Dominican Republic: Pegasus spyware discovered on prominent journalist’s phone

A high-profile woman journalist in the Dominican Republic has been targeted with NSO Group’s Pegasus spyware, in the first confirmed case in the country, Amnesty International reveals in a new investigation published on World Press Freedom Day.

Analysis by Amnesty International’s Security Lab confirmed that a mobile device belonging to Nuria Piera was targeted and infected with Pegasus, which enables full and unrestricted access to a device, three times between 2020 and 2021. Piera is an investigative journalist who has focused on issues of corruption and impunity in the Dominican Republic throughout her decades-long career.

The latest discovery means there are now at least 18 countries, where it has been confirmed with forensics that journalists were targeted with spyware, though the actual scale of this abuse of surveillance technology is likely to be much higher. The Dominican Republic is the third country in the Americas, after Mexico and El Salvador, where Amnesty International has confirmed the use of Pegasus to target journalists and human rights defenders.

“The Dominican Republic is the latest country where spyware is being weaponized to silence and intimidate courageous journalists. Having already uncovered multiple cases in Mexico and El Salvador, we will continue to investigate any evidence that arises of the possible further use of Pegasus in the Dominican Republic. We call on states to urgently adopt a global moratorium on spyware,” said Erika Guevara-Rosas, Americas director at Amnesty International.

Spyware exposed

Amnesty International’s investigation found evidence of Nuria Piera’s device first being compromised with Pegasus on or around 20 July 2020. Similar signs were also discovered on or around 8 September 2021 and 1 October 2021. Amnesty International also shared forensic data with The Citizen Lab for peer-review, who confirmed the conclusions using their independent methodology.

Nuria Piera told Amnesty International she was working on sensitive, high-profile investigations around the time her device was infected with Pegasus. She was looking into reports of corruption related to high-ranking government officials and relatives of the nation’s former president; months later, criminal judicial proceedings were brought against them for alleged bribery and other criminal charges.

Having already uncovered multiple cases in Mexico and El Salvador, we will continue to investigate any evidence that arises of the possible further use of Pegasus in the Dominican Republic.

Erika Guevara-Rosas, Americas director at Amnesty International

Piera first received confirmation that she had been targeted by Pegasus when notified by Amnesty International’s Security Lab. In November 2021, she received the Apple notification that was sent to users whose devices were reportedly attacked by exploits used by Pegasus and Quadream’s spyware, which has been linked to Pegasus. Piera stated that she had never received a judicial order or any other formal notifications from the Dominican authorities that she was under surveillance, nor told any of the reasons behind it.

These invasive tactics can be particularly harmful to women journalists, who often face gender-based attacks, including accusations of having violated traditional social, sexual or moral norms.

“You have to work hard to not become neurotic, because you’re always suspicious that someone may have information about you. It’s like being in quicksand. It really affects your sense of freedom, how free you feel to speak up. Sometimes you don’t even know how they want to hurt you, through you or through your loved ones. You then feel responsible, which is even more serious” Nuria Piera said.

Amnesty International urges the authorities to promptly conduct an independent, impartial, and transparent investigation into the unlawful targeted surveillance of journalists in the country, including the targeted attack with Pegasus on Nuria Piera.

“In a country where journalists and human rights defenders have long alleged that surveillance is prevalent, finding Pegasus should be taken as a concerning threat. Since surveillance poses enormous risks to the physical safety and mental wellbeing of journalists, and may place their sources, colleagues, friends, and family in harm’s way, the Dominican authorities must immediately investigate this case and provide effective safeguards to protect journalists and prevent this from happening again,” said Elina Castillo Jiménez, Digital Surveillance Researcher at Amnesty International.

There are now at least 18 countries, where it has been confirmed with forensics that journalists were targeted with spyware.

Surveillance and journalism in the Dominican Republic

As part of an ongoing investigation, Amnesty International spoke to dozens of journalists and human rights defenders in the Dominican Republic, nearly all of whom suspected they had been targeted for surveillance because of their work. Most suspected that intelligence officers were targeting them using traditional forms of surveillance, such as wiretapping.

