• by Wendy Davis  @wendyndavis, November 30, 2022

A group of journalists with the El Salvador-based news organization El Faro are suing NSO Group for allegedly installing Pegasus spyware on their iPhones.

In a complaint filed Wednesday in federal court in San Jose, California, the journalists, including El Faro director Carlos Dada, say they were repeatedly hacked by the Israeli company NSO Group in 2020 and 2021.

“The Pegasus attacks have profoundly disrupted plaintiffs’ lives and work,” the complaint alleges. 

The journalists, who are represented by the Knight First Amendment Institute at Columbia University, add that the spyware compromised their safety, their sources' safety, and hindered newsgathering efforts.

“The attacks have deterred some sources from sharing information with plaintiffs,” the complaint alleges. “Some plaintiffs have been diverted from pressing investigative projects by the necessity of assessing which data was stolen, and of taking precautions against the possibility that the stolen data will be exploited.”

The Israeli company installed Pegasus to spy on journalists, activists, government officials and others in more than 50 countries, the Washington Post reported last year. 

NSO allegedly installed the malware by exploiting vulnerabilities in Apple devices. After Pegasus has been installed, the software allows third parties to secretly activate smartphones' microphones and cameras, and also to access the owners' messages and contacts, phone logs, social media accounts and web browsing activity, the complaint alleges.

"Defendants have sold Pegasus to authoritarian and rights-abusing governments around the world, and many of those governments have used the spyware to target journalists, human rights activists, and political opponents," the El Faro journalists allege. 

“The attacks -- which intensified around El Faro’s publication of major stories -- damaged devices used by employees for both professional and personal purposes and resulted in the exfiltration of sensitive data to defendants and their clients,” the complaint alleges.

The El Faro employees claim NSO Group violated various federal and state laws, including the federal Computer Fraud and Abuse Act -- an anti-hacking law that prohibits companies from accessing computer servers without authorization.

NSO Group also faces lawsuits by Facebook and Apple.

Facebook's complaint, filed in October of 2019, alleges that NSO installed Pegasus on the phones of approximately 1,400 WhatsApp users, including human rights leaders, journalists, government officials, and diplomats.

NSO argued it's immune from civil lawsuits in the U.S. under the Foreign Sovereign Immunity Act, which protects foreign governments from liability. NSO contended that it was covered by that law because it acted at the direction of foreign governments.

The 9th Circuit Court of Appeals rejected that argument last year, writing that the Foreign Sovereign Immunity Act protects countries, not private companies that license technology to governments.

NSO recently asked the Supreme Court to take up the case. That request is pending.