Researchers added a fourth group to the list of targets of Mexican government spyware, and this one’s a bombshell.
The research group Citizen Lab reported that the mobile phone used by the group of five international experts named by the Inter-American Human Rights Commission to independently investigate the 2014 disappearance of 43 students in Guerrero was infected with the Pegasus spyware. This spyware was sold exclusively to the Mexican government by the Israeli company NSO Group and works by sending texts with links that when opened deliver the entire contents and activity of the phone to agents for monitoring. The latest discovery brings the number of confirmed targets to 19, among them human rights activists, opposition politicians, critical journalists, anti-corruption leaders and public health promoters.
A Pattern of Abuse
On June 19, Citizen Lab released a report stating that between 2015 and 2016, at least 76 cell phone messages were received attempting to infect the phones of prominent critics of the Peña Nieto administration. On the same day, Citizen Lab, along with the Mexican chapter of the international freedom of expression watchdog Article 19, digital rights group R3D and SocialTIC—organizations that collaborated in the Mexico investigation—held a press in a downtown Mexico hotel. The room filled early with hundreds of members of the press and concerned citizens.
On stage eleven men and women, nearly all victims of the spyware told their stories and denounced the surveillance. The spyware sent out messages to entice users to click on a link, saying, for example, ‘my father died, we are devastated, here is the funeral information’ or ‘There’s a suspicious truck outside your house, here’s a picture I took’. In many cases the messages were tailored to the victim, such as texts to the investigative journalists who broke the story of the 7 million-dollar mansion where Peña’s family lived that was bought by a major government contractor (the Casa Blanca scandal), or to Aristegui’s adolescent son with messages referring to his mother’s work. Some even pretended to be the U.S. government by claiming the link contained important visa information. Once clicked, the victim’s phone became an open door to his or her private life.
The 16th article in the Mexican Constitution requires that any intervention of private communications must have a prior federal judicial authorization.
Ayotzinapa, Abuse after Abuse
It was no secret that the Mexican government was not happy with the work of the Inter-Disciplinary Group of Independent Experts investigating the September 26, 2014 disappearance of 43 students of the rural school Ayotzinapa and the murder on site of six others. First, the group debunked the central piece of the government’s case through a series of scientific proofs that the claim was physically impossible. The Federal Attorney General’s Office declared that the students were kidnapped by corrupt local police and turned over to a local organized crime group, which then murdered them and burned their bodies at a nearby dump. The experts showed that a fire of the intensity to completely destroy 43 bodies never took place there. In their final report they stated that the government had extracted confessions through torture, destroyed or hidden important evidence, stonewalled questions into the role of the army, and failed to cooperate fully with investigators. They discovered a bus that had been omitted from the investigation and opened up a new line of investigation into possible links between the crime and heroin trafficking in the region.
The spy attacks of the experts’ phone took place in the critical period between the release of the first report and the final report in May 2016. The Attorney General’s Office is one of the Mexican government agencies that purchased the spyware.
The New York Times, which has been covering the case closely, quoted the Rights Commissioner’s response to the latest revelations:
“This case just on its face — and presuming the veracity of the allegations — is serious enough to warrant the creation of an international commission,” said James L. Cavallaro, a commissioner on the Inter-American Commission on Human Rights, which appointed the group of experts. “The commission shares the concerns of others: How can the government be trusted to investigate its own alleged violation of citizen rights given its track record in this matter?”
With the Ayotzinapa case still unsolved, the students still disappeared, the motives still unknown and the masterminds still unpunished, the spy scandal adds another layer of injustice. It indicates what many of us have believed from the beginning– that the Mexican government is more concerned with damage control than truth because, for them, the truth could be very damaging.
“Cyber warfare”: Who’s the Enemy?
The Israeli company NSO, which Citizen Lab reports is trying to change its name to Q Cyber Technologies since the Mexican scandal broke, stipulates that it sells the powerful spyware program exclusively to governments for combating terrorism and organized crime. However, Citizen Lab notes that this is not the first time it has acquired information indicating that governments have misused the program.
Ana Cristina Ruedas of Article 19 commented at the press conference, “The evidence indicates that these new cases are not isolated, but points to the existence of a policy of systematic harassment of human rights defenders, journalists and activists. Likewise, based on these reports we can assume the absence of judicial authorization, legality, necessity and proportionality in the exercise of exceptional powers to carry out surveillance practices. These are behaviors that violate the privacy of people, inhibit freedom of expression and violate the right to defend human rights.”
