0:00

Did. You kill Marlene Johnson. I

0:03

think you're one of the first people

0:05

to have actually ask. Beyond all repair

0:07

from Wb you are and Z S

0:09

P Media has been named one of

0:11

the best podcasts of the year so

0:14

far by Vulture and it'll leave you

0:16

questioning everything. Wow, it just

0:18

gets more interesting. And

0:20

the biggest twist of all is

0:23

almost here. Beyond all repair, Listen

0:25

and follow wherever you get your

0:27

podcasts. From

0:34

The Center for Investigative Reporting in

0:36

P R X this is reveal

0:39

a mallet. This

0:41

past decade has been brutal for

0:43

journalists around the globe. More than

0:45

five hundred reporters in media workers

0:48

have been killed in the line

0:50

of duty, including in the ongoing

0:52

wars in Gaza and Ukraine. That's

0:54

according to The Committee to Protect

0:57

Journalists. One of the most notorious

0:59

cases over the years was Jamal

1:01

Khashoggi an explosive new report this

1:04

morning. A calmness for the

1:06

Washington Post. Turkish officials have

1:08

audio and video recordings of

1:10

the gruesome murder of journalists

1:12

Jamal Khashoggi inside the Saudi

1:14

Arabian consulate in Istanbul. After

1:16

the show, these murder came

1:18

another disturbing revelation. A joint

1:21

investigation has revealed evidence suggesting

1:23

spyware was used to monitor

1:25

those in his inner circle

1:27

before and even after his

1:29

death. Researchers. Believe

1:31

the cell phones have showed. his

1:34

wife and friends were infected with

1:36

Pegasus, a military grade surveillance software.

1:38

It can copy your messages, harvest

1:41

your photos, and even record you

1:43

by controlling your food on camera

1:45

and microphone. Pegasus probably the most

1:48

advanced piece of spyware have developed.

1:50

It is effectively the most invasive

1:52

form of surveillance imaginable. Pegasus.

1:56

Is made by is really company the

1:58

it is So group which has dinner

2:00

it is software was used to target

2:03

facilities and they say Pegasus is only

2:05

sold the government's for tracking and capturing

2:07

criminals and terrorists but over the years.

2:10

Many. Confirmed targets of Pegasus

2:12

have not been criminals or

2:14

tears Their human rights activists,

2:17

scholars and journalists. Today.

2:20

Will bring you a So

2:23

that first aired last year.

2:25

Producing collaboration with the podcast

2:27

series Shoot The Messenger and

2:29

Exile Content Studio hosts Rose

2:31

Read and Nando Vila investigate

2:34

how Pegasus was weaponize to

2:36

go after an entire newsroom.

2:38

reporters, editors, photographers, accountants are

2:40

working in one of the

2:42

most dangerous countries in the

2:44

Western Hemisphere. El Salvador.

2:49

Carla. Stata as an award winning

2:51

journalist who for more than two

2:53

decades has run the newsroom of

2:56

Alfaro Space and the capital San

2:58

Salvador. Who were born before google.

3:01

We were born in their country

3:03

were. Not many people. Have

3:05

access to The Internet. Nineteen Ninety

3:07

Eight. And. We started

3:10

it just as an experiment. Oh

3:12

see we are. In Sato

3:14

is a special newsroom. Because it

3:16

was the first exclusively digital newspaper

3:18

in Latin America. In

3:20

English and photo means the lighthouse.

3:23

Known. For it's investigative reporting

3:25

of file has been referred

3:27

to as quotes: a breakthrough

3:30

digital newspaper blazing an independent

3:32

and ethical trail, and Central

3:34

America. I think that

3:36

we were able to attract a

3:38

very talented. Generation of

3:41

Salvadoran journalists. Whole.

3:43

Children of the post war.

3:46

When. Cutler's references the war. He's talking about

3:48

his son of a lot of Civil War

3:51

in the nineteen eighties and early nineties. a

3:56

twelve year conflict cities a leftist gorilla

3:58

coalition has backed by cuba against

4:00

the government and far-right paramilitary groups,

4:02

which received more than a billion

4:04

dollars in military support from the

4:07

U.S. The Reagan administration in Washington

4:09

is backing the government drive with

4:11

arms, money, and advisers. It's

4:13

estimated that more than 75,000 civilians were killed.

4:18

Nearly a quarter of the Salvadoran population

4:20

moved to the U.S. The

4:23

devastating effects of the conflict

4:25

lasted for decades. And

4:27

Alfaro has reported on all of

4:30

that, including government corruption and gang

4:32

violence. We do long-featured

4:35

stories that deal with

4:37

violence, with organized crime,

4:39

with corruption, with human

4:42

rights violations, and with politics. Carlos

4:46

and his colleagues are no stranger to

4:49

threats. Over the

4:51

years, police have made unofficial visits

4:53

to the newsroom. Unidentified people in

4:55

unmarked cars showing up unannounced to

4:57

the Alfaro offices to intimidate its

4:59

journalists. We've received

5:02

messages from organized crime.

5:04

We've received real threats

5:06

from public officers. Gangs

5:08

publicly said that if it was up

5:10

to them, we should not exist. We

5:14

have been harassed in the form

5:16

of physical harassment of having strange

5:19

people standing out

5:21

of our homes. We

5:24

have received drones standing

5:27

by our windows. And

5:30

it wasn't just outside his windows.

5:33

Carlos says one time a drone

5:35

actually flew into his apartment. It

5:38

hovered for about a minute in his

5:40

living room and then darted away. Because

5:45

they've been operating in such a

5:48

dangerous environment for so long, Carlos's

5:50

team takes extra precautions when they're

5:52

working with their sources. They're

5:55

careful with how they communicate with each

5:57

other. And they pay attention when

5:59

something seems… A little off.

6:02

And twenty twenty one Reporter Houllier.

6:04

Deborah takes notice something was off

6:06

with her brand new I phone.

