By AZAM AHMED and NICOLE PERLROTH
JUNE 19, 2017
MEXICO CITY — Mexico’s most prominent human rights lawyers, journalists and anti-corruption activists have been targeted by advanced spyware sold to the Mexican government on the condition that it be used only to investigate criminals and terrorists.
The targets include lawyers looking into the mass disappearance of 43 students, a highly respected academic who helped write anti-corruption legislation, two of Mexico’s most influential journalists and an American representing victims of sexual abuse by the police. The spying even swept up family members, including a teenage boy.
Since 2011, at least three Mexican federal agencies have purchased about $80 million worth of spyware created by an Israeli cyberarms manufacturer. The software, known as Pegasus, infiltrates smartphones to monitor every detail of a person’s cellular life — calls, texts, email, contacts and calendars. It can even use the microphone and camera on phones for surveillance, turning a target’s smartphone into a personal bug.
The company that makes the software, the NSO Group, says it sells the tool exclusively to governments, with an explicit agreement that it be used only to battle terrorists or the drug cartels and criminal groups that have long kidnapped and killed Mexicans.
But according to dozens of messages examined by The New York Times and independent forensic analysts, the software has been used against some of the government’s most outspoken critics and their families, in what many view as an unprecedented effort to thwart the fight against the corruption infecting every limb of Mexican society.
“We are the new enemies of the state,” said Juan E. Pardinas, the general director of the Mexican Institute for Competitiveness, who has pushed anti-corruption legislation. His iPhone, along with his wife’s, was targeted by the software, according to an independent analysis. “Ours is a society where democracy has been eroded,” he said.
The deployment of sophisticated cyberweaponry against citizens is a snapshot of the struggle for Mexico itself, raising profound legal and ethical questions for a government already facing severe criticism for its human rights record. Under Mexican law, only a federal judge can authorize the surveillance of private communications, and only when officials can demonstrate a sound basis for the request.
It is highly unlikely that the government received judicial approval to hack the phones, according to several former Mexican intelligence officials. Instead, they said, illegal surveillance is standard practice.
“Mexican security agencies wouldn’t ask for a court order, because they know they wouldn’t get one,” said Eduardo Guerrero, a former analyst at the Center for Investigation and National Security, Mexico’s intelligence agency and one of the government agencies that use the Pegasus spyware. “I mean, how could a judge authorize surveillance of someone dedicated to the protection of human rights?”
“There, of course, is no basis for that intervention, but that is besides the point,” he added. “No one in Mexico ever asks for permission to do so.”
The hacking attempts were highly personalized, striking critics with messages designed to inspire fear — and get them to click on a link that would provide unfettered access to their cellphones.
Carmen Aristegui, one of Mexico’s most famous journalists, was targeted by a spyware operator posing as the United States Embassy in Mexico, instructing her to click on a link to resolve an issue with her visa. The wife of Mr. Pardinas, the anti-corruption activist, was targeted with a message claiming to offer proof that he was having an extramarital affair.
For others, imminent danger was the entry point, like a message warning that a truck filled with armed men was parked outside Mr. Pardinas’s home.
“I think that any company that sells a product like this to a government would be horrified by the targets, of course, which don’t seem to fall into the traditional role of criminality,” said John Scott-Railton, a senior researcher at Citizen Lab at the Munk School of Global Affairs at the University of Toronto, which examined the hacking attempts.
The Mexican government acknowledges gathering intelligence against legitimate suspects in accordance with the law. “As in any democratic government, to combat crime and threats against national security the Mexican government carries out intelligence operations,” it said in a statement.
But the government “categorically denies that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization.”
The Mexican government’s deployment of spyware has come under suspicion before, including hacking attempts on political opponents and activists fighting corporate interests in Mexico.
Still, there is no ironclad proof that the Mexican government is responsible. The Pegasus software does not leave behind the hacker’s individual fingerprints. Even the software maker, the NSO Group, says it cannot determine who, exactly, is behind specific hacking attempts.
But cyberexperts can verify when the software has been used on a target’s phone, leaving them with few doubts that the Mexican government, or some rogue actor within it, was involved.
“This is pretty much as good as it gets,” said Bill Marczak, another senior researcher at Citizen Lab, who confirmed the presence of NSO code on several phones belonging to Mexican journalists and activists.
Moreover, it is extremely unlikely that cybercriminals somehow got their hands on the software, the NSO Group says, because the technology can be used only by the government agency where it is installed.
The company is part of a growing number of digital spying businesses that operate in a loosely regulated space. The market has picked up in recent years, particularly as companies like Apple and Facebook start encrypting their customers’ communications, making it harder for government agencies to conduct surveillance.
Increasingly, governments have found that the only way to monitor mobile phones is by using private businesses like the NSO Group that exploit little-known vulnerabilities in smartphone software. The company has, at times, operated its businesses under different names. One of them, OSY Technologies, paid Michael T. Flynn, President Trump’s former national security adviser, more than $40,000 to be an advisory board member from May 2016 until January, according to his public financial disclosures.
Before selling to governments, the NSO Group says, it vets their human rights records. But once the company licenses the software and installs its hardware inside intelligence and law enforcement agencies, the company says, it has no way of knowing how its spy tools are used — or whom they are used against.
The company simply bills governments based on the total number of surveillance targets. To spy on 10 iPhone users, for example, the company charges $650,000 on top of a flat $500,000 installation fee, according to NSO marketing proposals reviewed by The New York Times.
Even when the NSO Group learns that its software has been abused, there is only so much it can do, the company says, arguing that it cannot simply march into intelligence agencies, remove its hardware and take back its spyware.
