The day El Faro reporter Julia Gavarrete’s father passed away, her phone was infected with Pegasus spyware that could activate the microphone and camera, and read all her messages – one of multiple occasions her privacy was invaded with the tool over the course of several months. Gavarrete made this disturbing discovery while cooperating with a new investigation into the phone hacking of more than 30 journalists in El Salvador, she told CPJ.
CPJ joined civil society and media groups yesterday in a statement calling on Salvadoran authorities to respond to the findings by experts at Citizen Lab and Access Now, among others. It’s not clear who was operating the spyware, but Pegasus creator NSO Group, an Israeli company, has repeatedly said it sells Pegasus only to vetted government clients and investigates allegations of abuse. More than 180 journalists around the world were identified as possible Pegasus targets last July in investigative reports that the company said were false.
The incidents in El Salvador were first publicized in November, when several journalists with iPhones reported Apple had notified them about possible spyware; Apple subsequently filed a lawsuit against NSO in a U.S. court for facilitating surveillance.
Gavarrete covers politics, health, environment, and gender for El Faro and previously worked at Gato Encerrado. Investigators found that staff at both independent digital outlets faced repeated Pegasus attacks in 2020 and 2021, especially El Faro, which reported 22 phones owned by its journalists were infected 226 times in total. The incidents coincided with some of their most hard-hitting investigations, Gavarrete told CPJ.
President Nayib Bukele and other Salvadoran officials have also singled out the sites and other independent outlets, disparaging staff, barring entry to press conferences, and denying work permits since Bukele’s election in 2019.
CPJ emailed Bukele’s office for comment but did not receive a response.
In a recent phone interview, Gavarrete told CPJ’s Dánae Vílchez about how knowledge of the spyware has affected her reporting. The interview has been edited for length and clarity.
Let’s talk about context: What is happening in El Salvador right now regarding press freedom?
In 2021 we saw setbacks – [fewer options] for citizens requesting information from institutions to understand what the government is doing with public funds, and the government also took a more concrete position against media it considered “inconvenient,” those that are doing watchdog work and monitoring finances. I don’t believe the situation will improve.
Were you afraid you were being spied on?
Several of us already suspected that [our communications] were being intercepted. Information that we shared was later made public on social media through trolls and Twitter accounts, [or] on pages that share fake news. But it was just a hunch.
Last year I was working on an investigative project, and it seemed like someone had read my conversations with a source. People stopped us at the entrance to a building like they knew we were going to be there. That confirmed to me that we were being monitored, but I never knew where the intervention came from.
I don’t know, for example, if the theft of my computer was state surveillance. [Editor’s note: In 2020, Gavarrete’s laptop was stolen from her home though other valuables were untouched; she was working for Gato Encerrado at the time.] I could never confirm it because the investigation never went anywhere.
How did you find out what was really going on?
I was able to confirm that I was being monitored with Pegasus working directly with organizations that were looking into this matter here in El Salvador.
My first impression was shock; suspecting you’ve been targeted isn’t the same as knowing. It hit me not only on a professional level, but also emotionally. To think about the amount of information that passes through a device, and the personal information they can access and what they can do with [it]…Processing that took me a bit of time, but in the end you have to turn the page and try to continue. That was my way of coping.
From what you know, can you tell us a little about what was found on the phones?
We found continuous interventions in which [someone] had access to and extracted information from our phones. Analysis allowed us to identify specific dates when the infections occurred.
Many of my initial thoughts were about work: What kind of information was reaching my phone [on] those days? What sources was I seeing?
Then I thought about difficult moments in my life, [like] my father’s illness. Not only are these people interested in knowing who you are as a journalist, but they want to know what happens in your personal life. Imagine the type of unscrupulous people behind this.
There were dates when a number of [us] were subject to heavy surveillance. Some journalists endured [it for] at least a year. Even for the researchers [performing the analysis], the obsessive use of Pegasus in El Salvador was very strange. It is not just that devices were being infected, but that the infections were constant.
Why do you think the government would be interested in monitoring your work?
Those who are behind these interventions are undoubtedly interested in knowing what is being produced in our newsroom. The government will always be interested in knowing what journalists who are investigating them are doing, although we do not have evidence of specific contracts.
What has become very clear to us is that during the periods when we have been surveilled, El Faro was working on hard-hitting reports into corruption or irregular purchases. There isn’t a single day that the reports showed we had been infected that wasn’t related to something that El Faro published or an ongoing investigation.
At a global level, state surveillance shows that governments are interested in controlling what is said about them, and not fighting organized crime.
Has the government acknowledged what happened or taken any responsibility?
The government distanced itself from the messages from Apple. Some officials said that what Apple was saying was not about El Salvador. It was just a matter of denying and trying to shift attention elsewhere.
We hope the government can provide answers, clarify whether it is using this type of software, [and] investigate who is behind all this – and that the international community gets more involved in demanding that we get these answers. We are talking about an excessive amount of money that someone is spending on this.
How has this situation affected your work as a journalist? How does it make you feel?
It is a stressful burden. Now it’s confirmed, it is not only about protecting our integrity and that of our sources, but also our families, trying to explain what is going on and why they can’t communicate with us “normally.” [Our devices] may still be infected. Anything sensitive that they want to say to me, they can only say in person. This is one of the most significant pressures that I have had to deal with.
I was cautious before, but [now] I am even more extreme to avoid putting sources in danger. But it wears you out day-to-day, and you have to make an even greater effort to be able to produce journalism.
See CPJ’s safety advisory, “Journalist targets of Pegasus spyware”