New Delhi: Two years ago, Andrés Manuel López Obrador won an extraordinary victory. He obtained an outright majority to become the first leftist politician to become Mexico’s president in over three decades.
But, in the run-up to the 2018 election campaign, as the challenger to the incumbent president, Lopez Obrador, also known by his initials AMLO, was encircled by a massive spying campaign by Mexican government entities as per a leaked database of thousands of phone numbers believed to have been listed by multiple government clients of Israeli spyware firm, NSO.
France-based media non-profit organisation Forbidden Stories and human rights watchdog Amnesty International obtained access to 50,000 phone numbers listed by clients of NSO since 2016. This was shared with a group of 16 media partners across the globe, including The Wire, who worked together in a joint investigative project called the Pegasus project.
According to this data, the largest cluster was of more than 15,000 Mexican phone numbers which were selected for potential surveillance in 2016 and 2017, the crucial two years before the last presidential elections.
An Appeal: Support Investigative Journalism That Brings You The Truth. Support The Wire.
The Pegasus Project’s journalists were able to identify and verify more than 400 Mexican numbers. However, the leaked list of phone numbers does not make it clear how many were successfully targeted. Most of those interviewed no longer had the phones they were using when their numbers appeared on the database or had deleted their earlier SMSes, which made it impossible to forensically verify if their device had been penetrated.
The reportage for this article was done by journalists of the following Pegasus Project media partners – the Washington Post, Proceso, Aristegui Noticias, Forbidden Stories and Organised Crime and Corruption Reporting Project.
The Pegasus software is used to target phones, selected by clients, by sending customised text messages with a link. If the phone user clicks on the link, the NSO client will be able to access all the information on the device, from call records to chats, photos and emails. The spyware can also be installed through a zero-click exploit, which means the user does not have to click any link for the phone to be infected. Besides, the phone’s microphone and camera can also be remotely switched on for eavesdropping.
The consortium of 17 partners was able to identify traces of Pegasus in phones of two Mexicans employed in news organisations, whose numbers figured on the list. The analysis of the phones of a human rights activist and a former prosecutor proved inconclusive, as they had replaced the devices they were using in 2016 and 2017.
In response to a detailed questionnaire sent by Pegasus Project partners, NSO Group has denied all charges, claiming that its technology has helped prevent terrorist attacks and break up criminal gangs. “NSO Group will continue to investigate all credible claims of misuse and take appropriate action based on the results of these investigations,” the company said. It asserted that it had no visibility into its clients’ data and neither does it operate spyware licensed to clients.
Previously, Citizen Lab, a digital surveillance research organisation based at the University of Toronto, and Amnesty International had detected at least 26 infections in phones of Mexican journalists, activists and politicians.
The Israeli firm has repeatedly asserted that it sells Pegasus only to “vetted” government entities. In Mexico, three different government agencies had signed deals with NSO, as per media reports.
Also Read: Pegasus Project: How Phones of Journalists, Ministers, Activists May Have Been Used to Spy On Them
A few years after the War on Drugs began, the Mexican defence ministry was reportedly the first to buy the software, but its usage was never officially confirmed. Milenio, a national newspaper, published documents in 2017 that showed that the attorney general’s office was using Pegasus to monitor 500 people.
The current administration, led by López Obrador, also said that the domestic intelligence agency, Cisen, extensively used Pegasus from 2014 to 2017, coinciding with the term of President Enrique Peña Nieto and his Institutional Revolutionary Party (PRI) in power.
In 2017, Peña Nieto had also publicly confirmed that his government was using the Pegasus spyware. However, he stated that it was being used to fight organised crime and categorically rejected “any sort of intervention in the private lives of activists or any other citizens.”
Defeating his predecessor Felipe Calderón, Peña Nieto arrived with a lot of promise, but eventually his six years as head of state between 2012 and 2018 became synonymous with massive corruption scandals and soaring criminal violence.
Enrique Pena Nieto, former Mexican president, in December 2017. Photo: Reuters/Carlos Jasso
Snooping on politicians, others
Meanwhile, AMLO was campaigning across the country with his new political party, Movement for National Regeneration (Morena), armed with a pro-poor message, with an emphasis on ending corruption.
The leaked records show that AMLO’s wife, three brothers, two sons, two chauffeurs, legal adviser, party finance head, close aides, potential cabinet members were all selected as targets by official Mexican entities. It even included the manager of Amigos, the amateur baseball team in which the 67-year-old AMLO played. The president’s phone didn’t figure in the list, with his aides saying that he uses it infrequently.