“When you’re selling AK-47s, you can’t control how they’ll be used once they leave the loading docks,” said Kevin Mahaffey, chief technology officer at Lookout, a mobile security company.
Rather, the NSO Group relies on its customers to cooperate in a review, then turns over the findings to the appropriate governmental authority — in effect, leaving governments to police themselves.
Typically, the company’s only recourse is to slowly cut off a government’s access to the spy tools over the course of months, or even years, by ceasing to provide new software patches, features and updates. But in the case of Mexico, the NSO Group has not condemned or even acknowledged any abuse, despite repeated evidence that its spy tools have been deployed against ordinary citizens and their families.
From Hope to Intimidation
Journalists, human rights defenders and anti-corruption campaigners have long faced enormous risks in Mexico. For decades, they have been followed, harassed, threatened and even killed for their work, occupational hazards more common in authoritarian states than in countries in good standing with the Organization for Economic Cooperation and Development, as Mexico is.
But when President Enrique Peña Nieto came into office in 2012, promising to lift Mexico to its rightful place on the world stage, there was an inkling of hope that the nation’s democracy was coming into its own.
His party passed a list of badly needed changes, taking aim at the failing education system and moving to enhance the transparency of Mexico’s bureaucracy. Competition in some core industries, like telecommunications, has increased.
But by 2014, much of the early promise of the Peña Nieto administration was dashed by the crises subsuming it, including the mysterious disappearance of 43 teaching students after a clash with the police, and accusations that the president and his wife got a special deal on a multimillion-dollar home from a government contractor.
The scandals have left an enduring mark on the president’s reputation. After a stunning rise built on a perfectly crafted image — a young, energetic president working across party lines, the embodiment of a new Mexico — Mr. Peña Nieto was suddenly recast as an out-of-touch, corrupt politician with abysmal approval ratings.
In no small part, that fall was thanks to the Mexican journalists who broke news of the scandals, as well as the lawyers and activists who refused to let the country forget about them.
“You have to remember this was a government that went from setting the agenda to being entirely reactive,” said Carlos Loret de Mola, a news anchor for Televisa who has some of the best sources inside the Mexican government.
Mr. Loret de Mola, who received at least eight messages laced with NSO software, added, “They looked at journalists and thought, ‘They are bringing these things out and embarrassing us, so it’s better if we spy on them.’”
Mexico is still a far cry from Turkey, which jails more journalists than any other nation in the world. It is hardly China, an authoritarian state where critics are silenced and a Western-style free press has been cast as a political peril by the government. But Mexico is in crisis on these fronts all the same.
More journalists were killed in Mexico last year than during any other year this century, and 2017 is off to an even worse start. Government critics are routinely harassed and threatened, and now they are being targeted with incredibly sophisticated software.
“The fact that the government is using high-tech surveillance against human rights defenders and journalists exposing corruption, instead of those responsible for those abuses, says a lot about who the government works for,” said Luis Fernando García, the executive director of R3D, a digital rights group in Mexico that has helped identify multiple abuses of Pegasus in Mexico. “It’s definitely not for the people.”
‘About Getting Revenge’
Perhaps no journalist in Mexico has done as much to damage the reputation of the president than Carmen Aristegui. And few have paid as dearly for it.
In 2014, she and her team broke the scandal of the so-called Casa Blanca, or White House, a story of real estate intrigue that involved a special deal handed to Mexico’s first lady, Angélica Rivera, by a major government contractor close to the president.
The story reached a worldwide audience and forced the president’s wife to surrender the house, presenting the Mexican government with the sort of ethical quandary that in a different country might result in a congressional inquiry or the appointment of an independent prosecutor.
Instead, the president was cleared of wrongdoing by a prosecutor who had worked closely with his campaign team, while Ms. Aristegui lost her job. That moment marked the beginning of a sustained campaign of harassment and defamation against her: lawsuits, break-ins at her offices, threats to her safety and the monitoring of her movements.
“It’s been about getting revenge for the piece,” she said. “There’s really no other way to see it.”
So when she began receiving text messages in 2015 from unknown numbers, instructing her to click on a link, she was suspicious. One message asked for her help in locating a missing child. Another alerted her to sudden charge on her credit card. And she received a text message purportedly from the American Embassy about a problem with her visa. Impersonating an American government official is a possible violation of United States law.
When the messages failed to entice her to click on the links and inadvertently download the software, they grew increasingly strident, including one warning that she could be imprisoned. Several came from the same phone number, leaving a record of the spyware operator’s sloppiness.
Still, the spyware operators pressed on. Starting as early as March, they began targeting Ms. Aristegui’s then-16-year-old son, Emilio, who was living in the United States at the time. Some of the texts were similar to the ones she had received. Others were made-up headlines about Ms. Aristegui, sent from what appeared to be a news agency.
“The only reason they could be going after my son is in the hopes of finding something against me, to damage me,” she said.
Ms. Aristegui is the embodiment of the hope — and the crushing limitations — for a free media in Mexico. Though she was fired over what her employer called internal disagreements, she continued publishing on her own, eventually drawing enough of an audience to sustain a team of reporters.
But the work has taken its toll. In one lawsuit, filed by the president of her former employer, a judge cited Ms. Aristegui last November for her “excessive use of freedom of speech.”
Her website, Aristegui Noticias, has been hacked numerous times, including on the eve of publishing a major investigation into the massacre of more than a dozen civilians by the federal police.
And her offices were broken into last November. So brazen were the assailants that they didn’t bother wearing masks. Nor did they steal much — one computer, a watch and a bag hanging from the back of a chair. Their faces and fingerprints were captured on cameras in the office. Still, no one has been caught.
