federal court against NSO Group, the company whose malicious surveillance software was used to infiltrate their iPhones and track their communications and movements surreptitiously. In recent years, NSO Group’s spyware has been used by authoritarian and rights-abusing regimes around the world to target journalists, human rights activists, and political dissidents. The case filed today is the first filed by journalists against NSO Group in U.S. court.

“These spyware attacks were an attempt to silence our sources and deter us from doing journalism,” said Carlos Dada, El Faro’s co-founder and director. “We are filing this lawsuit to defend our right to investigate and report, and to protect journalists around the world in their pursuit of the truth.”

El Faro is an internationally renowned digital newspaper based in El Salvador. It is dedicated to investigative and in-depth journalism about human rights, inequality, violence, and government corruption. NSO Group is an Israel-based technology company that develops spyware and sells it to governments around the world—including governments that have been implicated in serious human rights abuses. NSO Group’s signature product, called Pegasus, can infect smartphones undetected to give the spyware’s operators access to contact lists, calendar entries, text messages, emails, search histories, GPS locations, and more. According to today’s complaint, the Pegasus spyware attacks against El Faro were part of a broader campaign against the press and civil society in El Salvador, in which at least nine organizations and 35 individuals were targeted.

“The use of spyware to surveil and intimidate journalists poses a truly urgent threat to press freedom,” said Carrie DeCell, senior staff attorney with the Knight First Amendment Institute. “American courts must ensure that spyware manufacturers are held accountable for their actions where those actions violate U.S. law, as they did in this case.”

The complaint filed today alleges that NSO Group’s actions in developing spyware and deploying it against El Faro journalists violated, among other laws, the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act. In addition to asking the court to rule that the Pegasus attacks against El Faro and its reporters violated U.S. law, the lawsuit asks the court to require NSO Group to identify, return, and then delete all information it obtained through these attacks; to prohibit NSO Group from deploying Pegasus again against the plaintiffs; and to require NSO Group to identify the client that ordered the surveillance. The plaintiffs are filing the lawsuit in the same district in which two other lawsuits have been filed against NSO Group: one by Apple, and one by WhatsApp. The Supreme Court is expected to decide imminently whether to grant a cert petition filed by NSO Group in the WhatsApp case.

“NSO Group and other mercenary spyware manufacturers are supplying authoritarian governments with the tools to stifle dissent and crush press freedom,” said Jameel Jaffer, the Knight Institute’s executive director. “Courts must ensure that spyware manufacturers and their clients do not enjoy impunity for unlawful practices that have profound implications for democracy and human rights around the world.”

The Pegasus attacks on the plaintiffs’ phones were undetectable at first, but analyses conducted by the Citizen Lab at the University of Toronto’s Munk School of Global Affairs & Public Policy identified 226 Pegasus infections on devices used by El Faro employees between June 2020 and November 2021. The attacks intensified around the publication of major El Faro stories, damaged devices used by employees for both professional and personal purposes, and exposed the journalists’ sensitive information to NSO Group and its unidentified client.

“NSO Group has supplied government clients with powerful surveillance capabilities that have been widely abused worldwide to target civil society, lawyers, and journalists,” said Ron Deibert, professor of political science and director of the Citizen Lab. “Hopefully, this type of litigation will contribute to deterring such a callous disregard for human rights by both NSO Group as well as all companies in the mercenary spyware industry.”

Read today’s complaint here.

Read this press release in Spanish here.

In addition to DeCell and Jaffer, lawyers on the case include Alex Abdo, Stephanie Krent, Evan Welber Falćon, and Mayze Teitler of the Knight First Amendment Institute, and Paul Hoffman and John Washington of Schonbrun, Seplow, Harris, Hoffman & Zeldes LLP.

For more information, contact: Adriana Lamirande, adriana.lamirande@knightcolumbia.org.