In total, the phone numbers of over 50 individuals connected to AMLO were confirmed to be in the leaked NSO data by media partners of the Pegasus Project.
In 2013, right after losing his second presidential bid, AMLO suffered a heart attack. It became an electoral issue that his political rivals raised frequently, especially to contrast his apparent ill-health with Peña Nieto’s youthfulness. Mexican media carried leaked reports about his health that were used to raise doubts before the elections. AMLO’s cardiologist Patricio Heriberto Ortiz Fernández figures in the Pegasus Project data, but it is not clear if his phone was successfully compromised.
Also Read: Hacking Software Was Used to Spy on Jamal Khashoggi’s Wife Months Before His Murder
Besides, more than scores of Morena party members, both at the national and local level, were selected for infection through the controversial NSO spyware. This, as per the leaked records, included Claudia Sheinbaum, who became Mexico City’s first woman mayor in 2018.
As the first country to buy Pegasus, Mexico had been the laboratory to develop the application of the software.
In an interview to CBS News in the aftermath of the Jamal Khashoggi murder fallout, NSO Group’s founder and CEO Shalev Hulio did not directly admit that Pegasus was being used in Mexico. Nevertheless, he cited newspaper reports to say that the arrest of El Chapo, a notorious drug lord, had required authorities to “intercept a journalist, an actress, and a lawyer”. “Now by themselves, they –
you know, they are not criminals, right?”.
While high profile Narco kingpins and corrupt politicians have been selected as targets, it is also clear that Pegasus was probably a tool for massive political snooping by government entities.
In June 2017, the New York Times had reported on the hacking of phones of Mexican journalists and activists over the previous two years, via Pegasus. The latest leak shows that the surveillance campaign was unprecedented in scope.
The sheer scale of the leaked records which lists judges, footballers, diplomats, lawyers, models, relatives of public figures belies claims by NSO that its products are used only to combat terror and crime. It also includes phones of at least 25 journalists, as well as representatives of teachers’ unions who were fighting the Peña Nieto government over education reforms.
Guillermo Valdés Castellanos, who led the domestic intelligence agency, Cisen, from 2006 to 2011 stated that while “technology like Pegasus is very useful for fight organised crime”, the lack of checks and balances means it easily ends up in private hands and used for political and personal gains.
Journalists who were targeted were investigating links between criminal syndicates, local politicians and law enforcement authorities. Photo: Reuters
In March 2017, just hours after he made a Facebook live broadcast about collusion between local authorities and criminal gangs, journalist Cecilio Pineda was shot dead by gunmen. His phone number had been added to the list in the previous weeks. However, no forensic analysis can be done as his phone disappeared from the crime scene.
According to former Mexican government officials, a judge’s order is usually required to tap phones, but more often than not, the procedure is not followed. So far, no individual has been convicted for violating privacy laws.
With the war on drugs in the backdrop, Mexico has become a major buyer of spyware. Media reports had stated that at least 25 private companies, including the NSO Group, have sold products for surveillance to Mexico’s federal and state police forces.
“Under Peña, the use of Pegasus went wild,” said the former head of Cisen.
But, its fingerprints in government machinery have also been carefully wiped away.
Alfonso Navarrete Prida took over as secretary of the Interior in the last few months of the Peña Nieto presidency. He told a Pegasus Project journalist that when he became head of the ministry in January 2018, the spyware was not being plied, as per official records. “There were no documents that showed that this software had been used,” he said.
Mexico’s former government minister, Ángel Osorio Chon, whose ministry supervised the domestic intelligence agency, denied that they had access to spyware. “The head of the Government Ministry between December 2012 and January 2018 never authorised, nor had knowledge or information that CISEN acquired or used the Pegasus hacking tool,” he said in a letter to the Pegasus Project.
Former president Peña Nieto was unreachable, despite various attempts made through his former aides, former ministers and letter written to his daughter.
Pena’s predecessor targeted too
Among those listed in the leaked list is Pena’s predecessor, Mexico’s 63rd President Felipe Calderon and his wife, Margarita Zavala from the conservative National Action Party (PAN).
Zavala recalled to a Pegasus Project journalist that when she was preparing for her own presidential campaign in 2016, an odd-sounding text message popped up. “We always assume we’re spied on,” she said.
Since she doesn’t have access to that mobile phone, the hacking cannot be forensically proven. But, as per the data, Zavala, as well as her campaign team were targeted by more than one NSO client in 2017.
The widespread surveillance gnawed away at Mexico’s political system, with many browbeaten and forced to leave the field. “It shouldn’t be so difficult to be a politician,” said Zavala, adding, “It shouldn’t cost you so much”.
A senior PAN official, Fernando Rodriguez Doval, also remembers that in 2016 text messages with links to open for a news magazine featuring him and renewal of Netflix subscription. At least 80 PAN politicians, ranging from governors of states, legislators and office-bearers, figure in the database.
The first female governor of Mexico’s northern state of Sonora, Claudia Pavlovich, is not surprised that she was one of the possible Pegasus targets. “They had been listening to me for a long time,” she said.
During her 2015 gubernatorial campaign, local media published leaked recordings of her conversations that suggested that a member of her party, PRI, was involved in bribery. She claimed that the recordings were doctored.
According to the leaked list, Pavlovich, along with aides and cabinet colleagues, were selected for surveillance after she became governor.
Perusing the leaked records, Pegasus Project journalists also detected phone numbers of at least 45 former and current governors of Mexico’s 32 states. This included 29 who were sitting governors in 2016 and 2017.
Peña’s home province, the State of Mexico, held its governor elections in June 2017. The province is a PRI stronghold – the party had held the state for just shy of a century – and the president’s cousin was running for governor. But with Peña’s approval ratings tanking, the election was seen as a dress rehearsal for the following year’s general elections.
The Pegasus Project media partners have found from analysing phone records that politicians from every party were targeted, including gubernatorial candidates, their families and associates, in the run-up to polling day. Finally, PRI’s Alfredo del Mazo Maza scrapped through with a narrow victory.
While Peña faced an avalanche of political scandals, the most damaging was perhaps the disappearance of 43 protesting trainee teachers from a college in Guerrero state’s Ayotzinapa town. On September 26, 2014, they were last seen being driven off in police vehicles.
Activists hold a sign that reads “We are missing 43” during the delivery of the final report of the 43 missing students from the Ayotzinapa teacher’s training college by members of the Inter-American Commission on Human Rights (IACHR), at Claustro de Sor Juana University in Mexico City, Mexico, April 24, 2016. Credit: Reuters/Edgard Garrido
As per the leaked data, relatives of at least three of the victims were selected as targets. This included Meliton Ortega, uncle of 19-year-old Mauricio Ortega, who became the spokesperson for the families. “I have always suspected that the authorities are monitoring me. They are absolutely capable of it,” he said.
Vidulfo Rosales, a lawyer of a human rights NGO working for the families, was also in the crosshairs. “[The government] felt pressure and began a smear campaign against experts, parents and representatives of the GIEI… They tapped my phones and misrepresented many conversations, making them public to discredit the work we were doing,” Vidulfo Rosales told a Pegasus Project journalist.
An international panel of investigators, known by their Spanish acronym GIEI, had found that the official probe had not taken into account the presence of soldiers and federal police.
University of Toronto’s Citizen Lab had first revealed that one phone belonging to the group was targeted by Pegasus in March 2016. The leaked data accessed by Pegasus Project shows that at least one other phone belonging to the panel was also selected for surveillance.
The widening outrage over the presumed massacre implicated Tomás Zerón, the director of the attorney general’s Criminal Investigation Agency, who was also a signatory of Pegasus contracts. He had previously been more well known for leading the investigations against the drug baron, known as ‘El Chapo’.
Also Read: FAQ: On the Pegasus Project’s Digital Forensics
After AMLO took over the presidency, Mexican authorities charged Zerón with embezzling state funds in one case and kidnapping and evidence tampering in the investigation of the students’ disappearance.
Zerón escaped to Israel in 2019, where he applied for political asylum. Last week, the New York Times reported that Israel has refused to extradite him due to Mexico’s criticism of Tel Aviv’s treatment of Palestinians.
Mexico’s undersecretary for human rights, Alejandro Encinas, stated emphatically that the “instructions from the president are, we don’t spy on anybody”. He claims that even after he became a minister, his phone battery suddenly drained inexplicably at least three times, fueling suspicion of surveillance.
The Leftist leader considers himself a veteran of being kept under watch, with his phone tapped since his days as a student activist. Admitting that accountability in the official machinery over deploying spyware for blanket surveillance will take some time, he said, “There’s a long way to go in investigating and ending the impunity associated with these practices”.
Read The Wire’s coverage as part of the Pegasus Project here.