Investigation finds spyware targeted international group of experts who took issue with Mexico’s inquiry into the disappearance of 43 students

Investigators have revealed that targets of high-tech spying in Mexico included an international group of experts backed by the Organization of American States who had criticized the government’s investigation into the disappearance of 43 students.

Mexican spy scandal escalates as study shows software targeted opposition Read more

Previous investigations by the internet watchdog group Citizen Lab found that the spyware had been directed at journalists, activists and opposition politicians in Mexico.



But targeting foreign experts operating under the aegis of an international body marks an escalation of the scandal, which so far involves 19 individuals or groups. The experts had diplomatic status, making the spying attempt even graver.

“This must be investigated to find out who sent these messages, because they could put at risk a lot of contacts and sources,” said the former Colombian prosecutor Angela Buitrago, a member of the group of experts.

Buitrago said she and another expert, Carlos Beristain, had received the messages. She said she hadn’t opened them.

“I didn’t open it because I am used to spying,” Buitrago said. “When you work in a prosecutors’ office, a government office, there are strange messages and you pass them on to the analysts.”

A report released by the University of Toronto-based analysts found that someone sent emails with links to the spyware to the International Group of Independent Experts, named by the Inter-American Commission on Human Rights. The experts had been critical of the government’s investigation into the 2014 disappearance of 43 students from a rural teachers’ college in Guerrero state – a politically sensitive incident that deeply embarrassed the government.

While the Mexican government bought such software, it’s not clear who used it. Mexico’s president, Enrique Peña Nieto, last week dismissed allegations that his government was responsible and promised an investigation.



Arely Gómez, who was attorney general at the time some of the hacking attempts occurred but now heads the country’s anti-corruption agency, said on Thursday that her office had intelligence tools “like any other attorney general’s office in Mexico and anywhere else in the world”.

“During my term, they were always applied in accordance with the legal framework,” Gomez said.

The spyware, known as Pegasus, is made by the Israel-based NSO Group, which says it sells only to government agencies for use against criminals and terrorists. It turns a cellphone into an eavesdropper, giving snoopers the ability to remotely activate its microphone and camera and access its data.

The spyware is uploaded when users click on a link in email messages designed to pique their interest.

Citizen Lab said the spyware attempts against the international experts occurred in March 2016 as the group was preparing its final, critical report on the government investigation into the disappearances.

The 43 students were detained by local police in the city of Iguala on 26 September 2014, and were turned over to a crime gang. After an initial investigation, the government said it had determined the “historical truth”: that all of the students had been killed and that their bodies had been incinerated at a dump and then tossed into a river.

But only one student’s remains have been identified, with a partial DNA match on another. The experts criticized the government’s conclusions, saying there was no evidence of a fire large enough to incinerate the bodies and that government investigators had not looked into other evidence.

How Mexico's attack on human rights undercut an international investigation Read more

Citizen Lab said it found similarities in the messages or the sender’s phone number to a previous spyware attack. In a 19 June report, the group said at least 76 spyware text messages had been sent to 12 prominent journalists and rights activists in Mexico, all of whom were investigating or critical of the government. Some had uncovered corruption.

The conservative National Action Party was also a target.

The investigators said they had no conclusive proof of government involvement in the attacks, but John Scott-Railton of Citizen Lab said the National Action case “makes it crystal clear that NSO has been used widely and recklessly across a swath of Mexican civil society and politics. Once again we see ‘government-exclusive’ spyware being used for seemingly political ends”.

“As cases continue to emerge, it is clear that this is not an isolated case of misuse, but a sustained operation that lasted for more than a year and a half,” Scott-Railton said.