The threats, harassment, even the spying, all of it she channels into work.
“For me, I have opted to believe that my public work is what will best protect me,” she said. “The great challenge for journalists and citizens is that the fear serve us, and not conquer us.”
Texts Laced With Menace
It was Dec. 21, 2015, and Mr. Pardinas was at the beach with his family, trying to enjoy the start of his Christmas vacation. But his phone kept buzzing, at first with calls from lawyers, and then with an odd text message.
It had been a long few months in an even longer campaign: to pass an unprecedented law forcing Mexico’s public servants to disclose their financial conflicts of interest.
In November, he had presented a study on the costs of corruption in Mexico, confirming with facts and figures something that nearly all Mexicans knew in their hearts — that corruption was crippling the country.
He followed it up with media interviews, poking fun at the Mexican government’s embarrassing response to corruption. He joked that it probably spent more money on coffee and cookies than on the office in charge of prosecuting graft.
The study, the interviews, a seemingly endless gantlet of meetings with politicians — it all laid the groundwork for the new law, which Mr. Pardinas, a private citizen directing a public policy group, was helping to write.
So even as Christmas approached and his family relaxed in the coastal town of Puerto Vallarta, Mr. Pardinas was busily consulting lawyers on the final draft, which he had just over a month to submit.
And then a message: “My father died at dawn, we are devastated, I’m sending you the details of the wake, I hope you can come.” Attached was a link.
Mr. Pardinas thought it odd that whoever had sent such a personal text was not even among the contacts in his phone. He showed his wife the message, and decided to ignore it.
Things only picked up from there, both on his proposed law and the odd messages. The government roundly ignored his bill, until he and others gathered more than 630,000 signatures supporting it.
Mr. Pardinas’s tone grew bolder. He told one radio host that “for the government of Mexico, anti-corruption measures are like garlic to a vampire.”
Then came another text message. This one appeared to be from the news outlet Uno TV, which sends daily news headlines to cellphone users across the country. The headline struck him: “The History of Corruption Within the Mexican Institute for Competitiveness.” It was particularly alarming because that was his organization.
He declined once more to click on the link, suspecting foul play. More text messages came, including the next day. Only this time, having failed with Mr. Pardinas, they tried his wife.
The message, sent from the same news headline service, said that leaked videos showed Mr. Pardinas having sexual relations with a member of his staff. It was also sent to a colleague.
Mr. Pardinas called his wife, telling her that she appeared to be part of a broader harassment effort. “Oh, it’s these people again,” she responded.
The campaign to pass the law continued, and the bill made it through Congress relatively unscathed. But the Senate decided to add an extra provision: Everyone who worked for a company that received government money would also have to disclose their interests and assets. That meant the bill would cover more than 30 million people.
The president vetoed the bill, saying it needed more discussion, essentially kicking the can down the road.
Mr. Pardinas continued his broadsides in interviews, naming obstructive lawmakers and well-connected companies that benefited from government money. Few activists go so far as to name names in interviews, but Mr. Pardinas, who holds a Ph.D. from the London School of Economics, plowed ahead anyway.
The initiative seemed doomed. Yet another message arrived, on Aug. 1, this one laced with menace: “Listen, outside of your house is a truck with two armed guys, I took their photo look at them and be careful.”
Mr. Pardinas, who was at work when this message came, once again declined to take the bait. But he did call his wife, again, asking her to look out their window to see if there was a truck parked outside. There was not.
“By the end, my wife had Olympic-style training in this hacking stuff,” Mr. Pardinas said.
‘It Comes With the Territory’
Mario E. Patrón was on edge. The conference table was packed with fellow human rights defenders, including the United Nations commissioner for human rights in Mexico. Everyone was there to discuss the bombshell expected to drop.
An international panel brought to Mexico to investigate the haunting disappearance of 43 teaching students was releasing its final report the next day, at the end of April 2016. The findings, Mr. Patrón knew, were going to be brutal.
The government would be accused of negligence, incompetence, even malfeasance in its handling of the case. Like others in the room, Mr. Patrón, whose organization represents the parents of the missing students, was wondering how the government would respond.
His phone buzzed and he glanced at the screen. “THE GOVERNMENT OF MEXICO GETS OUT IN FRONT OF THE GIEI,” the text message read, using the acronym for the international panel. It seemed like the news he had been waiting for.
He showed the message to his colleague, then clicked on the link. But instead of an article or a news release, it simply redirected him to a blank page. Confused, he left the meeting and raced to his office to begin making calls to see what the government had in store.
And like that, he fell into their trap.
Mr. Patrón is the executive director of the Miguel Augustín Pro Juárez Human Rights Center, perhaps the most highly respected human rights group in Mexico. The group focuses on the nation’s most serious cases of human rights abuses, making it a nettlesome critic of the government.
In addition to Mr. Patrón, two other lawyers for the group were targeted with the software: Santiago Aguirre, the primary lawyer representing the families of the missing students, and Stephanie E. Brewer, a Harvard-educated American lawyer who has worked for the group since 2007.
“We have always suspected they spied on us and listened to us,” Mr. Patrón said. “But to have evidence that we are victims of actual surveillance — it confirms that we are under threat. And that the government is willing to use illegal measures to try and stop us.”
Beyond the missing students, Centro Prodh, as the group is called, is representing one of the few survivors of a military raid in 2014 in the town of Tlatlaya, where the army stormed a suspected cartel hide-out and killed 22 people.
While pursuing the case, the group unearthed a memorandum ordering the soldiers to kill suspected cartel members, strengthening the argument that the events did not unfold as a firefight, as the military claimed, but were instead extrajudicial executions carried out by the soldiers.