6:08

I started having a lot of

6:10

problems for a sample. The battery

6:13

was very very love a. The

6:15

short time and an app that

6:17

she relied on to make encrypted

6:20

calls with her sources wouldn't open.

6:22

The. Phone was over seedings and to

6:25

scream started turning off her opening

6:27

acts that she was noodles me.

6:29

We. Were just having this sensation

6:31

of that someone? Was really

6:33

knows someone was enough phones

6:36

and we never thought about

6:38

passes. Clears.

6:41

Phone was essentially sent to

6:43

Citizen Lab. It's a digital

6:45

watchdog group that essentially tracks

6:47

human rights violations on the

6:50

internet. The. Lab had been

6:52

aware that something was up. And

6:54

saw that something going on with Pegasus.

6:57

Their. John. Scott Rail ten

6:59

as a senior researcher with Citizen

7:01

Lab, which is based at the

7:03

University of Toronto's Monk School. A

7:06

lot of their work focuses on

7:08

tracking mercenary spyware like Pegasus. It's

7:11

not uncommon for us as researchers to

7:13

know that Pegasus where my can be

7:15

used in a country, but Everly no

7:17

idea who those victims are in. The

7:19

problem is because go hunting for those

7:21

people you're looking for needles in a

7:23

stack of needles. John.

7:25

Taxes Houllier. They had found Pegasus

7:27

on her I phone. He

7:29

was in our overwhelming is started

7:31

thinking about okay on the target

7:34

ran out of the thing was.

7:37

Is obvious. That is not only mean

7:39

there are more people here that are

7:41

targeted as well. They

7:44

then started to put the pieces together

7:46

of what was happening, not just with

7:48

Houllier, but with her colleagues to. There

7:51

is a pattern to Pegasus cases, which

7:53

is if you find one in a

7:55

given country, you're probably gonna find a

7:57

lot more. Well. Since they keep

7:59

asking. More photos. We sent all the

8:01

photos. And when researchers

8:04

took a closer look, John

8:06

says there was something different

8:08

about how Pegasus was being

8:10

used on Alfaro. Personally,

8:13

Cannot be right. I've never seen anything like

8:15

that. It was that they

8:17

were really targeted just speaking a

8:19

in a radical manner. Sesame

8:22

we'd seen before in anything like this

8:24

volume where this number of cases. Citizen

8:27

Lab. Was. So impressed by

8:29

her case we thought well maybe this

8:31

is really big, be something extraordinary. I

8:34

got screwed worse. Since.

8:38

The initial discovery of Pegasus.

8:40

We've been on this journey

8:43

to try to understand where

8:45

it is, how it's evolving,

8:47

Who the. Customers. Are

8:50

were the targets may be. John.

8:53

Has worked with Citizen Lab for the

8:55

past decade and has been tracking Pegasus

8:58

since Twenty sixteen. That's.

9:00

When they made their first discovery of

9:02

a Pegasus in section on the phone

9:04

of a human rights activist from the

9:06

United Arab Emirates named Us med Months

9:08

or she's been in prison since twenty

9:10

seventeen. And. Turn his

9:12

head of continued unbroken since those

9:14

first findings around of my bones

9:17

and that approached gave us a

9:19

trail of digital breadcrumbs that we

9:21

continue to follow to this day.

9:25

Pegasus is the most sophisticated spyware

9:27

made to date and can bypass

9:29

any encryption because it uses a

9:32

loophole in a phone software to

9:34

be a hidden but active parasite.

9:37

Vienna. So Group the company behind

9:39

Vegas has said Mexican authorities use

9:41

their product to help capture the

9:43

drug lords fuckin Guzman better known

9:45

as a Chapel by tapping the

9:47

phones of people with his inner

9:49

circle. But Citizen Lab

9:51

has confirmed journalists have also been

9:54

targeted. one of the

9:56

components of our work of course

9:58

is this constant effort to

10:00

try to understand where Pegasus is

10:03

located in cyberspace, whereas

10:05

the data that's being taken from phones going.

10:09

In some cases, our research has

10:11

been able to determine clusters of

10:13

servers that belong to, we

10:16

could say, a single deployment, and then try

10:18

to understand where in the world the infections

10:21

are that are talking to that cluster.

10:24

Pegasus allows an operator in one

10:27

country to steal information from phones

10:29

in multiple countries. In

10:31

El Faro's case, the hackers seem to be

10:33

close to their target. Back

10:36

in 2020, we observed an

10:38

operator that appeared to be

10:40

involved in El Salvador. So

10:43

this means there's a Pegasus operation going

10:45

on in El Salvador. By

10:47

the next year, we were investigating these cases. When

10:53

the El Faro journalists learned that

10:56

Julia Gavarrete's iPhone was inspected with

10:58

Pegasus, they suspected the

11:00

Salvadoran government was behind the attack.

11:04

The government has denied the use of Pegasus,

11:06

but as we've heard, harassment of the

11:08

media by the government is hardly new.

11:11

Carlos has covered the terms of

11:14

six different Salvadoran presidents, and

11:16

some of those administrations have tried

11:19

to intimidate or silence independent press

11:21

in El Salvador or

11:23

just make their business difficult. In

11:25

the form of legal harassment,

11:28

we are the subject of four

11:32

different tax audits. Harassment

11:35

has intensified during

11:37

this administration of

11:39

president Nayib Bukele. Nayib

11:43

Bukele was elected president in 2019 at the age of 37. He

11:48

has a beard, wears skinny jeans, leather

11:50

jackets, and backwards baseball caps. He

11:53

once described himself on Twitter as the

11:55

world's coolest dictator. Fluent

11:57

and prolific on social media, he has said

12:00

that Instagram posts can be more important

12:02

than assembly floor speeches. Bukele

12:04

has led a brutal campaign to crack

12:07

down on gangs, which, since El Salvador's

12:09

civil war, has been a powerful force.

12:18

This is Bukele describing his war on gangs and

12:20

corruption in a speech to the nation in June.