The panel agreed that the it was highly unlikely that a judge had authorized any of these interventions since the targets were neither terrorists nor members of organized crime groups.
With the latest report on the phone of the international investigators, there have now been four reports on misuse of the spyware—the first involving food rights activists campaigning for a tax on soda pop, the second focused on the group present at the May event, the third relating to opposition politicians from the right-wing PAN party and this one. Although Mexican dissidents have long suspected they were being spied on, for the first time in recent history this investigation provides society with “scientific and forceful evidence” of espionage against people critical of the regime, as described by journalist Carmen Aristegui.
At the press conference, Aristegui decried that “the government has used our taxes and our resources to commit serious crimes.” In reference to the texts sent to her son’s phone in the United States she asked:
“Why did the government of Enrique Peña Nieto want a teenager’s cell phone information? What would the government of Enrique Peña Nieto do with the information of a young student? Did he intend to use something that he got from that to attack journalists more than he already has done in other ways?”
The Mexican journalist community has been rocked by more than a 100 assassinations of journalists in the past 17 years there’s been over a and suffered harassment and intimidation under the Peña government. The age of technology puts us in a paradoxical situation. On the one hand, it provides vital tools for people who are dedicated to defending human rights and questioning government actions. On the other, it provides the government with sophisticated equipment like Pegasus to repress these efforts.
When asked if there are precedents to the Mexican case, John Scott Railton, the Citizen Lab researcher, said, “It is an unfortunate group of countries that are linked to this type of activity. And I would highlight that many of those who use it, are countries that are barbaric and authoritarian”.
The same day of the press conference, the group of journalists, lawyers and activists filed a formal complaint with the Attorney General’s Office. A member of the audience asked if the group thought the government would carry out a trustworthy investigation. The director of the Mexican Miguel Agustin Pro Human Rights Center, Mario Patrón, a target of the spyware, responded with a rhetorical question, “Will the government have the capacity and the will to investigate itself? I think we all know the answer,” he said. “Our intention with the complaint that we presented today is just to monitor and document the impunity and ineffectiveness of the state’s own institutions”.
Patron said the journalists and rights defenders demand that the Mexican government “open independent, comprehensive and transparent investigations, as well as sanctions against those responsible who, through abuse of power, have decided to illegally violate the privacy of these members of society. We also demand the necessary legal reforms to regulate the powers of the State in accordance with human rights standards and guaranteeing accountability. ”
Aristegui, director of Aristegui News, urged President Enrique Peña Nieto and his government to explain what happened.
The Mexican government responded late and badly. Daniel Millán Valencia, director of international media for the Presidency, penned a letter sent to the New York Times and Aristegui News stating, “There is no evidence that Mexican government agencies are responsible for the alleged espionage described in the article. For the Mexican government, respect for the privacy and protection of personal data of all individuals are values inherent in our freedom, democracy and the rule of law.”
On June 22 Enrique Peña Nieto at the inauguration of an industrial park in Jalisco, going on the offensive: “I hope that the Office of the Attorney General can quickly determine responsibilities, and I hope, under the law, that justice can be applied against those who have raised these false accusations against government”.
The People’s Money Used against Them
Spying on citizens by these means is outrageously expensive. Infecting ten iPhone users costs $650,000, plus an additional $500,000 fee for software installation, according to the report. This doesn’t quite reach the levels of the alleged recent embezzlements of former state governors , but it does beg the question of why these public resources are not used to search for the over 30,000 disappeared in the country.
The May 19 article on the front page of the New York Times, calls the espionage program “an unprecedented attempt to weaken and intimidate people trying to end the corruption that affects Mexican society.” An editorial following the more recent revelations of the spy program against the human rights experts, states:
“The mass disappearance (of the Ayotzinapa 43) has already done great damage to Mexico and its president, Enrique Peña Nieto, who came to office promising to change the country’s image. That image has only been worsened by the latest revelations.” The paper supports the call for another international investigation.
Mexico and the president’s PRI party is gearing up for a presidential election in 2018. The last thing it needs is another scandal. It’s very likely that the Peña administration will do everything possible to sweep the spy scandal under the rug–a rug already bulging with clumsily hidden scandals and atrocities. International pressure is critical now to support the journalists, human rights defenders, activists and citizens in Mexico clamoring for justice.
