Judge Dismisses Pegasus Spyware Lawsuit Targeting Salvadoran Journalists
What Happened — A U.S. federal judge in California dismissed a lawsuit filed on behalf of El Faro journalists whose phones were infected with the zero‑click Pegasus spyware. The plaintiffs alleged 226 infections between June 2020 and November 2021, but the court ruled the case lacked jurisdiction.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of undisclosed third‑party surveillance tools infiltrating devices that handle sensitive information.
- Highlights the need for continuous monitoring of vendor‑supplied software and evidence‑backed due‑diligence to prove that no hidden malicious components exist.
- Aligns with a control objective around third‑party risk management—collecting, reviewing, and retaining assurance artifacts that satisfy multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected — Media and journalism organizations, especially those operating in high‑risk political environments; broader implications for any entity relying on third‑party mobile applications.
Recommended Actions
- Inventory all mobile applications and SDKs used by staff; verify provenance and conduct threat‑model reviews.
- Implement continuous vendor‑risk monitoring, capturing contracts, security attestations, and real‑time threat intelligence feeds as audit evidence.
- Prepare a defensible incident‑response playbook that includes evidence‑preservation steps for potential spyware detection.
Source: The Record
Technical Notes
- Pegasus is a zero‑click exploit that leverages iOS/Android vulnerabilities to gain full device control without user interaction.
- The attacks were timed to precede major investigative publications, indicating a strategic surveillance campaign.
Source: Knight First Amendment Institute