12:25

He boasted about opening a mega-prison, possibly

12:27

the world's largest. During

12:29

his tenure, more than 65,000 people

12:31

have been arrested for being suspected gang

12:33

members. Before becoming

12:36

president, he was a city mayor, and

12:38

El Faro was one of the few Salvadoran

12:40

outlets to cover his unconventional race for president,

12:43

as Bukele ran outside the two main political

12:45

parties. Mainstream media in

12:47

El Salvador will not cover his

12:50

political messages or his political

12:53

conferences. We did. By

12:56

that time, he was only talking to us because

12:58

we were the only ones willing to talk to

13:00

him. As soon as he

13:02

became president, we started

13:04

reporting on his government. In

13:07

Bukele's first year in office, he began

13:09

to work on consolidating his power. In

13:12

February of 2020, he was trying to

13:14

push through a loan of $109 million for military equipment

13:19

and was meeting resistance from

13:21

parliament. After speaking for half

13:23

an hour, the president went into the legislative assembly.

13:25

He said he would give the members of the

13:27

parliament another week to approve this loan, and he

13:30

said if they didn't do that, he would return

13:32

to the assembly. A

13:34

few weeks later, lawmakers were in session.

13:38

Heavily armed police and soldiers

13:40

arrived to occupy El Salvador's

13:42

parliament building. Soldiers

13:44

entered El Salvador's parliament as

13:46

the president demanded lawmakers approve

13:49

a $109 million loan to equip

13:51

the military and police to fight

13:53

against violent gangs. He

13:56

entered Congress followed by soldiers

13:58

armed like fools. conflict

14:01

to threaten the

14:03

congressmen that he was going to

14:05

sack them that day. He

14:07

didn't in the end. He prayed

14:09

to God sitting in the chair of the

14:12

president of Congress and he

14:14

left the place and he talked

14:16

to the crowd outside Congress and he told

14:18

the crowd, God asked me

14:20

for patience. The

14:30

president was pushing Congress, which he

14:32

didn't get control to approve the

14:35

loan. Congress was asking

14:37

for more information about it and then

14:40

what he did was to threaten Congress that

14:42

he was going to stage a coup d'etat

14:44

against Congress. Not long after

14:46

Bicaly threatened a coup, El Salvador

14:49

held parliamentary elections. He

14:52

won the majority and on the first

14:54

session of the new Congress that he

15:03

controlled, Congress dismissed

15:06

some Supreme Court justices or

15:09

judges, which is of course

15:11

unconstitutional and that's how Bicaly

15:13

got in control of

15:15

all the institutions of the state. El

15:19

Faro pressed on with their coverage

15:21

of Bicaly's power grab and the

15:23

harassment intensified. In

15:26

November of 2020, the president criticized

15:28

El Faro on Twitter saying,

15:31

quote, they say they do

15:33

independent and truthful journalism. At

15:36

least the pamphlets are good for

15:38

ripening avocados or cleaning up after

15:40

pets. And this

15:42

tweet, quote, El Faro and friends

15:45

have become a website with opposition

15:47

content. If there was any journalism

15:49

left there, it's gone. Bicaly

15:52

is not only the president, he's the

15:54

most popular president in the

15:56

whole Western Hemisphere. He has

15:58

around. 85%

16:02

of popular support. When a president

16:04

with that traction, with

16:07

that huge percentage of followers,

16:10

which that divisive

16:12

speech declares you a

16:14

public enemy, that means that a lot

16:16

of that 85% of the people will

16:20

believe him, will

16:22

believe that we are

16:25

not publishing the truth,

16:27

because the truth is what the government says.

16:30

All of this raises

16:32

some questions. If Bukele's propaganda machine is

16:35

so powerful, and if he enjoys genuine

16:37

popular support, why

16:40

bother spying on journalists? And

16:42

is there any way to figure out if

16:44

Bukele's government really was behind the Pegasus attack?

16:49

One of the reasons Pegasus is so powerful is

16:52

because it's very hard to trace

16:54

an attack back to the source. But

16:57

in this case, the hacker left behind

16:59

some important clues. That's

17:02

up next on Reveal. Support for

17:04

Reveal comes from the American Public Television. We're

17:08

a network of public broadcasters that provide

17:10

information to the public. We're a network

17:12

of public broadcasters that

17:15

provide information to the public. Support

17:18

for Reveal comes from Odoo. What is Odoo? Well,

17:20

Odoo is an all-in-one management software

17:23

with apps for every business need.

17:25

Odoo has apps

17:28

for CRM, accounting, sales, HR,

17:30

inventory, manufacturing, and everything in

17:33

between, and they're all in one

17:35

easy-to-use software. And the best part about

17:37

Odoo? All Odoo apps are

17:39

integrated, helping you get things done faster

17:41

and more efficiently. So

17:43

when you think about business, think Odoo. To

17:47

learn more, visit odoo.com. That's odoo.com. of

18:00

church and state. Americans United

18:02

defends your freedom to live as yourself and believe

18:04

as you choose, so long as you

18:06

don't harm others. Core freedoms

18:08

like abortion rights, marriage equality, public

18:11

education, and even democracy itself rest

18:13

upon the wall of separation between

18:15

church and state. A network

18:18

of anti-democratic groups are attacking these

18:20

freedoms, seeking to force us all

18:22

to live by their narrow beliefs.

18:25

Americans United is fighting back, freedom

18:27

without favor and equality without exception.

18:30

Learn more about AU's work

18:32

at au.org.mj. From

18:43

the Center for Investigative Reporting and

18:45

PRX, this is Reveal. I'm

18:47

Al Legend. We're bringing you

18:50

a show from last year about the spread

18:52

of a virus, a human-made

18:54

information virus. Pegasus

18:56

is spyware developed to help

18:58

governments crack into smartphones to

19:01

target drug traffickers and terrorists.

