A Journalist’s Death, Followed by Hacking

MEXICO CITY — The messages arrived at a familiar moment of crisis for Mexico’s fragile journalist community — another reporter killed in the line of duty.

Javier Valdez, an investigative reporter, had been shot dead a day earlier. Then came a sudden development: According to a text message received by his colleagues, his killers had been detained.

Despite the tragedy, his fellow workers were suspicious. More than 90 percent of murders go unsolved in Mexico. How did the authorities solve the case so soon?

More likely, they worried, the text messages were an attempt to infiltrate their smartphones — part of a pattern of hacking attempts involving spying technology bought by the Mexican government. They were correct. The messages were infected with a spyware known as Pegasus, which the Mexican government purchased from an Israeli cyber arms dealer called the NSO Group, according to a forensic analysis by the Citizen Lab at the Munk School at the University of Toronto.

A simple click on the links embedded in the messages would have infected the cellphones with spyware powerful enough to break through encrypted messaging, monitor emails and remotely activate the camera and microphone.

Someone was trying to spy on Mr. Valdez’s friends and colleagues the day after he was killed last year — most likely the Mexican government, according to those targeted.

“I believe they wanted to search our conversations and messages for clues to the murder of Javier, but we are absolutely against this,” said Ismael Bojórquez, the news director of Rio Doce, the news organization where Mr. Valdez worked. “Nothing obtained illegally should be used in an investigation.”

The illegal use of the surveillance technology in Mexico first emerged during the administration of Enrique Peña Nieto, which bought the spyware on the condition that it be used only to target terrorists and criminals.

But in the last year and a half, the Citizen Lab has confirmed nearly two dozen questionable targets, including prominent journalists, human rights lawyers and anticorruption activists.

When news of the surveillance erupted last year, the Mexican government denounced the spying and opened an investigation. But not one person has been punished.

Aware of the scandal, Mr. Bojórquez said he had little faith in the messages he was receiving. He and another target — the news director, Andres Villareal — refused to click on the links. They had reason to be suspicious.

The men were running one of the few independent news groups in the nation, dedicated to covering organized crime and exposing Mexico’s vast nexus of crime and corruption.

Threats were inevitable, and not just from organized crime. Government data show that public officials are responsible for the greatest number of attacks on journalists. More than 47 have been killed since Mr. Peña Nieto took office in late 2012, according to Article 19, a journalist protection group.

Mr. Bojórquez said he and others had become aware of the government’s spyware in February 2017, when the Citizen Lab and The New York Times published articles out-

Texts are infected with spyware bought by Mexico.

lining its illicit use against backers of a nationwide soda tax.

Mexico’s government was embarrassed. And yet months after the attempted hacking of doctors and activists promoting a tax on sugary drinks, the targeting did not stop. “These infection attempts are reckless, and probably indefensible,” said John Scott-Railton, a researcher at Citizen Lab. “Where was the internal oversight? And where was NSO’s oversight?”

A spokesperson for NSO said: “We do not tolerate misuse of our products against civil rights activists, journalists or any innocent person. If there is suspicion of misuse, we investigate it and take the appropriate actions, including suspending or terminating a contract.”

A new government came into office on December 1. But whether the status of journalists will change, and whether their targeting and abuse, and state overreach, will subside, is an open question.

“A change in government,” Mr. Bojórquez said, “does not mean there will be a change in the context of impunity or aggressions against journalists.”