Incident: Pegasus Spyware Hack on Journalists and Activists in El Salvador

Published Date: 2022-01-13

Postmortem Analysis
Timeline 1. The software failure incident involving the hacking of phones with the Pegasus spyware in El Salvador occurred between July 2020 and November 2021 as reported by Citizen Lab and confirmed by Amnesty International [123264]. 2. The article was published on January 13, 2022 [123264]. 3. Therefore, the software failure incident happened between July 2020 and November 2021.
System 1. Pegasus software by NSO Group - The Pegasus software designed by the Israeli company NSO Group failed as it was used to hack into the phones of journalists and activists in El Salvador, compromising their privacy and security [Article 123264].
Responsible Organization 1. The software failure incident, which involved the hacking of phones using the Pegasus spyware, was attributed to the Israeli company NSO Group, specifically their software Pegasus [123264].
Impacted Organization 1. Journalists and activists in El Salvador, including those from El Faro, GatoEncerrado, La Prensa Gráfica, Revista Digital Disruptiva, Diario El Mundo, El Diario de Hoy, and two independent journalists, as well as members of the organizations Fundación DTJ and Critosal were impacted by the software failure incident involving the Pegasus spyware [123264].
Software Causes 1. The software cause of the failure incident was the sophisticated spyware program Pegasus, designed by the Israeli company NSO Group, which infected the devices of journalists and activists in El Salvador [123264].
Non-software Causes 1. Lack of cybersecurity measures to prevent unauthorized access to devices [123264] 2. Alleged involvement of government entities in hacking activities [123264]
Impacts 1. The software failure incident involving the Pegasus spyware impacted the privacy and security of nearly three dozen journalists and activists in El Salvador, with their devices being hacked and compromised [Article 123264]. 2. The incident led to the exposure of sensitive information, including messages, photos, emails, call recordings, and the activation of microphones and cameras on the compromised devices [Article 123264]. 3. The affected individuals, including journalists from various media outlets and members of organizations, experienced prolonged periods of unauthorized access to their devices, with one journalist reporting 269 days of intrusion [Article 123264]. 4. The software failure incident raised concerns about government involvement, with suspicions pointing towards the government of El Salvador as the potential perpetrator, although the government denied any involvement [Article 123264]. 5. The incident highlighted the risks associated with the use of sophisticated spyware like Pegasus, with implications for privacy, freedom of the press, and potential misuse by repressive regimes [Article 123264].
Preventions 1. Implementing strong cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access to devices and systems [123264]. 2. Educating users on cybersecurity best practices, such as avoiding clicking on suspicious links or downloading unknown attachments, to prevent malware infections like Pegasus [123264]. 3. Using secure communication channels and encrypted messaging platforms to protect sensitive information from being intercepted by spyware like Pegasus [123264]. 4. Enforcing strict access controls and permissions to limit the exposure of sensitive data and prevent unauthorized access to devices and networks [123264].
Fixes 1. Implementing stronger cybersecurity measures to prevent unauthorized access to devices and data, such as regular security audits and updates [123264]. 2. Conducting thorough investigations to identify the perpetrators behind the hack and holding them accountable [123264]. 3. Enhancing user awareness and training on cybersecurity best practices to prevent falling victim to similar attacks in the future [123264].
References 1. The Citizen Lab 2. Amnistía Internacional 3. Efe (agencia de noticias) 4. Reuters