19:04

But Pegasus has also been used

19:06

against journalists, activists, and scholars. And

19:09

in the case of the Alfaro newspaper

19:11

in El Salvador, an entire newsroom. Rose

19:14

Reed and Nando Vila from the podcast

19:16

series Shoot the Messenger are

19:18

tracking efforts to figure out who

19:20

was behind the attack. In

19:24

the months after Citizen Lab found Pegasus

19:26

on the phone of Alfaro reporter Julia

19:28

Gavarrete, the newspaper was facing

19:31

direct and public attacks from President

19:33

Nayib Bukele. In

19:35

trying to connect Bukele's government to the

19:37

phone hack, there was some unique evidence.

19:40

Once again, this is Citizen Lab's

19:42

senior researcher, John Scott Railton. Sometimes

19:45

we get lucky and we get a device

19:47

that's just been infected and we're

19:50

able to say, okay, well, we can connect

19:52

this infection to a cluster of servers that

19:54

we were monitoring. What's interesting

19:56

about the El Salvador case is we did have one

19:59

case. where we

20:01

were able to connect one

20:04

of the infections to an

20:06

operator. That case

20:08

involved an Alfaro reporter named

20:10

Carlos Martinez. Researchers

20:12

caught a spyware attack on

20:15

Carlos's phone. The technical

20:17

term is intermission, and they caught

20:19

it as it was happening, in

20:21

real time. We

20:23

were able to discover that there

20:26

was a failed exploit attempt on his

20:28

device, and we connected that failed exploit

20:30

attempt to the operator that we called

20:32

Torogoz, which had been pretty

20:35

much exclusively targeting within El Salvador.

20:38

They saw the operator live

20:41

in Carlos Martinez's phone. That

20:43

allowed them to geolocate the

20:46

operator. And to no

20:48

surprise, it's based in El Salvador. That's

20:51

who was operating Pegasus in our

20:53

phones. Which further

20:55

adds to the suggestive evidence pointing at

20:57

the likelihood that the El Salvadorian government

20:59

may be the operator in this case.

21:02

With each infection, you can kind of

21:04

hear a ching in the background, as

21:06

you imagine the process of analyzing the

21:08

data, the process of targeting the person,

21:11

all of these other pieces that would have had

21:13

to go into it. I imagine just reams and

21:15

reams and reams of paper and documents authorizing and

21:17

requesting infections again and again and again and again.

21:20

And then reports generated based

21:22

on that material. The

21:24

NSO Group, the Israeli company behind

21:26

Pegasus, insists it only sells to

21:29

government agencies, like security and intelligence

21:31

services. Since Pegasus is

21:33

classified by Israel as a cyber weapon,

21:36

the NSO Group is required to get

21:38

government approval for every sale. It

21:40

works like a subscription service. Countries

21:42

use a portal, and depending on the

21:45

package are allotted a specific number of

21:47

targets. The idea is the more you

21:49

pay, the more targets you get. But

21:52

NSO is very protective about the intricacies of

21:54

their deals. Carlos Dada

21:56

says that makes it all the more difficult

21:58

to figure out who was spotted. on his

22:00

newspaper. Since NSO

22:04

keeps such a secrecy over

22:07

who they sell Pegasus to, the

22:10

government of El Salvador has

22:12

been able to say it's not ours.

22:15

Most of the time, hacks with Pegasus

22:17

are a single hit, largely

22:19

because of how expensive it is to use. The

22:22

person operating it will break into a phone,

22:25

take a copy of everything, and get out.

22:28

But that was not the case with the El Fado

22:30

hack. I'm pretty accustomed to

22:32

looking at the readouts and

22:35

the number of infections that we show

22:37

when we do an analysis. And again

22:40

and again, the results from the

22:42

El Fado would literally fill my

22:44

screen with cases, with numbers

22:46

of infections. It was that they were

22:49

really targeted 10, 20, 30, 40 times the

22:51

same individual. This

22:54

was like obsessive every day, constantly hacking

22:56

and rehacking every time this person would

22:58

restart its phone. That's

23:01

really intense. In

23:03

my case, out of a year and a half,

23:06

Citizen Labs says the information might

23:08

have lasted 167 days. That's

23:12

not only getting into your phone, sucking

23:14

the information, that's leaving with you. Basically,

23:17

I had someone leaving in my phone next to

23:19

me, turning on the microphone, turning on the camera.

23:22

Knowing where I was going and

23:25

who I was meeting with. It

23:28

was more surprising that even people

23:30

from the accounting department, from the

23:32

managing part of the El

23:35

Fado was also, I

23:37

don't know the exact word, contaminated with Pegasus,

23:40

which lets you know the scope

23:43

of this information and

23:46

the amount of money they

23:48

spent to find out

23:50

everything about our operation and

23:52

about every single one of us. sample

24:00

through the entire organization, monitoring people

24:02

left and right. Journalists, editors, publishers,

24:05

the works. Citizen

24:07

Lab uncovered a total of 226

24:09

infections detected on 22 members of

24:11

Alfaro over the course

24:16

of a year. We try to get

24:18

people informed very quickly.

24:20

There are times when I will go to sleep

24:23

knowing that the next day I'll have to talk to some

24:25

people and give them some tricky news. People

24:27

often want to know. People are

24:29

relieved to learn that they have

24:32

been hacked. I

24:34

think for a lot of people, it is

24:36

also clarity and truth in

24:38

a scenario where those things are

24:40

hard to come by. After

24:46

the hack was discovered, Carlos met with

24:48

his newsroom to talk about what

24:50

this meant for them personally

24:52

and for their sources. Our

24:55

lifestyle was already different. Everybody

24:57

knew what was going on inside Alfaro. We

25:00

have a very solid team in that sense. I

25:03

felt that my first obligation was

25:06

letting everybody know that

25:10

the healthiest decision would be to leave

25:12

to quit Alfaro and that I

25:15

didn't want anyone to stay because

25:17

they felt some kind of obligation.

