First came the revelation that prominent Mexican anti-corruption fighters, human rights activists and other government critics were targeted for surveillance with sophisticated spyware sold to the Mexican government for combating crime and terrorism. Now comes the shocking addendum that an international team charged with investigating the disappearance of 43 students in Mexico was also being watched with the spyware known as Pegasus, which secretly monitors a cellphone.

The alarming disclosures raise two related issues. One is the abuse by the government — or by some rogue elements in it — of highly sophisticated and expensive cyberwarfare technology. The government has denied responsibility for the espionage, but it acquired the weaponry, and using it against citizens raises profound legal and ethical questions, especially for a government already facing severe criticism over human rights.

The other issue is whether commercial vendors of mass surveillance tools, however well intentioned, can really control what they are used for. In this case, the NSO Group, an Israeli firm, said it sold Pegasus only to governments, only after checking their human rights practices and only on the condition that it be used solely for tracking criminals and terrorists. But NSO admitted that after a sale, it had no control over how the spyware was used. And once discovered in a phone, it is not possible to determine who planted it.