Some of the most courageous journalists in the world write for El Faro, a Salvadoran news organization whose fearless, independent reporting about corruption, violence, and human rights abuses in Central America has earned it the gratitude of readers all over the world—and the enmity of criminal gangs and authoritarian governments. Beginning in June 2020, at least 22 people associated with El Faro were the targets of spyware attacks. Over a period of about 18 months, their iPhones were accessed remotely and surreptitiously, their communications and activities monitored, and their personal data stolen. Many of these attacks occurred when the journalists were communicating with confidential sources, and reporting on abuses by the Salvadoran government.
 
The spyware used in the attacks was developed by NSO Group, an Israeli company whose malicious surveillance software has been implicated in dozens of attacks on civil society actors around the world. NSO Group’s signature product—called Pegasus—was used against journalists in Hungary, human rights activists in Kazakhstan, and Saudi political dissidents in Europe and North America. Groups including the University of Toronto’s Citizen Lab, Amnesty International, and Access Now have documented many other instances in which authoritarian governments used NSO Group’s spyware to reach across borders to stifle dissent. In response to this evidence, the U.S. Commerce Department added NSO Group to a sanctions list last year.
 
Yesterday, the Knight Institute filed suit against NSO Group on behalf of 15 of the El Faro employees whose iPhones were infected with Pegasus spyware. (Ronan Farrow wrote about the case for The New Yorker here.) Our complaint explains that NSO Group’s development and deployment of the spyware violated, among other laws, the Computer Fraud and Abuse Act, which prohibits accessing computers without authorization. We argue that our case belongs in a U.S. court because the spyware attacks violated U.S. law, because they were intended to deter journalism that is important to hundreds of thousands of American readers, and because NSO Group’s development and deployment of Pegasus involved deliberate and sustained attacks on the U.S. infrastructure of U.S. technology companies—including Apple, which itself sued NSO Group last year, contending that the spyware manufacturer had damaged its business and harmed its users. We ask the court to order NSO Group to cease its attacks on the El Faro journalists. We also ask it to compel the spyware manufacturer to disclose what information it stole from the journalists’ phones, and, perhaps most importantly, to identify the client with whom it carried out the attacks.
 
The supply of spyware to authoritarian and other rights-abusing governments has become a truly urgent threat to human rights and press freedom—an “existential crisis for journalism around the world,” as the Committee to Protect Journalists put it in a recent statement. David Kaye, the former U.N. special rapporteur for freedom of opinion and expression, has called for a moratorium on the sale of spyware, and in recent months others have joined his call.

Asked why he decided to participate in the Knight Institute lawsuit, Carlos Dada, El Faro’s publisher, said that the spyware attacks on El Faro’s journalists were an attempt to silence El Faro’s sources and deter its journalism. “We are filing this lawsuit to defend our right to investigate and report, and to protect journalists around the world.”
 
We’re grateful to Carlos and his colleagues for their courage, and honored to be able to represent them in this important case.