The organization’s clients also include the women of Atenco, a group of 11 university students, activists and market vendors who were arrested by the police more than 10 years ago during protests in the town of San Salvador Atenco and brutally sexually assaulted on the way to prison.
Aside from the grave abuse of power, the case was especially sensitive: The governor who ordered the crackdown on the protesters was Enrique Peña Nieto, now the president of Mexico.
From the very beginning, the case was an uphill battle. Arrested on trumped-up charges, some of the women spent more time in prison than the officers who raped them.
Finding no recourse in Mexico, Ms. Brewer and others appealed to the Inter-American Commission on Human Rights, a regional body outside the Mexican judicial system, to review the case. And they waited — for nearly seven years.
Finally, in 2015, the commission found in favor of the women, ordering the government to investigate the case all the way up the chain of command, a directive that would include Mr. Peña Nieto. Ultimately, the case was sent to the Inter-American Court, an independent judiciary with jurisdiction over Mexico, a major blow to the nation’s presidency.
One evening Ms. Brewer was at home, getting ready for bed when a text message arrived. The date practically coincided with the 10-year anniversary of the assaults on the women, an eerie bookend to their decade-long struggle for justice.
On her phone was a provocative question, a taunt even, asking whether anyone defended the soldiers and members of Mexico’s navy who also suffered abuse.
“And you guys that do human rights against this, what about the dignity of them …” The message contained a link, presumably to a news story or a tip.
Intrigued, Ms. Brewer clicked on it. She was directed to a broken link, a telltale sign of the malware.
“It’s just part of defending human rights in Mexico,” she said. “It comes with the territory.”
Azam Ahmed reported from Mexico City, and Nicole Perlroth from Boulder, Colo. Paulina Villegas contributed reporting from Mexico City.
This post was updated on .
Awesome report. ..Scary as hell for its content and implications for all of us everywhere.
IMO, Mexico (a corrupt, failed State) is an ideal testing ground for the abuse of this kind of "spy" technology to be applied on citizens.
Digital technology (Spyware, the Cloud, GPS locators, social, psychological, DNA profiling, GPS micro-drones with high definition cameras and listening/recording devices, marketing profiles, etc. are realities of our times.
The world as we once knew it, no longer exists. I'll back this statement up with references in future posts.
This post was updated on .
A detailed article with great graphics on the same topic of Mexico and NSO "Pegasus" spyware (("NSO Group" (AKA Q Cyber Technologies) is a Israel company.)).
Quote from the article:
"In the past five years it has become increasingly clear that civil society is under threat from the misuse of powerful spyware tools exclusively sold to governments. Research has repeatedly shown how governments around the world use digital spying tools designed for criminal investigations and counterintelligence to target journalists, human rights defenders, and others."
.... "Once infected, a phone becomes a digital spy in the pocket of a victim, fully under the control of the operator. An infected phone can be configured to report back all activities on the device, from messages and calls (even those via end-to-end-encrypted messaging apps), to recording audio and taking pictures."
Click here for article: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/
The NY Times article mentions Carlos Loret de Mola, but it doesn't go into detail about why he was being hacked with spyware.
From late Summer into Fall of 2015, Loret de Mola published a series of reports detailing how extrajudicial executions took place during the Federal Police attack on Rancho del Sol in Tanhuato, Michoacán on May 22, 2015.
On that day 42 supposed narcos associated with CJNG werer killed, while one federal police officer was killed.
Loret de Mola was given access to both the state of Michoacán PGR and Federal PGR report on the incident.
He was shocked how clearly the executions were described in the reports. The majority of the 42 were shot at close range (less than two meters). Many in the back. Most of the weapons seized had not been fired.
When his report came out on the State investigation, the state authorities comically speculated about a "close range shootout."
Neither report has ever been made available to the public and no charges were ever brought against any federal officials.
Good links everyone. With my weak command of Spanish, I take it that the Mexican government is saying they have nothing to do with the spyware misuse and respect the rights and freedoms of all its citizens?
Yes, pretty much!
I've got a two gold ingots for sale cheap. Anyone?
Chava, here is a little more from the article that I posted earlier.
I think it helps answer your question.
.... " Journalism Under Threat in Mexico
Mexico is one of the most dangerous places in the world for journalists. Reporters covering sensitive issues often face threats of kidnapping, intimidation, or physical violence as a result of their work. Mexican organized criminal groups are responsible for much of this violence. However, according to a recent report from human rights group Article 19, at least 53% of the 426 acts of violence and intimidation against journalists in 2016 were linked to officials. The report also found that virtually none of these actions resulted in legal consequences for the aggressor. In spite of these risks, reporters and editors continue to report on important issues, including corruption at the highest levels of the country. Reporters working on these topics often face threats in an attempt to intimidate them into silence.
Many Mexican journalists have stated their belief that their communications are monitored by elements within the Mexican government and security services. Prior Citizen Lab research on NSO group also included an example of a targeted Mexican journalist (Rafael Cabrera). In another case indicating surreptitious monitoring, a recording of a private phone call between Santiago Aguirre and the parent of one of the victims of the Iguala Mass Disappearance appeared online. Aguirre is one of the targets of infection attempts using NSO exploit links that we examine here.
While these cases provide indications that Mexican journalists are under digital surveillance, their clandestine nature can make them hard to document. This report, and corresponding reporting by R3D, Social Tic, and Article 19, provide the clearest evidence yet that government-exclusive spyware is being used in an effort to infect and monitor Mexican journalists."
Original article at: https://citizenlab.org/2017/06/reckless-exploit-mexico-nso/
This post was updated on .
Here is a bit more (from Reforma, 6-28-17) on the topic at hand.
