Mexico Hacking and Spying on Its Citizens Is a 'Human Rights Crisis'

A version of this op-ed was first published in Spanish on VICE Mexico.

In Mexico, we are living a human rights crisis. The government's response has been far from solving cases of corruption, forced disappearances, and torture, but to spy on those who report them, according to reporting published this week in The New York Times.

We already knew the Mexican government previously purchased Pegasus, a sophisticated surveillance software sold by NSO Group, the Israeli cyberarms company. As the Times reports, that spyware has been used to intimidate activists, reporters and human rights defenders. According to Citizen Lab, the digital rights research group that analyzed the spyware infections, targets of the Pegasus program include:

• Carmen Aristegui, the reporter who exposed the biggest government corruption case to date regarding President Peña Nieto and his wife for a mansion they bought in one of the most expensive areas of Mexico City;
• Aristegui's son;
• Juan Pardinas and anti-corruption activists working at the Mexican Institute for Competitiveness;
• Reporter Carlos Loret de Mola, who published a series of articles on a 2015 raid on an alfalfa ranch in Tanhuato, Michoacan, where Mexican police summarily executed 22 civilians who are believed to not have been involved with organized crime;
• Lawyer Mario Patrón and his team at the Centro Pro de Derechos Humanos, an NGO that is disputing three legal issues that have shaken Peña Nieto reputation and legitimacy. There's the case of 11 women from Atenco who were raped by police officers during an operation ordered by Peña Nieto. The episode known as the massacre of Tlatlaya, where the Army killed twenty two people. And the high-profile case of the forced disappearance of 43 three students of Ayotzinapa.

These cases directly challenge the legitimacy of the Mexican government. Despite being illegal, the abuse of hacking tools against activists and reporters in Mexico has become a systematic policy of intimidation and harassment.

The president's office initially denied the Times report from June 19, stating there "was no proof" to claims the Mexican government illegally targeted citizens using spyware . And while at it, the president's office told the victims to please go and file a complaint at the Attorney General's office—one of the Mexican agencies that purchased the malware from NSO Group.

In response to the Times report a spokesperson for the president's office tweeted a photo of the government's position, which reads:

Well, first of all, of course espionage is secret.

But there is also evidence of three Mexican government agencies having purchased Pegasus: the Attorney General (for $15 million), the National Defense Ministry (for around $250 million), and the Center for Research and National Security, or CISEN (according to one of the leaked Hacking Team emails). What's more, the NSO Group claims it only does business with governments.

It didn't take long for Peña Nieto to admit to the Mexican government purchasing surveillance technologies. During a press conference on June 22, he said the spyware was used for national security purposes and for combating organized crime. While it is "very easy to signal and point a government as an entity that spies " on its citizens, Peña Nieto said, it is "utterly false" to claim Mexico does.

The president also portrayed himself as a victim of espionage. "We live in a society that feels spied [on] all the time," Peña Nieto said, adding that he himself has received "text messages from unknown sources" so he tries to "be careful with what he talks [about] over the phone."

The way to infect a target with Pegasus is to send SMS text messages containing some kind of false information to a target's cellphone. The goal is to deceive the individual into clicking on a web page where they unwittingly download the malware. Pegasus then spreads like a virus through the device, turning their iPhone or Android into a digital spy at the government's beck and call. Operators then take over messages, emails, calls and activities on the targets' phones, knowing their locations and intimate details of their private lives. The malware also allows officials to remotely activate a phone's camera and microphones without the knowledge of the victim. Everything is recorded and registered.

The popular saying "he who doesn't owe anything has nothing to fear" does not apply in this case. If the Mexican government has all your information, anything can be taken out of context, edited and used against you. In April of last year, as part of a smear campaign that stemmed from the investigation into the case of the missing 43 students, someone leaked a phone conversation of the assistant director of the Centro Pro de Derechos Humanos, making it seem he had received money illegally. In reality, these were two different conversations that had no relationship with each other. But after being edited together, the message was successfully twisted.

Most certainly, the use of surveillance techniques against opponents and dissidents is a common practice for the Mexican president, even if it is illegal.

Peña Nieto spied on his political opponents during the 2012 presidential campaigns. Pegasus was used before against Rafael Cabrera, another key journalist in the investigation of the president's house, and the malware was also used against activists who proposed a tax increase on soda companies.

Moreover, the Mexican government is the leading client of Hacking Team, an Italian cyberarms firm that sells similar malware called Galileo. This was used by the governor in the state of Puebla to spy on his political opponents.

The constitution and law are clear: In order to justify the use of Pegasus in these cases, the Mexican government would have to prove that the targets are under criminal investigation or pose an "imminent threat to national security", and that a court order authorized the surveillance. If officials fail to do so, illegal surveillance is punishable with prison sentences ranging from 6 to 12 years.

In the case of NSO Group, part of the problem is it is not punishable because international human rights treaties don't directly apply to companies. On the other hand, while the Wassenaar Arrangement that controls the export of arms and "dual purpose technology" does exist, it does not have binding legal force among participating states, including Mexico. In other words, the Arrangement has to be implemented in national laws to have effect, which almost never happens, and especially not in Mexico.

In a context of impunity, surveillance is added to a devastating panorama of censorship. Mexico is one of the most dangerous places for journalists, oscillating between war-torn countries like Afghanistan and failed states like Somalia. According to Article 19, an NGO that defends freedom of speech rights, 106 journalists have died and another 25 have disappeared in Mexico since 2000. In the last six years, reporters have denounced more than 800 cases of harassment, assault or homicide committed against them and their peers while the "independent" federal office in charge of investigating such cases has convicted suspects in only three. The government places full blame on cartels for attacks on the press, yet civil society organizations identified connections to public officials in 53 percent of the 426 attacks recorded in 2016.

"We don't know whether murdered journalists were spied on before getting killed but we have the right to think they were," Carmen Aristegui said during a recent press conference after the Times story broke

She is right. Espionage to prevent crime or "terrorist attacks" is not the same as spying to intimidate activists, journalists, and human rights defenders. The first can be disproportionate and unjustified, but what Peña Nieto's government does belongs to authoritarian regimes.

To make matters worse, during his June 22 press conference the president also appeared to issue a threat, saying the Attorney's Office should investigate those who "have raised false accusations" against the government. When questioned by the Times, the president's spokesman clarified that the president did not intend that threat, and that he had misspoken.

During Augusto Pinochet's dictatorship in Chile, illegal espionage was the central element of the censorship campaign that in turn translated into executions and arbitrary torture. But it was also an assault on the imagination. What was it like to live in fear because each word, gesture, comment or thought could be heard or listened to? Paranoia magnifies totalitarian regimes. Silence begins to settle in.

In the case of the Mexican government, the use of malware for espionage is not only a form of directly blackmailing dissidents. It also sends a clear message to the rest of society: Facing the possibility of being spied on, we will say less, do less, and publish less.

Some people say it doesn't matter if the government spies on us. Privacy doesn't matter, they say, because citizens have "nothing to hide." This argument is as baseless as saying that freedom of speech doesn't matter because we have nothing to say.

Two years ago, Mexico's Attorney General said that the 43 disappeared students had been incinerated at a trash dump by cartel members. He called this the "historical truth", even though it was an outright lie and an obstruction of justice.

The journalists, activists and defenders of human rights like the ones spied with Pegasus are the only ones who can contradict the narratives the status quo wishes to impose. As a society we cannot give ourselves the luxury of their silence.

Gisela Perez de Acha is a Mexican lawyer who specializes on free speech and gender rights in the digital world. She runs an independent cultural center, and works for a Latin American NGO called Derechos Digitales.