Report: Mexican journalists, activists targeted with spyware

MEXICO CITY (AP) — Mexican journalists, lawyers and activists were targeted by spyware produced by Israel's NSO Group that is sold exclusively to governments, according to an internet watchdog group's investigation published Monday.

Titled "Reckless Exploit," the report by Citizen Lab at the University of Toronto said the targets included people such as prominent journalists Carmen Aristegui and Carlos Loret de Mola, who were investigating alleged government corruption and purported human rights abuses by security forces.

The people targeted received messages with links that, if clicked on, opened up their devices to being exploited and spied upon.

The report comes at a time when Mexican journalists and human rights defenders already feel under attack. Six journalists have been killed this year.

NSO's Pegasus spyware allows hackers access to phone calls, messages, cameras and personal data. The company says it sells the product only to governments for the purposes of fighting crime and terrorism.

Citizen Lab said it had "no conclusive evidence attributing these messages to specific government agencies in Mexico. However, circumstantial evidence suggests that one or more ... of NSO's government customers in Mexico are the likely operators."

The report noted that the targets involved "domestic issues of immediate concern to powerful Mexican interests" and the government, and that "multiple government agencies in Mexico are reportedly NSO customers."

Mexico issued a statement saying that just like any other democratic country, it conducts intelligence operations to combat organized crime and defend national security. But it denied any illegal spying.

"The Government of the Republic categorically denies that any of its entities carries out actions of surveillance or intercepting communications from human rights defenders, journalists, anti-corruption activists or any other person without prior judicial authorization," it said.

Citizen Lab said it documented at least 76 messages containing links to the security exploit. Many were sent in August 2015 or between April and July of the following year.

The use of the software was so sloppy — sending multiple messages from the same domains or sending identically worded messages to multiple targets — as to suggest that the perpetrators wanted it to be known as a form of intimidation.

"The messages were both brazen and extremely obvious. ... Were these messages sent to lower-profile private individuals, the ruse may never have been discovered. But instead, the messages were sent to very high profile and well known journalists, increasing the likelihood of discovery," Citizen Lab said.

Loret de Mola, in a recorded message played at a news conference Monday in Mexico City, said initially he declined to participate because in the context of Mexican journalists being killed the spying seemed minor. He has a news program on the Televisa network and writes a column for El Universal newspaper.

But upon further reflection he changed his mind "because spying opens the door to go farther: the intimidation, the harassment, the censorship, the firings, the beatings, the abductions, the kidnappings, the disappearances, the murders, the impunity that makes it likely that none of this is investigated, that none of it is punished," he said.

Other targets included members of the Centro Miguel Agustin Pro Juarez, a prominent human rights group that has investigated cases such as the disappearance of 43 students whom police allegedly detained and turned over to drug gang killers; the anti-graft group Mexicans Against Corruption and Impunity; and the Mexican Institute for Competitiveness, a civil society group working on economic policy and combatting corruption.

Aristegui, who exposed a case of possible conflict of interest involving a luxury home acquired from a government contractor by President Enrique Pena Nieto's wife, was aggressively targeted according to Citizen Lab.

She received more than two-dozen messages with NSO links claiming to be from "the U.S. Embassy in Mexico, Amber Alerts, colleagues, people in her personal life, her bank, phone company and notifications of kidnappings," the report said.

Citizen Lab said some family members of the targets also received spyware messages, including Aristegui's son who was a minor at the time and got at least 21 of them.

Ana Cristina Ruelas of the media rights group Articulo 19 read a statement at the news conference demanding the government make public any information it has on the spying revealed by the report and investigate possible punishments for those responsible.

"Espionage in Mexico has become an effective mechanism of intimidation against human rights defenders, activists and journalists," it said. "It constitutes a form of control over the flow of information and abuse of power."

The victims filed a complaint with the Attorney General's Office Monday and reported the case to National Human Rights Commission.

"Enrique Pena Nieto must explain," Aristegui said.

"We don't know if the journalists killed were spied on beforehand," she said. "We don't know if something happened, but in light of this we have a right to think it."

Frank Smyth, executive director of the U.S. group Global Journalist Security, called Citizen Lab's report a reminder of the perils that spyware represents in an increasingly wired world.

"This is an escalation of surveillance, but it's a predictable one considering our technological capabilities and potential," Smyth said.