Mexican investigative journalist Carmen Aristegui speaks to reporters in Mexico City, June 19, 2017. (AP/Eduardo Verdugo)
Mexican investigative journalist Carmen Aristegui speaks to reporters in Mexico City, June 19, 2017. (AP/Eduardo Verdugo)

Spyware targeted Mexican journalists and activists

Mexico City, June 20, 2017–Attempts to spy on Mexican journalists and human rights activists by infiltrating their mobile devices with spyware threaten press freedom in the country, the Committee to Protect Journalists said today. A report released in Mexico City yesterday by the press freedom group Article 19 and open internet researchers R3D and the University of Toronto’s Citizen Lab documented the attempts.

Journalists, human rights defenders, and anti-corruption activists were targeted by sophisticated spyware capable of accessing their contacts, emails, and other sensitive information stored on their mobile phones, the report found. The software was also capable of recording keystrokes on the devices and of effectively turning the devices’ microphones into a listening device, according to the three groups.

“The surveillance of journalists threatens press freedom in Mexico, and potentially the safety of their sources for sensitive stories,” Carlos Lauría, CPJ’s program director and senior program coordinator for the Americas, said from New York. “The Mexican government should credibly investigate this intrusion and make the results of that investigation public.”

Targets received text messages to their mobile phones that contained seemingly credible warnings about, among other things, the wellbeing of family members. The recipients were invited to follow a link to an empty web page that sent the spyware to their phones, where it could operate undetected.

Among the targets were investigative journalists Carmen Aristegui and Carlos Loret de Mola, the director of the human rights group Centro PRODh, and the director of the think tank IMCO, the report found. Families were also targeted: The researchers found that Aristegui’s 16-year-old son received the “phishing” text messages, as did the wife of IMCO director Juan Párdenas.

Citizen Lab identified the spyware as Pegasus, a program developed by Israeli company NSO Group as a digital tool to combat terrorism and organized crime. According to news reports, the NSO Group sells Pegasus only to governments. NSO did not respond to CPJ’s phone calls seeking comment.

Carmen Aristegui and her investigative team in 2014 reported that the president’s wife had bought a mansion in Mexico City from a contractor with ties to the government. Carlos Loret de Mola investigated alleged extrajudicial executions by Federal Police in the town of Tanhuato, roughly 430 kilometers (267 miles) northwest of the capital. Centro PRODh, meanwhile, provided legal support to the families of 43 students who disappeared in Guerrero state in 2014, whereas IMCO has in recent years been a strong proponent of federal anti-corruption legislation, The New York Times reported yesterday. According to the report, the targets of the spyware received most of the phishing text messages while they were investigating or supporting issues that directly involved government institutions.

Citizen Lab stressed that the software cannot be traced back to its original senders and that there was no conclusive evidence as to who was behind the cyberattacks.

Mexico’s federal government denies it spied on the journalists or activists. A spokesperson for President Enrique Peña Nieto referred CPJ to the government’s statement to The New York Times, in which it “categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization.”