25:20

I have been

25:22

very insistent about that. Some

25:24

people left and we

25:27

all let them know they were entitled to that

25:30

and that that was a normal thing. But

25:34

if you wanted to stay, you

25:36

should know that silence is not

25:38

an option. So we

25:40

are not going to let these

25:42

things silence us while we are

25:44

working here. You had said

25:46

that people who work at

25:49

Alfaro that our lives are already different.

25:51

What does that mean? How are your lives

25:53

different working at Alfaro? I think

25:55

our public life, meaning going out

25:58

to parties

26:00

to public places have

26:03

already diminished a lot. Let

26:05

me give you a good example. One

26:07

day after a tough night

26:10

in HealthWise, I, in

26:12

the morning of Saturday,

26:16

I went to the pharmacy, I think

26:18

it was 8 a.m., to get medicine and

26:22

buy a couple of Gatorades. 15

26:24

minutes later, the press secretary was tweeting

26:27

a photo of the drugstore where I

26:29

went, saying, Carlos Dada was just here,

26:32

buying five Gatorades. That's

26:35

the size of his hangover. Let's

26:37

hope he didn't rape any women

26:39

yesterday night. That's the

26:41

kind of things that were happening. The

26:44

most important thing to the reporters at

26:47

Alfaro was what this would mean for

26:49

their sources, the people

26:51

who risked their jobs, their careers,

26:54

and even their safety, to share

26:56

with them critical pieces of

26:58

information and evidence about Bukelli's

27:00

administration and possible

27:02

corruption. We talk

27:04

to a lot of sources every

27:07

week, so it's impossible to

27:09

talk back to all the sources

27:12

that we have dealt with during all

27:14

the time that turned out that we were being

27:17

tagged with Pegasus. We

27:19

asked Citizen Lab for

27:21

the dates of the intramations into

27:24

everybody's phones, and

27:26

we crossed this information with our

27:28

news cycles. When

27:30

they looked at the points in time when

27:32

their phones were being targeted, they noticed something

27:34

startling, that the hacks

27:36

often coincided with their stories on corruption

27:39

and Bukelli's deals with gangs. There

27:42

was this nexus of timing between

27:45

reporting on corruption and

27:47

reporting on negotiations with

27:49

murderous gangs like MS-13 and

27:52

some of that targeting. That was

27:54

a huge story. MS-13

27:56

is a... A

27:59

gang? the biggest gang in

28:01

El Salvador. I don't know

28:03

how to describe how powerful they are because it

28:05

has to do not only with the number

28:07

of members but also with the

28:09

businesses they have or the things they move.

28:13

A few weeks after that we published

28:15

a new story that

28:17

said that it was not the only

28:20

gang that Bukele was negotiating with. He

28:22

was also negotiating with the 18th Street

28:24

Gang which is the other

28:26

big gangs. Those

28:29

were two big red dots when

28:31

we crossed the data. What

28:34

we had were videos, photography,

28:36

and official paperwork from the

28:38

prisons where the leaders were

28:40

taking out or where

28:42

government offices would visit to talk to them.

28:45

That proved that Bukele had been

28:48

negotiating with them and that's what

28:50

explained the reduction of the homicide

28:52

rate in the country. El

28:56

Faro published their article about

28:59

President Bukele's negotiations with MS-13

29:01

on September 3, 2020.

29:05

The article outlined how Bukele was

29:07

making an alliance and brokering deals

29:10

with the leaders of MS-13 to

29:12

reduce violence in exchange for favors,

29:15

better prison conditions, and

29:17

the release of high-ranking gang leaders from

29:19

prison. A few

29:21

weeks later Bukele struck back. He

29:24

announced El Faro was being investigated for

29:26

money laundering. During the month the

29:28

article was published, at

29:35

least one El Faro employee was

29:37

surveilled with Pegasus every single day.

29:39

The data indicated

29:41

a strong link between Pegasus

29:43

infections and the newspaper's corruption

29:46

investigations. Carlos says

29:48

many of El Faro's findings

29:51

were substantiated a U.S. court

29:53

as part of an investigation

29:55

into MS-13's transnational operations. The

29:58

United States Justice department

30:01

presented an indictment in New York

30:03

in a federal court

30:05

against certain members

30:08

of the MS-13 gang where

30:10

they detailed the negotiations

30:12

between the gangs and

30:15

President Bukele's administration. According

30:18

to this indictment they were

30:21

negotiating in exchange for economic

30:24

benefits for territorial

30:26

control and for the

30:28

refusal of the Bukele administration to

30:32

extradition requests

30:34

from the United States. We

30:36

in the end also knew and published

30:39

that some Bukele administration

30:41

officers personally took out

30:43

of prison MS-13

30:45

leaders and drove them to

30:48

the border with Guatemala. So

30:51

these are the kind of stories we were

30:53

publishing during this cycle. What

30:55

do you think that the people behind the

30:57

attack were looking for? My

30:59

first impression is that they want to know who

31:02

we're talking to. They want to know who our

31:04

sources are, who we meet with, because

31:07

we've been publishing inside information

31:09

in the last years and

31:11

that's how we found out about Bukele's deals

31:13

with the gangs and that's how we found

31:16

out about some corruption scandals. You

31:18

can imagine the risk for those people. So

31:20

that's my first impression that they wanted

31:22

to go after that but as we've

31:24

seen that happened to journalists in other

31:26

orthocratic ruled countries they

31:29

are looking for intimate

31:32

images that they can

31:34

blackmail the reporters with or discredit

31:36

them by handing them to the

31:39

public. We

31:42

knew that in El Salvador it's hard to

31:44

be a journalist but now you have to

31:46

be stronger if

31:49

you want to make the type of

31:51

work that we are doing. When it

31:53

comes to the Pegasus infections at El

31:55

Faro reporter Julia Raverte was patient zero

31:58

and she says it got under her skin. It

32:01

affected her mental health. She felt paranoid.