JUNE, 28, 2017
Mexico Government Espionage: Acting As If Nothing Happened
Reforma: Genaro Lozano*
Translated by Melanie Orr and Reed Brundage
The Mexican president is close to the people. This is how he sees himself in the relaunch of his image. The last attempt during his presidential term to improve his deteriorating image. So, we find him hugging a woman, playing chess with an elderly man, waving enthusiastically at a group of indigenous young people. A president who is interested in his people, who wants so very much to listen to them, who wants so very much to know what they think, a president who is so interested in his people that his government bought spy software to tap the cellphones of activists, journalists and opinion leaders who are critical of his governance.
It is the breakdown of the Mexican government. A government who manufactured a historic truth [regarding what happened to the 43 disappeared Ayotzinapa students] to file away the case at the tipping point of his time in office. A government who opened the door to a group of international experts [the Interdisciplinary Group of Independent Experts] to aid the investigations into the Ayotzinapa 43, only to discredit their findings. A government headed up by a president who acts as though he were in charge of a country, but who can’t seem to control even his own thoughts. A government that has already overtaken the previous presidential term in regards to the lack of responsibility in managing the crisis of insecurity that we are living in.
For this reason, Enrique Peña Nieto resembles the ex-US president Richard Nixon. The president whose government spied on their opposition, the Democrats, and who recorded their telephone conversations. The president who used to speak about a “silent majority”, who challenged the media and declared publically that “the press is the enemy”. The spy scandal had consequences and Nixon was obliged to step down as president. Peña is similar to Nixon, but Mexico is not similar to the US.
In Mexico, nothing happens. Nothing happens if an investigation by the world’s most prestigious newspaper [New York Times] reveals that activists and journalists have been spied on using software bought by the Mexican government. Nothing happens if organizations such as Citizen Lab, Article 19, SocialTIC and R3D: Network in Defense of Digital Rights document the messages received on the cell phone of activists and journalists. Nothing happens if Mexicans Against Corruption and Impunity reveal the links between a company favored with contracts by the government of Peña Nieto and the Israeli company that sells technology for espionage.
Much less important is the criminal complaint for espionage made [by those whose phones were hacked] to the Special Prosecutor for the Care of Crimes against Freedom of Expression (FEADLE), which has not been able to solve a single case of murder of journalists. Nothing happens because neither the National Institute for Access to Information (INAI) nor the National Human Rights Commission (CNDH) exhaust their constitutional powers as autonomous bodies and use their independence to act ex officio and demand transparency in technology contracts.
Peña Nieto's threat to those who carried out the investigation and denounced the espionage is added to the other statements for which he will be remembered, his legacy. And the absence of effective counterweights in Congress point to the closure of the Peña Nieto administration [November 31, 2018] with a total decomposition in public opinion. The Congress has failed to call officials to appear and even the President himself to clarify who bought the technology, who is using it and how.
This government no longer has credibility. The FEADLE prosecutor's announcement that he has asked for help from the FBI, the Canadian government and the UN is welcome, but it is late. In addition to these international bodies, there are also the OAS [Organization of American States] human rights rapporteurs and a UN rapporteur on the right to privacy in the digital age, led by Joseph Cannataci.
Given the lack of credibility of the government, a model of international support for this research is urgently needed and it is urgent that Congress awaken from its lethargy and react to the statements of a confused President, Enrique Peña Nixon.
Reforma only allows subscribers to access its articles online.
*Genaro Lozano is a political scientist with a Ph.D. from the New School for Social Research and undergraduate degree from the Autonomous Institute of Technology of Mexico. He is a professor at ITAM and the Iberoamerican University. He is deputy director of Foreign Affairs Magazine-Latin America. He is a CNNSpanish political analyst and contributor to the Mexican Institute of Radio. @genarolozano
Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware June 29, 2017
Three senior Mexican politicians were targeted with infection attempts using spyware developed by the NSO group, an Israeli “cyber warfare” company.
Ricardo Anaya Cortés, President of Mexico’s National Action Party (PAN)
Senator Roberto Gil Zuarth, President of Mexico’s Senate (during the targeting)
Fernando Rodríguez Doval, Communications Secretary for PAN
All three targets are members of the socially conservative National Action Party (PAN). Between June and July 2016 they were sent text messages containing links to NSO’s exploit framework.
The findings build on our prior collaborative investigations published on June 19 2017, and February 11 2017 uncovering targeting of Mexican journalists, lawyers, scientists, and public health campaigners using NSO’s exploit framework.
Newly Discovered Targets
This research note outlines three new targets: Senator Roberto Gil Zuarth, President of Mexico’s Senate during the targeting period and member of Mexico’s National Action Party (PAN), Ricardo Anaya Cortés, President of PAN, and Fernando Rodríguez Doval, Communications Secretary for PAN. PAN, a major opposition party, is traditionally viewed as socially conservative, and has provided Mexico with two of its most recent presidents: Vicente Fox and Felipe Calderón.
Target: Senator Roberto Gil Zuarth
Senator Roberto Gil Zuarth is currently the President of Mexico’s Senate and a member of PAN. Between June 15 and 17 2016 he was sent three infection attempts in the form of text messages with links to NSO exploit infrastructure.
The messages echoed themes uncovered in prior Citizen Lab reports of targeting in Mexico, such as the death of a father, and a news story in the Mexican news magazine Proceso mentioning the target. A third message suggests that another political party (Party of the Democratic Revolution: PRD) has been critical of him and his colleagues.
The messages pointed to links on the domain smsmensaje[.]mx. Citizen Lab has previously identified this domain as a part of the NSO exploit infrastructure. Clicking on the link would have infected Roberto Gil Zuarth’s iPhone with Pegasus spyware.
