The cellphones of dozens of journalists and human rights defenders in El Salvador have been repeatedly hacked with sophisticated spyware over the past year and a half, an internet monitoring group said Wednesday.

In a report on its most recent findings on the use of Israeli company NSO Group’s Pegasus spyware, the University of Toronto’s Citizen Lab said it had identified a Pegasus operator who worked almost exclusively in El Salvador in 2020.


While the researchers were unable to conclusively link the hacks to the Salvadoran government, the report noted that “the strong focus on infections in a specific country suggests that this is highly likely.”

NSO, which was blacklisted by the US government last year, says it sells its spyware only to legitimate government intelligence and law enforcement agencies that have been given the go-ahead by Israel’s Defense Ministry to use it in against terrorists and criminals.

Sofia Medina, spokesperson for President Nayib Bukele, declared in a statement: “The government of El Salvador is in no way related to Pegasus and is not a client of NSO Group,” and assured that it does not have the permissions to use this type of software. .


The government is investigating the use of Pegasus to hack phones in El Salvador, he said.

Medina noted that she also received an alert from Apple on November 23, as the other victims allege, telling her that there was a possibility that she was the victim of a state-sponsored hack. He said that the Minister of Justice and Public Security of El Salvador received that same message that day. The Citizen Lab investigation did not include government officials, Medina said.

NSO, placed on a US government blacklist last year, says it only sells its spyware to legitimate government security and intelligence agencies approved by the Israeli Defense Ministry for use against criminals and terrorists.


In a statement, NSO said it does not manage the technology once it is delivered to a client and has no way of knowing who its clients follow. But he stated that the use of his tools to follow activists, dissidents or journalists “is a serious abuse of any technology and goes against the intended use of such critical tools.” The firm noted that it has canceled several contracts in the past due to misuse by customers.

NSO does not identify its clients. But people familiar with the company said that at this time it does not have an active system in El Salvador. These people, who spoke on condition of anonymity to discuss the company’s customers, said NSO tries to obtain the cell phone numbers that were monitored and will investigate whether there was any misuse.

“The company will employ all measures at its disposal in accordance with its contractual agreements,” these people indicated.


Bukele, a wildly popular president, has lashed out at his critics in El Salvador’s independent press, many of whom were affected by the hacks.