32:04

She had to change the way she lived and worked. You

32:07

have to take care of your sources,

32:09

or you have to take care of the

32:11

information that someone shared with you. You have

32:13

to take care of your own family. We keep

32:17

analyzing our devices just

32:19

to check if we are

32:22

still victims of phagocyst, but there

32:24

are more. I mean, phagocyst is

32:26

not the only program that they

32:29

can use. For

32:31

John Scott Reilton from Citizen Lab, he's

32:33

seen phagocyst used in all sorts of

32:35

ways by governments trying to stop the

32:37

press or to attack human rights defenders.

32:40

Maybe it's used purely strategically, right? They

32:42

don't want to do anything that would show that

32:44

they have it. And so instead, they

32:46

try to use it to frustrate the

32:48

designs or plans or activities of an

32:50

organization. Maybe in other cases,

32:52

it's going to be used to blackmail people, or

32:54

maybe it'll be used to discredit people. Think

32:57

about all the things that you do on your

32:59

phone and then imagine what would happen if all

33:01

of those things were dumped out on the table.

33:04

Think about what they might do in your personal life,

33:06

in your work life. That kind

33:08

of creativity, unfortunately, is the stock

33:10

in trade of security services and

33:12

authoritarian or repressive regimes. We

33:17

saw in the killing of Saudi journalist

33:19

Jamal Khashoggi that phagocyst has been connected

33:22

to murder investigations. Carlos

33:24

Dada knows this firsthand. In

33:28

2017, his good friend, Mexican investigative

33:30

reporter Javier Vallez, was shot dead

33:33

in his hometown of Culiacal. Javier

33:36

Vallez investigated corruption and drug

33:38

cartels, the same kind of work

33:40

El Faro does. And

33:42

police investigations have revealed he was killed

33:45

for his reporting. One

33:47

lab discovered something more, that

33:49

his widow was targeted with Pegasus within

33:51

weeks of his murder. was

34:00

Javier Valdez, there's no one like him, with

34:03

a marvelous pen to describe in

34:06

a very literary way the horrors

34:08

of drug trafficking and its

34:10

consequences in a place like Sinaloa in

34:13

Mexico. He was

34:15

exceptional as a journalist, but

34:18

his ultimate fate was not

34:20

exceptional among Mexican

34:22

journalists. But again, also

34:25

Mexico is not an exceptional place. It

34:27

may be the worst, if not

34:30

one of the worst places to do journalism, but

34:32

not the only one where journalists are

34:34

being killed. The

34:36

commonality in these countries is a

34:38

level of impunity, which allows

34:41

criminals to think we can

34:43

kill a journalist and

34:46

we won't pay the consequences. In

34:51

January 2022, Carlos,

34:53

Julia and their colleagues prepared

34:55

to publish an article about

34:57

how Alfaro's newsroom was targeted

35:00

by Pegasus. They

35:02

wanted to share with the world the

35:04

scale and intensity of the attack and

35:07

warn their sources. I

35:09

told my family, I told my

35:12

girlfriend, I told some of my friends, this

35:15

is what happened. You should know

35:17

from me before you know from her publication

35:19

at Alfaro. I

35:22

was alone in my house, just

35:25

waiting for the moment that everything was

35:27

going to be released and

35:30

yes, I was scared a little bit. We

35:33

were telling our own stories.

35:36

It was the first time that I worked

35:40

on something like that. We

35:42

don't use the talk and we don't

35:44

like to talk ourselves. We became the

35:47

story, which is very uncomfortable. affordable

36:00

for journalists. We tell

36:02

other people's stories. When

36:05

we published the story that we

36:07

have been infected with Pegasus, we felt

36:09

the obligation to run an editorial which

36:12

was titled to our sources,

36:15

basically telling our sources we have done anything

36:18

in our hands to protect you. So

36:21

take your own measures, just know what is

36:23

happening. And of course, what happened the

36:25

day after is that no one else wanted to talk to

36:27

us anymore. And it has

36:29

taken a long time to

36:32

construct systems of

36:34

communication with sources that are

36:37

safe. Carlos

36:39

says that it was only after they

36:41

published the article about the Pegasus attack

36:43

that he had the time to think

36:45

about all the personal consequences.

36:49

I felt like so

36:51

invaded that the only thing

36:53

that I felt that I needed to

36:55

do was get into the shower and

36:57

open it. I needed to like clean

37:00

myself from something very dirty. They

37:02

have all my photos. They have all

37:04

my videos. They have the photos of

37:07

my dear ones. They

37:09

have been listening to

37:12

my conversations in my apartment

37:15

with my girlfriend, with my

37:17

friends, with my not so friendly

37:19

friends. They have been living with

37:21

me for many, many days. Today,

37:28

the staff at Alfaro remain dedicated

37:30

and they found new

37:32

ways to communicate safely. It makes

37:35

their work more difficult, more tedious.

37:37

They often have to travel within

37:39

El Salvador and outside

37:41

the country to work effectively

37:44

and be safe. We

37:47

are going back and forth, going

37:50

out and going back in. Some

37:52

of them have spent months out

37:55

of the country and then they go back. We

37:58

are trying to... measure

38:00

the risks week by week.

38:04

These people are at such risk. And

38:07

clearly, even though they knew that they were

38:09

at risk at the time, there were risks

38:11

that they didn't fully understand, these digital risks.

38:13

And that made me angry. It

38:15

made me angry because I thought that the work that

38:18

they were doing was critically important. So the world would

38:20

understand what was going on in El Salvador. And

38:23

yet there was this digital subversion going

38:25

on on their devices, trying to make

38:27

it really dangerous for them to do

38:29

truth telling and to talk to sources.

38:33

Pegasus is just one

38:35

element of the harassment and attacks

38:38

against independent presidents in El Salvador.