Target: Ricardo Anaya Cortés
Ricardo Anaya Cortés is a lawyer, politician, and current president of PAN. On June 15, 2016 he was sent a text message claiming that he was mentioned in an article in Proceso. Notably, his colleague at PAN, Senator Roberto Gil Zuarth received a nearly identical message on the same day.
Target: Fernando Doval
Fernando Doval is the communications secretary for PAN, having previously served as a legislator representing the Federal District (Mexico City) in the Mexican Congress. On July 14, 2016 he was targeted with an infection attempt via text message.
The message was similar to messages sent to his PAN colleagues, and claimed that he had been mentioned in an article on Proceso.
These cases indicate that during June and July 2016 senior Mexican politicians who are members of PAN were targeted with multiple infection attempts using NSO’s technology. While we are not privy to the reasons behind the timing of the targeting, it may be relevant that during this particular timeframe, anti-corruption legislation was being discussed in Congress.
This latest discovery is the result of close collaboration between Citizen Lab and Mexican partner organizations, and provides further evidence of the widespread and highly political targeting using NSO’s Pegasus infrastructure. It also reflects the willingness of individuals targeted with infection attempts to come forward and share their cases.
Our investigations have now found NSO used against scientists, health advocates, lawyers, journalists, senators, and politicians in Mexico.
We hope this finding will contribute to further scrutiny and investigation of the way that NSO’s Pegasus was used in the Mexico, and across its borders.
Mexico opposition officials targeted by government spying: report
Three senior opposition officials in Mexico, including a party leader, were targeted with spying software sold to governments to fight criminals and terrorists, according to a report by researchers at the University of Toronto.
The officials, who included conservative National Action Party (PAN) head Ricardo Anaya, received text messages linked to software known as Pegasus, which Israeli company NSO Group only sells to governments, the report by Citizen Lab said.....
Arely Gómez acknowledged using the espionage system
It was purchased by former prosecutor, Murillo Karam
Although it was announced that the "Pegasus" malware, which was used to spy on journalists,
human rights defenders and activists, was used in 2015, when Arely Gómez was already Attorney General of the Republic. Now secretary of the Public Service admitted that the Mexican government did use spyware, but, she added, that was done under the law.
Beyond seeing in what part of the law espionage is legal, the question is why Pegasus was not employed for what was its fundamental purpose: to locate narcotraffickers and terrorists and, instead, Arely Gómez used it against activists and Journalists, in total violation of their human rights.
"I am telling you that the Office of the Attorney General of the Republic and any Attorney General whehter from the Mexican State or from anywhere in the world, has, in order to fulfill its mandate, some intelligence systems and tools that must always be used within the framework. During my mandate, they were always attached within the legal framework, what the law gives us to combat organized crime and crime," said Gómez.
Below is another hyper-critical OP ED on the current SPYING issues in Mexico.
Mexico Government Espionage: The Spies and the Spied On
Posted: 30 Jun 2017 02:02 PM PDT
Reforma: Sofía Orozco*
Translated by Emma Manson
"Thanks to those who keep a punctual and detailed record of everything, we know that during the first quarter of 2017 Mexico has seen more violence than ever before. The number of intentional murders has surpassed the point of counting. To this one must add the numerous assaults, kidnappings and cases of extortion. We are not misled; nor did we receive more information than normal today: we are just living through this tragic time.
Our government has shown neither response, nor interest in reclaiming our institutions of security or dispensing justice; quite the contrary, it spends its time focusing on frivolous tasks and dedicating itself to gossip.
At a high financial price (and a democratic one), we understand that the government feltlike meddling in the private lives, curiously enough, of journalists who don’t support the government, politicians and activists. These people have subsequently been told that there is no evidence for these claims and, if they want, they may file a complaint (to be investigated by the government itself, but the government will deny everything and declare that it is classified information in order to be done with it as quickly as possible. In other words: do what you want.
The government can’t locate fugitives and doesn’t know where criminals are or what they are doing, but when it is convenient for them they go straight to the cutting edge of cyber spying technology. And we all know their intentions: to shut people up, to censor, to suppress, to get revenge, to fabricate crimes, basically, to get rid of anything that gets in its way.
The government can’t locate the former PRI governors nor the money that they took with them from public funds, but soon they will be able to geotag you in your voting booth and take a satellite image of you in order to see whom you voted for.
If we thought that it couldn’t get any worse, then we were wrong.
The worst part comes when we think about all the hope we have invested in the 2018 presidential and congressional elections being democratic. Really? Innocence continues to overcome us. Regardless of the fact that even today we are still unable to distinguish a candidate who is strong, foolproof, able to unify the vote, able to provide certainty, able to win an election at a national level… deep down we know there is no magical way to change the situation.
I don’t blame Andrés Manuel López Obrador [head of the Morena party and its likely presidential candidate] for acting somewhat crazily; it is considerably easier to make funny advertisements that talk of beans and pigs instead of raising any alarm. It is easier for him to believe in blind faith that, when he comes to power, he will be able to stop the robbery and corruption, than to even consider what he might have to do in order to reduce them, albeit just a little.
So-called democratic elections, true to the system that we know, under the supervision of the National Electoral Institute, which monitors them so carefully, and considers them full of challenges, are not going to get better on their own; but they could certainly get much worse.
Without a doubt we have many spies and many who are being spied on and, with technology that favors the highest bidder, the situation keeps getting more twisted. How sad. In the middle of the worst period of violence, with poverty rates out of control, in a country lacking a sufficient healthcare system, educational reforms in turmoil, energy prices through the roof, unsustainable development, half the official payroll drowning in corruption and with extortionate election campaigns, we will have fragile candidates, ruptured political parties, false news, new and more sophisticated methods of buying votes and all kinds of other botched jobs.