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The software failure incident involving the use of the Pegasus spyware by the NSO Group has occurred before with other organizations or individuals. The incident in El Salvador involving the hacking of journalists and activists' phones with Pegasus is not an isolated case. Pegasus has been used to target various individuals worldwide, including politicians, journalists, executives, and activists [123264]. (b) The software failure incident having happened again at multiple_organization: - The incident involving the Pegasus spyware by the NSO Group has affected multiple organizations and individuals globally. Over 600 politicians and officials, 189 journalists, 64 business executives, and 85 activists have reportedly been victims of this spyware. Additionally, around 50,000 phone numbers have been targeted, indicating a widespread impact across various organizations and sectors [123264].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase: The incident of software failure in the article is primarily related to the design phase as it involves the sophisticated spyware software Pegasus developed by the Israeli company NSO Group. The software was designed to infect devices with iOS and Android systems, allowing for the extraction of messages, photos, emails, call recording, and secret activation of microphones and cameras [123264]. (b) The software failure incident related to the operation phase: The software failure incident can also be related to the operation phase as it involved the operation of the Pegasus spyware on the devices of journalists and activists in El Salvador. The operation of the spyware led to the compromise of the devices, unauthorized data extraction, and invasion of privacy, indicating a failure in the operation of the software for malicious purposes [123264].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident in the news article is related to a hack involving the sophisticated spyware software Pegasus, designed by the Israeli company NSO Group. The hack targeted the phones of nearly three dozen journalists and activists in El Salvador, infecting 37 devices between July 2020 and November 2021 [Article 123264]. The software Pegasus is designed to infect devices with iOS and Android systems, allowing for the extraction of messages, photos, emails, call recording, and secret activation of microphones and cameras. The failure, in this case, originated from within the system as the spyware was intentionally deployed to infiltrate and compromise the targeted devices. (b) outside_system: The software failure incident involving the Pegasus spyware hack can also be attributed to factors originating from outside the system. The hack was reportedly carried out by unknown entities, with suspicions pointing towards the government of El Salvador, although the government denies involvement [Article 123264]. This external factor of a potential government-led hack from outside the system contributed to the software failure incident. Additionally, the NSO Group, the company behind Pegasus, has faced accusations of selling its spyware to repressive governments, raising concerns about external threats to individuals' privacy and security.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in this case was not due to non-human actions but rather due to a sophisticated spyware program called Pegasus, developed by the Israeli company NSO Group. The spyware infected devices with iOS and Android systems, allowing for the extraction of messages, photos, emails, call recordings, and the secret activation of microphones and cameras [123264]. (b) The software failure incident occurring due to human actions: The software failure incident in this case was due to human actions, specifically the hacking of nearly three dozen phones belonging to journalists and activists in El Salvador using the Pegasus spyware. The hack affected 37 devices between July 2020 and November 2021, with most of the targeted phones belonging to journalists from El Faro, a media outlet that had exposed connections between the government of Nayib Bukele and gangs in the country. The journalists suspected the government's involvement in the hack, which the government denied [123264].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The software failure incident reported in the articles is not attributed to hardware issues. Instead, it is related to the sophisticated spyware software Pegasus, developed by the Israeli company NSO Group, which was used to hack into the phones of journalists and activists in El Salvador [123264]. (b) The software failure incident occurring due to software: - The software failure incident in this case is directly related to the software aspect, specifically the Pegasus spyware developed by NSO Group. The software was used to infect and compromise the devices of journalists and activists, allowing for unauthorized access to messages, photos, emails, call recordings, and the activation of microphones and cameras without the users' knowledge [123264].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The incident involved the hacking of nearly three dozen phones of journalists and activists in El Salvador using the sophisticated spyware Pegasus, as discovered by Citizen Lab and confirmed by Amnesty International [123264]. The spyware Pegasus, designed by the Israeli company NSO Group, infects devices to extract messages, photos, emails, record calls, and secretly activate microphones and cameras. The hack affected 37 devices of 35 individuals between July 2020 and November 2021, with most of the hacked phones belonging to journalists from El Faro, a Salvadoran media outlet that exposed links between the government of Nayib Bukele and gangs in the country. The incident involved unauthorized access and surveillance of individuals' devices with the intent to gather sensitive information and monitor their activities. (b) The software failure incident is non-malicious. There is no indication in the articles that the software failure incident was unintentional or caused by factors introduced without the intent to harm the system. The incident was a deliberate act of hacking using the Pegasus spyware, indicating a malicious intent to infiltrate and monitor the devices of journalists and activists in El Salvador [123264].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The incident involved the sophisticated spyware software Pegasus, developed by the Israeli company NSO Group, being used to hack the phones of journalists and activists in El Salvador. The hack affected 37 devices of 35 individuals, primarily journalists from El Faro, who had exposed connections between the government of Nayib Bukele and gangs in the country. The government of El Salvador was suspected by the journalists to be behind the hack, although the government denied these allegations [123264].