38:40

They passed a law criminalizing

38:43

publication about gangs that

38:45

can bring a

38:47

reporter or a publisher or an editor

38:50

up to 15 years in prison for

38:53

publishing a story about gangs with

38:55

the clear intention of silencing us

38:57

who were publishing book list secret

38:59

negotiations with gangs. Since

39:02

we decided that silence is not an option,

39:05

when we publish a story about

39:07

gangs, we have faced the need

39:09

to take those reporters out of

39:11

the country for some time. Pegasus

39:14

is just another means that

39:17

this government has to

39:19

attack and harass independent press, not far

39:21

from the only one. Coming

39:27

up with the Pegasus hack of El

39:29

Faro means for the free press around the

39:31

world. Think about what happened

39:33

to El Faro as a canary in

39:35

the coal mine. It is

39:38

highlighting what happens when an unaccountable

39:40

government gets his hand on a

39:42

powerful surveillance tool. It

39:45

will be abused. You're

39:47

listening to Reveal. From

40:02

the Center for Investigative Reporting and

40:04

PRX, this is Reveal. I'm

40:06

Al Ledson. When Pegasus

40:08

was developed, it was marketed secretly

40:10

to intelligence agencies as a tool

40:13

for tracking terrorists and drug traffickers.

40:16

Its creators have said that sometimes

40:18

that necessitates spying on innocent people.

40:21

This is the NSO Group's

40:24

former CEO, Shalef Julio, on

40:26

60 Minutes, talking about how

40:28

Pegasus helped authorities in Mexico

40:30

capture Joaquin Guzman, AKA

40:32

El Chapo. They had to

40:35

intercept a journalist, an

40:37

actress, and a lawyer. Now,

40:39

by themselves, they're

40:41

not criminals, right? But if

40:44

they are in touch with

40:46

a drug lord, and in order to

40:48

catch them, you need to intercept them. OK,

40:51

so let's assume that in the right hands,

40:54

Pegasus can help catch the bad guys. But

40:57

in the wrong hands, well, we've seen what

40:59

happened at El Faro and around the globe.

41:02

Traces of Pegasus have been discovered

41:04

on the phones of journalists, human

41:06

rights activists, and politicians. Some

41:09

of the people spied on were either killed or

41:11

put in prison, but to this day, no

41:14

one knows the full story of Pegasus.

41:17

With me to talk about all of this

41:19

is Shoot the Messenger co-host, Rose Reed. Hey,

41:22

Rose. Hey, Al. It's great to be here. So

41:24

I gather that one of the

41:27

many frustrations for El Faro and

41:29

other media outlets goes beyond the

41:31

extensive spying and the damages caused.

41:34

Yeah, it's really about the total

41:36

lack of accountability for all of

41:39

this. You know, as we

41:41

mentioned, El Salvador has denied using

41:43

Pegasus. And since NSO

41:45

Group's contracts protect the identity of

41:47

its customers, we can assume it's

41:49

the government of Naib Bukele, but

41:51

we don't have exact confirmation. Although

41:54

we did learn that Citizen Labs

41:56

saw in real time an operator

41:58

in El Salvador targeting a journalist

42:00

at El Faro. If

42:03

no one's been held accountable in El Salvador

42:05

for these hacks, what else

42:07

can a media organization like El Faro do?

42:10

Well, there's one thing El Faro

42:12

has done. They've teamed up

42:14

with the Knight First Amendment Institute at

42:16

Columbia University, and in 2023, they

42:19

filed a lawsuit against the NSO group.

42:22

Their complaint says the attacks violated the

42:24

Computer Fraud and Abuse Act, which

42:27

is an anti-hacking statute that dates

42:29

back to the 80s. And

42:31

the act itself does say that it can

42:33

extend beyond US soil. Now, there

42:35

was a lot of hope that if this

42:38

lawsuit was successful, it would compel the NSO

42:40

group to reveal the identity of the client

42:42

that targeted El Faro. However,

42:45

this past March, a federal

42:47

judge dismissed the lawsuit. Basically,

42:49

the judge's ruling found that since the

42:51

NSO group is an Israeli company, a

42:54

better form for this case would be in

42:56

Israel. El Faro and the

42:58

Knight Institute have filed an appeal. With

43:01

this spyware that is truly next

43:03

level, they can't be the

43:05

only one suing the NSO group. That's

43:08

right. There's another lawsuit on behalf

43:10

of META, and specifically WhatsApp. They

43:12

allege that Pegasus was used to

43:14

exploit a bug in WhatsApp and

43:16

target more than 1,400 people. That

43:20

also included activists and journalists.

43:23

And Apple's also suing NSO group. Apple's

43:26

saying that NSO violated their infrastructure

43:28

to target these people. And that's

43:30

actually how Pegasus works. The whole

43:33

idea about Pegasus is that it

43:35

finds a vulnerability in either your

43:37

iPhone or your Android. NSO

43:40

asked the court to dismiss the

43:42

Apple lawsuit. But in January, a

43:44

federal judge denied the group's motion.

43:46

And there's been an important development

43:48

in the META lawsuit. The

43:51

judge in that case ordered NSO to

43:53

share its source code for

43:55

Pegasus with WhatsApp. So

43:57

both of these lawsuits are still in.

44:00

call. What are

44:02

the risks here for the NSO group? Well,

44:05

NSO's business model relies

44:07

on secrecy. And

44:09

that means keeping all of their clients, aka

44:13

governments, countries hidden.