Now Enrique Peña Nieto says that he, too, feels spied on. I can’t imagine the boredom of the people who observed him up close. Hopefully it was espionage with a motive; I’m sure that they’ve already come across a bunch of books and a dictionary that have the words “damage”, “injustice” and “cynicism” clearly highlighted...."
This post was updated on .
Spyware Sold to Mexican Government Targeted International Officials
By AZAM AHMED
JULY 10, 2017
MEXICO CITY — A team of international investigators brought to Mexico to unravel one of the nation’s gravest human rights atrocities was targeted with sophisticated surveillance technology sold to the Mexican government to spy on criminals and terrorists.
The spying took place during what the investigators call a broad campaign of harassment and interference that prevented them from solving the haunting case of 43 students who disappeared after clashing with the police nearly three years ago.
Appointed by an international commission that polices human rights in the Americas, the investigators say they were quickly met with stonewalling by the Mexican government, a refusal to turn over documents or grant vital interviews, and even a retaliatory criminal investigation.
Now, forensic evidence shows that the international investigators were being targeted by advanced surveillance technology as well.
The main contact person for the group of investigators received text messages laced with spyware known as Pegasus, a cyberweapon that the government of Mexico spent tens of millions of dollars to acquire, according to an independent analysis. The coordinator’s phone was used by nearly all members of the group, often serving as a nexus of communication among the investigators, their sources, the international commission that appointed them and the Mexican government.
Beyond that, the investigators say they received identical text messages on their own phones, too, luring them to click on links that secretly unlock a target’s smartphone and turn it into a powerful surveillance device. Calls, emails, text messages, calendars and contacts can all be monitored that way. Encrypted messages become worthless. Even the microphone and camera on a smartphone can be used against its owner.
The effort to spy on international officials adds to a sweeping espionage offensive in Mexico, where some of the country’s most prominent journalists, human rights lawyers and anticorruption activists have been the targets of the same surveillance technology. But the new evidence shows that the spying campaign went beyond the nation’s domestic critics.
It also swept up international officials who had been granted a status akin to diplomatic immunity as well as unprecedented access to investigate a case that has come to define the nation’s broken rule of law — and the legacy of its president, Enrique Peña Nieto.
Surveillance under Mexican law can be conducted only with the authorization of a federal judge, and only if the government can show cause to do so. But the kind of diplomatic immunity the investigators received meant that it was extremely unlikely that a federal judge would have been allowed to sign off on such a warrant, the investigators said.
“You are not just hacking anyone’s phone, you are hacking the phone of someone who has been granted immunity,” said Francisco Cox, one of the investigators and a prominent Chilean lawyer. “They couldn’t even search my bags in the airport.”
“If this can happen to an independent body that has immunity and that is invited by the government, it is a bit scary to think of what could happen to a common citizen in Mexico,” he said.
Since 2011, Mexico has purchased at least $80 million worth of the spyware, which is sold exclusively to governments, and only on the condition that it be used against terrorists and criminals. But an investigation by The New York Times and forensic cyberanalysts in recent weeks determined that the software had been used against some of the country’s most influential academics, lawyers, journalists and their family members, including a teenage boy.
The government has denied responsibility for the espionage, adding that there is no ironclad proof because the spyware does not leave behind the hacker’s individual fingerprints. It has promised a thorough investigation, vowing to call on specialists from the United Nations and the F.B.I. for help. One of the surveillance targets, the forensic analysis showed, was a United States lawyer representing victims of sexual assault by the Mexican police.
But the United States ambassador to Mexico, Roberta S. Jacobson, said the United States was not involved in the investigation. Opposition lawmakers and international officials are now calling for an independent inquiry into the spying scandal, declaring Mexico unfit to investigate itself.
“This case just on its face — and presuming the veracity of the allegations — is serious enough to warrant the creation of an international commission,” said James L. Cavallaro, a commissioner on the Inter-American Commission on Human Rights, which appointed the group of experts. “The commission shares the concerns of others: How can the government be trusted to investigate its own alleged violation of citizen rights given its track record in this matter?”
Another commissioner, Esmeralda Arosemena de Troitiño, backed the idea of an independent inquiry. “This investigation should find both the material and intellectual authors of the alleged spying,” she said.
Top officials from the nation’s main opposition party have come forward to say that they, too, have been targeted, raising the pressure on the government. The head of the National Action Party, Ricardo Anaya, says his party is pushing for a congressional committee to conduct its own inquiry and will also formally demand an international investigation into the spying.
“The grand tragedy of Mexico is impunity. Horrible things occur, and nothing happens,” he said. “This time, we will not let that happen.”
The disappearance of the students in September 2014 ignited an enormous outcry in Mexico. Hundreds of thousands poured into the streets to protest a case that, to many, represented all that afflicts Mexico, a nation where about 30,000 people have disappeared and more than 100,000 have been killed in the decade-long churn of the drug war.
The anger also focused on Mr. Peña Nieto, whose determination to change the narrative of his country from one of desperate violence to economic promise was suddenly, and permanently, upended. The outrage has been matched only by the disbelief that, almost three years later, nearly all of the 43 students are still missing. The remains of one have been discovered. Fragments of another may also have been identified. The rest of the students, whether dead or alive, have not been found.
Many Mexicans believed that their best chance of finding out what really happened to the students lay with the international investigators, who were appointed by the Inter-American Commission on Human Rights, a regional body based in Washington that monitors countries and can refer cases to court. But the investigators said the government essentially obstructed their inquiry and then cast them out by refusing to extend their mandate — evidence, they said, that the government simply did not want the case solved.