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the article as the sophisticated spyware Pegasus, developed by the Israeli company NSO Group, was used to hack the phones of journalists and activists in El Salvador. The software was designed to infect devices with iOS and Android systems, allowing the extraction of messages, photos, emails, call recordings, and the secret activation of microphones and cameras [123264]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration temporary The software failure incident described in the articles is temporary. The incident involved the hacking of nearly three dozen phones of journalists and activists in El Salvador with the Pegasus spyware software. The hacking occurred between July 2020 and November 2021, affecting 37 devices of 35 individuals [Article 123264]. The incident was not a permanent failure but rather a temporary breach of security that lasted for a specific period due to the actions of the hackers.
Behaviour crash, value, other (a) crash: The software failure incident in the news article can be categorized as a crash. The Pegasus spyware infected devices, leading to a loss of control over the devices' functions and allowing unauthorized access to sensitive information. This resulted in the system losing its intended state and not performing its functions as expected, ultimately leading to a security breach and compromise of privacy [123264]. (b) omission: The software failure incident does not align with the omission type of failure. The incident involved the deliberate infiltration of devices with spyware, leading to unauthorized access and data extraction, rather than the system omitting to perform its intended functions [123264]. (c) timing: The software failure incident does not relate to a timing failure. The incident involved the continuous compromise of devices over a period of time, indicating a persistent security breach rather than a timing issue where functions were performed too late or too early [123264]. (d) value: The software failure incident aligns with a value failure. The Pegasus spyware infiltrated devices to extract messages, photos, emails, record calls, and activate microphones and cameras, leading to the incorrect performance of the system by allowing unauthorized access and data extraction [123264]. (e) byzantine: The software failure incident does not correspond to a byzantine failure. While the incident involved sophisticated spyware designed to infiltrate devices and extract data covertly, there is no mention of inconsistent responses or interactions within the system that would characterize a byzantine failure [123264]. (f) other: The software failure incident can be described as a security breach. The deliberate infiltration of devices with the Pegasus spyware led to unauthorized access, data extraction, and surveillance of journalists and activists, compromising their privacy and security. This behavior goes beyond a typical software failure and highlights a significant breach of trust and privacy [123264].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence harm, property, theoretical_consequence, other (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [123264]. (b) harm: The software failure incident involving the Pegasus spyware resulted in harm as the phones of nearly three dozen journalists and activists in El Salvador were hacked, compromising their privacy and potentially putting them at risk [123264]. (c) basic: There is no mention of people's access to food or shelter being impacted due to the software failure incident in the provided article [123264]. (d) property: People's material goods, money, or data were impacted due to the software failure incident as their phones were hacked, leading to potential data theft and privacy breaches [123264]. (e) delay: There is no mention of people having to postpone an activity due to the software failure incident in the provided article [123264]. (f) non-human: Non-human entities were not directly impacted due to the software failure incident described in the article [123264]. (g) no_consequence: The software failure incident had real observed consequences, so the option of 'no_consequence' does not apply [123264]. (h) theoretical_consequence: Theoretical consequences discussed in the article include the potential misuse of the Pegasus spyware for surveillance purposes by governments and the impact on privacy and freedom of the targeted individuals [123264]. (i) other: The software failure incident led to a breach of privacy, potential surveillance, and compromised data security for the journalists and activists targeted by the Pegasus spyware [123264].
Domain information, government (a) The failed system was intended to support the information industry, specifically the media sector in El Salvador. The software failure incident involved the hacking of nearly three dozen journalists and activists in El Salvador using the Pegasus spyware program [Article 123264]. The targeted individuals were associated with various media outlets such as El Faro, GatoEncerrado, La Prensa Gráfica, Revista Digital Disruptiva, Diario El Mundo, El Diario de Hoy, and two independent journalists [Article 123264]. (l) The failed system was also related to the government sector in El Salvador. The journalists and activists targeted by the Pegasus spyware were investigating and reporting on issues related to the government of President Nayib Bukele, including alleged links between the government and criminal gangs in the country [Article 123264]. The government of El Salvador denied involvement in the hacking incident but acknowledged that some high-ranking officials' phones may have been compromised as well [Article 123264].

Sources

Back to List