44:16

If any of these cases move

44:18

to trial, it could bring a

44:20

lot of problems for the NSO

44:22

group because their contracts, documents, emails,

44:25

phone calls, text messages

44:28

could all be subpoenaed. I

44:30

hear all these stories and see all the

44:33

research that's been compiled. It's

44:35

really hard for me to accept the

44:37

NSO's claims that Pegasus isn't involved in

44:39

these attacks. Yeah, this is something I

44:41

wonder a lot about too, and I think a lot of

44:44

people have given this a lot of thought. And

44:46

you know, there's evidence that Citizen

44:49

Lab and other research groups have

44:51

collected that's really compelling that Pegasus

44:53

is involved. Now, the

44:55

executives at the NSO group have declined

44:57

to speak with us, but in their

44:59

defense, they've said that Pegasus is classified

45:01

as a cyber weapon. So

45:04

every sale has to be approved by

45:06

the Israeli government. And

45:08

its contracts with other governments and intelligence

45:10

agencies have all kinds

45:13

of restrictions. And so

45:15

NSO also says if a government abuses

45:17

their software and targets

45:19

illegitimate targets, they're cut off

45:21

as clients. This is

45:24

Omri Lavi, one of NSO's

45:26

co-founders, speaking in an interview that

45:28

was posted on YouTube. We

45:30

do everything within our power to

45:32

prevent and make sure that this

45:34

technology is not misused. We're

45:37

taking the regulation that is put

45:40

on our shoulders and taking it even further

45:42

by having our own regulatory

45:44

leaps and bounds and committees and

45:47

people involved that try and prevent

45:49

as much as possible misuse

45:51

of this technology. But I

45:53

just want to add that nothing

45:56

will ever be 100%. will

46:00

ever be 100% but that's quite a big

46:04

deal. I think this is

46:06

where the NSO group has really tripped up because

46:08

they basically have said conflicting

46:29

messages. On one hand they

46:31

say, you know, we do

46:33

a lot of due diligence and we

46:35

really investigate our clients before we sign

46:38

them onto a contract. And

46:40

they've also said, we don't

46:42

know exactly who our clients are targeting.

46:44

We give them a portal and they're

46:46

the ones who are operating it. And

46:49

they don't have control over what their clients

46:52

are doing. So basically you

46:54

could sum up their business model

46:56

as, trust us, we'll

46:59

investigate. But they don't want

47:01

to give a definitive statement on how involved

47:03

they are with the targeting

47:05

and infections with their customers.

47:09

And I think what's really important for us to remember is

47:12

that the abuses are still proliferating.

47:16

The NSO group has become so

47:19

controversial. It's been blacklisted by the

47:21

Biden administration, but it's

47:23

also hugely profitable. That's

47:25

right. And the co-founders, Shalav Julio

47:27

and Omri Lavi, when they started out in the

47:29

mid 2000s, cybersecurity

47:32

was a budding industry, you

47:34

know, measured in the millions. And

47:36

today the cyber warfare industry and

47:39

the mercenary companies that support it

47:41

represent more than $43 billion. And

47:45

those are just the reported numbers. Bloomberg

47:48

projects that there are more than 200 companies

47:50

in this space. And

47:53

the NSO group is just one of the most famous

47:55

or infamous. Okay,

47:58

so let's say the lawsuits are still in

48:00

place. successful and Pegasus is eventually shut down.

48:03

Given how much money is at stake, could

48:05

this kind of technology just find a new

48:07

life in some other form? People

48:10

who have thought deeply about this

48:12

say that Pegasus is just a

48:14

first iteration. Like so

48:16

much of how technology evolves, so

48:19

does something like Pegasus. I mean we've even seen

48:21

it go from one click to

48:23

zero clicks. So I

48:25

think that we're already seeing

48:27

this kind of evolution happen.

48:30

I think a lot about what

48:32

John Scott Railton from Citizen Lab

48:34

had to say about how the

48:36

NSO group was trying to market

48:38

Pegasus. Think about what

48:41

happened to El Faro as a

48:43

canary in the coal mine. It

48:45

is highlighting what happens when

48:47

an unaccountable government or unaccountable

48:49

security service gets its hand

48:51

on a powerful surveillance tool.

48:54

It will be abused. We

48:57

are seeing early cases, high-risk

48:59

places, places with maybe

49:01

you know security services that are not as good

49:03

at hiding their tracks. But that's not

49:06

where this ends. It ends in a police

49:08

department near you and that should concern

49:10

all of us. So

49:14

I think the key word is

49:18

vigilance for all of us. We

49:20

need to be vigilant about the

49:22

nexus, the close connections between private

49:24

industry and the government, especially in

49:27

the area of technology. We

49:29

can't simply trust what any government

49:31

tells us because we've

49:33

seen how some of this advancing

49:35

technology can pose direct threats to

49:37

democracy in places where

49:40

democracy is struggling or where it's under

49:42

threat to keep it that way. Rose,

49:46

thanks so much for talking to me. It's

49:48

a pleasure El. Thank you for having me. Rose

49:51

Reed is co-host and executive producer of

49:54

Shoot the Messenger, espionage, murder,

49:56

and Pegasus spyware. It's

49:58

a podcast from exile. content studio

50:00

and PRX. We know

50:03

El Faro newspaper is just the tip of

50:05

the iceberg when it comes to Pegasus. For

50:08

deeper dive, you can binge the

50:10

entire 10-episode series on Shoot the

50:12

Messenger. Find it anywhere you get

50:14

your podcasts. This

50:18

week's show was produced by Michael

50:21

Montgomery and Stephen Rascone. Michael also

50:23

edited the show. Special thanks to

50:25

Nando Villa, Sabine Janssen, Gail Reed,

50:27

Carmen Graderol, Isaac Lee, and the

50:29

entire team at Exile Content Studio.

50:32

Thanks also to the committee to

50:34

protect journalists. Nikki Frick is our

50:36

fact checker. Victoria Baranetsky is our

50:38

general counsel. Our production manager is

50:40

Zulema Cobb. Score and sound designed

50:43

this week by Pache Quinones. With

50:45

help from Jay Breezy, Mr. Jim

50:47

Briggs, and Fernando Mamayo Arruda. Our

50:49

interim executive producers are Taki Telenides

50:51

and Brett Myers. Our theme music

50:54

is by Camarado, Lightning. Support

50:57

for reveals provided by the Reeve

50:59

and David Logan Foundation, the Ford

51:01

Foundation, the John D. and Catherine

51:03

T. MacArthur Foundation, the Johnson-Logan Family

51:05

Foundation, the Robert Wood Johnson Foundation,

51:07

the Park Foundation, and the Hellman

51:09

Foundation. Reveal is a co-production of

51:11

the Center for Investigative Reporting and

51:13

PRX. I'm Al Letzen and

51:15

remember there is always more to the

51:17

story. PRX.