The lack of transparency around the use of surveillance and spyware, however, makes it difficult for victims to obtain information or to seek accountability. In the Dominican Republic, there are no clear avenues for adequate remedies in the event of unlawful targeted surveillance. Habeas data, a constitutional avenue for data and privacy protection available in the country, and the criminal remedy available under Law 53-07 on Crimes of High Technology (Ley 53-07 sobre Crímenes y Delitos de Alta Tecnología), can only be used when you know who is surveilling you, which is not always possible without being granted access to information or without the necessary technical skills. It is often virtually impossible for targets to even prove the existence of surveillance, either because of technical hurdles or the covert nature of its use. These factors limit access to remedy and further expand the chilling effect of surveillance.

In a country where journalists and human rights defenders have long alleged that surveillance is prevalent, finding Pegasus should be taken as a concerning threat.

Elina Castillo Jiménez, Digital Surveillance Researcher at Amnesty International

In the Dominican Republic, journalists known for investigating corruption may also risk becoming the target of smear campaigns. Edith Febles, another prominent woman journalist who uncovered irregularities during the tenure of the former attorney general, told Amnesty International that she was regularly the target of waves of what appeared to be orchestrated attacks on social media because of her work.

“Something of this nature deeply harms the rule of law and harms the professional practice [of journalism]. No journalist should be subjected to acts of this nature, which basically seek to undermine their word, to undermine the possibility of people finding out what is going on, because the problem is not even you. When it comes to undermining credibility, what they are trying to do is to put an obstacle between you and the communication you have with people,” said Edith Febles.

Amnesty International asked the Dominican authorities for information or comment on the use of Pegasus. At the time of publication, the office of the Attorney General and the Ministry of Interior and Police responded that neither institution had bought or used Pegasus during the tenure of the current officeholders, which started in August 2020, and stated their willingness to investigate. Other authorities did not respond to the request. Amnesty International also asked NSO Group for comment, who did not provide a response.

As the country begins a legal reform of the National Intelligence System, Amnesty International urges the Dominican Republic to embrace this as an opportunity to implement a rights-respecting regulatory framework. Until such a framework is implemented, a global moratorium on the purchase, sale, transfer, and use of spyware must be enforced.

Background

Unlawful targeted surveillance violates the right to privacy and can lead to violations of numerous other human rights, including the rights to freedom of expression, association, and peaceful assembly. Inter-American and international law and standards require that any state interference of the right to privacy should be lawful, necessary, proportionate, and serve a legitimate aim. Targeting journalists or other human rights defenders because of their work is never in accordance with international human rights law. Using spyware to target journalists and human rights defenders — in the absence of adequate transparency and other safeguards — also instils fear and has a chilling effect on their ability to work without undue interference.

Unlawful targeted surveillance can also have significant effects on mental health. It can lead those who suspect they are under surveillance to distrust and limit their interactions with others, shrink their intimate circles, avoid certain places, and even change their families’ schools or housing, for fear of attacks against their loved ones in retaliation for their work or activism. As surveillance of one person can also expose the personal information of people in their network, it can also lead to concerns over the wellbeing of their colleagues, friends, relatives, and even their sources. In this sense, unlawful surveillance can also have an impact on the right to health of those targeted and those around them.

In 2022, Amnesty International’s Security Lab began to independently analyze technical data from a sample of individuals identified as potential Pegasus targets in the Dominican Republic, including journalists and human rights defenders, as part of a broader, ongoing investigation into unlawful surveillance.

In 2021, Amnesty International provided the technical support for the Pegasus Project, which identified at least 25 Mexican journalists who were selected for targeting over a two-year period. Amnesty International’s Security Lab also peer-reviewed a joint investigation that Citizen Lab and Access published in January 2022 and independently verified forensic evidence confirming the use of Pegasus against journalists and members of civil society organizations in El Salvador on a massive scale.

NSO Group claims to only sell its products to government agencies, stating on its website: “NSO products are used exclusively by government intelligence and law enforcement agencies to fight crime and terror”. This claim is clearly contradicted by these new revelations regarding the use of Pegasus to yet again target a journalist.