Still, it is hard to prove who ordered the spying. Even the manufacturer of the spyware, an Israeli cyberarms manufacturer called the NSO Group, says it cannot determine who, precisely, is behind specific hacking attempts using its technology.
But the company says that it sells its surveillance tools only to governments, and that stringent safeguards prevent them from being used by anyone outside of the government agencies that purchase the technology.
Moreover, once a person’s phone is targeted, researchers can verify that the spyware has been deployed by examining the text message to determine whether it points to a server running NSO’s technology. They have confirmed at least 19 cases in Mexico involving human rights lawyers, anticorruption activists, journalists and, now, international officials.
“Citizen Lab and our partners are finding people targeted with NSO spyware almost wherever we look in Mexico,” said John Scott-Railton, a senior researcher at Citizen Lab at the Munk School of Global Affairs at the University of Toronto, which has worked with the digital rights group R3D in Mexico to identify the spyware on the phones of targeted activists and officials.
“I have never seen anything that matches the scale and scope of this case,” he said of the surveillance campaign in Mexico.
Hacking attempts disguised as text messages appeared on the cellphone of the executive secretary for the investigators, the point person for all contacts with the group, on March 1 and 4, 2016, the forensic analysis found. Around the same time, lawyers for Centro Prodh, a human rights group looking into the mass disappearance of the students, were also being targeted by the software.
“The Mexican government implored the commission to create this expert group, and then when their investigation did not ratify the official version, things changed,” said Mr. Cavallaro, who was the president of the Inter-American Commission at the time of the hacking attempts. “If it’s true that the government spied or tried to spy on our experts, that would be an outrage of historic proportions.”
The investigators sent a private letter to the Inter-American Commission late last month, detailing their suspicions after The Times published an article about the hacking campaign. They said some of their phones had also been subject to suspicious messages.
One message, sent to one of the investigators in March, was from someone posing as a close friend whose father had died. A link was attached with the details of the funeral. When the link was opened, the website of a well-known funeral home in Mexico popped up. A similar message, with the same link, was also sent last year to an academic trying to impose a sugar tax in Mexico. In that case, the message was confirmed as Pegasus.
During the hacking attempts on the investigators, the group was in the throes of a crisis. The investigators had just complained publicly of being harassed, and they were less than two months from publishing their final report, which rejected the government’s version of what happened to the students.
The mystery began on Sept. 26, 2014, when about 100 students from a teachers’ college in the town of Ayotzinapa struck out to commandeer some buses. As they had in years past, the students planned to take the buses to Mexico City to attend a commemorative march and then return them, a tradition both the bus companies and the authorities typically tolerated.
But that night soon turned into an ominous chapter in Mexico’s modern history. The police fired mercilessly on the students and the buses transporting them, leaving six dead and scores wounded. The police emptied two buses of students, detained them and whisked them away in patrol cars.
The government maintains that local police officers, along with the drug gang they worked for, kidnapped the students, killed them and incinerated their bodies in a nearby dump.
The government version, however, never offered a clear motive for the attack on the students, and Mexicans pushed for an international inquiry. Eventually, the government agreed, and the Inter-American Commission on Human Rights appointed a five-member team of prominent prosecutors and rights activists from across the Spanish-speaking world.
When the investigators arrived in Mexico, after months of local protests over the disappearances, it was an exceptional moment: a reclusive government opening itself up to external scrutiny.
But within a few months, the relationship between the government and the investigators began to sour. In its first report, the investigators contradicted a central tenet of the government’s version, saying it could find no evidence of a fire big enough to burn 43 bodies, nor any remnants or bone fragments that matched those of the missing.
The acrimony came quickly. Pro-government newspapers began attacking the group, and the Mexican government opened a criminal investigation against the executive secretary of the Inter-American Commission, based on unsubstantiated claims about the misuse of funds.
“We always worked in good faith, and we went with open eyes and an open mind, only going where the facts led us,” said Mr. Cox, one of the investigators. “Our purpose was to contribute to the rule of law in Mexico.”
The more I read about this the more evident it becomes of the guilty 1 especially those international investigators of the 43 normalistas targeted with the spyware.
This post was updated on .
so if the U.S cant get a peice of the pie they will expose you !! is my understanding .how about google and apple ?us bid $180 mil to the the NSO i think they went as high as $220 !!so why are they putting there heads inside little dirt hole to hide ?shit how long do you think google and apple been collecting and selling info?how about a stimulus check for theyre customers ? free apps lmao !!!my ass!!this shit aint about spyware i can name so many programs that do the same and they are open source free to the public for educational purposes!!what you should really be asking yoursefl is why the fucken gov .is purchasing this crap !
In reply to this post by Chava
U.S ranks 38th in education and look how quick it pulls out their checkbook for worthless spyware Hahahah!!! people got wake up !
In reply to this post by deelucky1
I think they purchase "this crap" because they want to be on top of the game and they've got the money. These guys are all in bed with each other and while we look at Mexicos problems we dont see the US's B.S. Most people don't know much beyond what their media tells them to think. The internet was developed by the "defense" industry. Google and Facebook have partnered with CIA at times to develop different programs.
I am kind of surprised the NY times has reported on this and I think the reason why is that higher profile journalists have been killed in Mexico. Reporters stick together and the one power that a journalist has is to write, and now they are pissed off and since it has to do with Mexico, it is somewhat safer for them. Which leads me to the next question. Who is the USA using the pegasus program to spy on?
|Free forum by Nabble||Edit this page|