Knight First Amendment Institute Sues a Cyber-Intelligence Company

For the past several years, journalists from El Faro, a prominent news organization in El Salvador, have been reporting on the corruption and malfeasance within El Salvadoran President Nayib Bukele’s government.

By June 2020, many of those journalists’ phones had been hacked using Pegasus spyware, a product of the Israeli firm NSO Group. The software gave hackers the ability to access the journalists' phones without notice in order to monitor their communications and activities and steal their personal data. The surreptitious surveillance often took place around the publication of major stories, including ones about corruption within the Bukele administration. Once the surveillance came to light, some sources were frightened away, thus having a chilling effect on El Faro journalists’ reporting.

At the end of 2022, the Knight First Amendment Institute filed a lawsuit, Dada v. NSO Group, on behalf of 18 of El Faro's employees whose iPhones were infected with Pegasus spyware. According to the Knight Institute, the “NSO Group’s development and deployment of the spyware violated, among other laws, the Computer Fraud and Abuse Act, which prohibits accessing computers without authorization.”

On February 8, the Knight First Amendment Institute at Columbia University will host an event to examine the case with Carlos Dada, El Faro’s co-founder; Sheila Coronel, the Toni Stabile Professor of Professional Practice in Investigative Journalism at Columbia Journalism School; Ronan Farrow, a journalist at The New Yorker who has recently reported on El Faro and the Pegasus spyware hacking; Carrie DeCell, senior staff attorney at the Knight First Amendment Institute; and Jameel Jaffer; executive director of the Knight First Amendment Institute.

Ahead of the event, Columbia News sat down with DeCell to understand more about the case, why Knight took it on, and what they hope to accomplish.

Why did the Knight First Amendment Institute take on this case against the NSO Group?

The proliferation of spyware like NSO Group’s Pegasus poses an urgent threat to press freedom and to democracy more broadly. NSO Group has sold its spyware to authoritarian and rights-abusing regimes around the world, and those regimes have used that spyware to surveil journalists, human rights activists, and political dissidents. U.S. courts must ensure that NSO Group and other spyware manufacturers are held accountable for facilitating the persecution of the press and other members of civil society.

With most of the actors in this lawsuit from outside the United States, how does this case fit into your mission of protecting First Amendment rights? Moreover, what does the nature of your lawsuit say about how the digitization of journalism has collapsed borders, in other words, what happens in one part of the world impacts free speech everywhere?

The spyware attacks against members of El Faro bear a crucial connection to the United States. The development and deployment of these attacks involved intentional abuses of the U.S. infrastructure of U.S. technology companies; that’s why WhatsApp and Apple have also sued NSO Group in U.S. Court. Moreover, hundreds of thousands of people in the United States read El Faro online. The spyware attacks on members of El Faro were attacks on the rights of those U.S. readers as well.

This case illustrates how the spyware created in one country, tested and refined in a second country, and sold to a third country can be used against victims in a fourth country and harm others in a fifth country. The transnational nature of this threat has made it difficult for victims to hold spyware manufacturers and governments accountable for their use of this technology—and that’s one of the reasons we decided to get involved.

In a recent Wall Street Journal article, Yaron Shohat, NSO Group’s chief executive said that “I will not tell you that we never had mistakes, but we act responsibly.” How would you respond to that statement?

What’s the saying? “Fool me once, shame on you, fool me a few hundred times, shame on me.” NSO Group’s spyware has been used to attack law-abiding members of the press and civil society hundreds of times, if not many more. NSO Group cannot credibly disclaim responsibility for these attacks year after year and still claim to “act responsibly.”

What do you hope will come from this case?

We hope that this case will demonstrate that spyware manufacturers like NSO Group can be held liable for their violations of U.S. law in U.S. court. More specifically, we hope to obtain a court order requiring NSO Group to disclose who ordered the spyware attacks on El Faro. That order would send a clear message to rights-abusing regimes around the world that they cannot rely on NSO Group’s assurances of secrecy when they use NSO Group’s spyware to silence the press, intimidate human rights activists, or crack down on political dissidents within and beyond their borders.

Watch the full video of the "Spyware and the Press" event below: