Spyware Sold to Mexican Government Was Used to Target Experts Investigating Missing Students

Revelations that the Mexican government has been using spyware intended to track terrorists to instead target journalists, opposition politicians, activists, and others escalated Monday when a report disclosed evidence the tools had also been aimed at international officials investigating the high-profile 2014 disappearance of 43 students.

The surveillance technology used appears to be Pegasus, a software created by the NSO Group, an Israeli arms manufacturer. It uses phishing links to hijack smartphones — once a device is infected, the software can monitor a person’s every move through access to phone calls, emails, and texts, rendering encryption useless. It also can take over the phone’s microphone and camera to record conversations and surroundings.

Since 2011 Mexican federal agencies have purchased around $80 million worth of spyware, according to the New York Times. NSO Group claims it only sells spyware to governments under the condition that the software will be used to monitor terrorist activity or criminal groups, like the drug cartels that plague Mexico. But abuse is not unheard of — in 2016, the United Arab Emirates allegedly used Pegasus to target a human rights defender.  

Now, forensic evidence analyzed by Citizen Lab, a research laboratory at the University of Toronto, reveals that a team of five international investigators looking into the case was also targeted in 2016. They join a growing list of 19 individuals Citizen Lab has confirmed were targeted by the NSO software, including lawyers for a Mexican human rights group also investigating the student disappearances. The infection attempts came at a time when the investigators were criticizing the Mexican government for interfering with their work and preparing their final report on the case.

The team, which included experts from Chile, Colombia, Guatemala, and Spain, was appointed by the Inter-American Commission on Human Rights and invited to Mexico to conduct an independent investigation into the sudden disappearance of 43 students in Sept. 2014. It seemed to herald an extraordinary moment of transparency after intense public outcry and frustration at government inaction. The students, young men and women from a rural teacher training school in Ayotzinapa, Guerrero, Mexico were intercepted by police on their way to a demonstration in 2014. After police opened fire on their buses, killing six people, the officers ushered the students into patrol cars. They were never heard from again. Three years later, the remains of only one have been identified.

The government claims that the alleged massacre was the work of local police in collaboration with drug cartels, and ended with a mass incineration at the local dump. But the investigative team eventually came to question key parts of the official narrative: Weather records showed it rained the night of the disappearance, and they found no evidence of a large-scale fire or bone fragments. They also couldn’t find a motive for the suspected killings.

But they were unable to solve the sordid mystery. The investigators say the government refused to cooperate and engineered a “smear campaign” discrediting their work. (The government denied responsibility for the harassment and promised a new investigation with the help of U.N. and FBI specialists. Critics are calling for a new independent inquiry.)

The spyware infection attempts allegedly occurred in March 2016, just as the investigators were accusing the government of interference and preparing their final report. The team’s executive secretary, who coordinated all the group’s movements, was sent two texts from someone posing as a friend whose father had died; links included in the text purported to share information about a funeral. The links were consistent with NSO spyware, Citizen Lab found. Other investigators on the team also received the same text messages.

It is unclear who ordered the spying — even NSO Group cannot determine where the phishing attempts originated. Under Mexican law, spying must be authorized by a federal judge, but is unlikely any judge would have legally signed off on such surveillance, because the investigators, working for the Inter-American Commission, were protected by diplomatic immunity.

“If this can happen to an independent body that has immunity and that is invited by the government, it is a bit scary to think of what could happen to a common citizen in Mexico,” Francisco Cox, one of the investigators, told the New York Times.

Photo credit: YURI CORTEZ/AFP/Getty Images