Mexico City, March 20, 2019–Griselda Triana, the widow of slain Mexican journalist Javier Valdez Cárdenas, was targeted by spyware identified as Pegasus in 2017 in an apparent spying attempt, according to a new report released today by Canadian research group Citizen Lab.
According to the report–released in collaboration with freedom of expression group Article 19 and Mexican digital rights group R3D–Triana received text messages on May 25 and May 26, 2017, containing links that, when followed, would have installed software on her mobile phone without her knowledge. That software would have allowed a third party to have access to, and even control, most functions of the phone. The spyware attack occurred 10 days after Valdez–a 2011 recipient of CPJ’s International Press Freedom Award–was shot dead in Culiacán, the capital of the northern Mexican state of Sinaloa.
Mexican media first reported in June 2017 that spyware known as Pegasus was purchased by the Mexican federal government from Israeli security firm NSO Group. Citizen Lab said that although it is thus far impossible to determine the exact source of the spyware attacks, its investigation points to a group linked to the Mexican government. The Mexican government of then-President Enrique Peña Nieto repeatedly denied the allegations that it spied on journalists, activists or human rights defenders.
“The Mexican government cannot plead ignorance or incapacity in this particularly outrageous scenario of the grieving widow of a murdered reporter targeted by spyware the federal government itself purchased,” said Jan-Albert Hootsen, CPJ’s Mexico representative. “Although this occurred under his predecessor, President Andrés Manuel López Obrador must immediately and credibly investigate accusations of spying by government agencies, lest his promises to improve the dire environment for Mexican journalists ring hollow.”
The attempt to surveil Griselda Triana is the 25th known case of third parties attempting to install spyware on the mobile phones of journalists, activists, laywers, and other Mexican citizens, according to the Citizen Lab report. CPJ has reported on the use of NSO spyware to intercept the communications of journalists around the world, including the way that it may have been used to spy on slain Saudi journalist Jamal Khashoggi.
In October, CPJ issued a safety advisory for journalists on how to protect themselves and sources against Pegasus spyware.