Spying by armed forces brings fears of a ‘military state’
MEXICO CITY — Mexico’s armed forces spied on a human rights defender and journalists who were investigating allegations that soldiers had gunned down innocent people, documents show, providing clear evidence of the military’s illegal use of surveillance tools against civilians.
The government has been embroiled in scandal for years over the use of sophisticated spyware against a wide range of people who stand up to Mexico’s leaders. But surveillance experts say this is the first time a paper trail has emerged to prove definitively that the Mexican military spied on citizens who were trying to expose its misdeeds.
Documents and interviews show how the spying that tarnished the previous government has continued under President Andrés Manuel López Obrador, who vowed that his administration would not engage in such surveillance, which he called “illegal” and “immoral.”
Mexico’s armed forces are not authorized to spy on civilians, legal experts say, but the military has long wielded spying technology and has grown ever more powerful under López Obrador.
In a 2020 Defense Ministry report, unearthed last year in an extensive hack of the Mexican armed forces and reviewed by The New York Times, military officers described the details of private conversations between a human rights advocate and three journalists discussing allegations that soldiers just weeks earlier had executed three civilians in a confrontation with a cartel.
The report contended that the advocate, Raymundo Ramos, was trying to “discredit the armed forces” by discussing allegations of unlawful killings by the military with reporters.
It recommended that the military glean information from his private conversations, but not include it in official case files, perhaps in an attempt to keep its spying secret.
Forensic tests show that Ramos’ cellphone had been infected multiple times by Pegasus — extremely powerful spyware — around the same time that the military produced the report on his conversations, according to an analysis by Citizen Lab, a research institute at the University of Toronto.
Despite the president’s assertions, Mexico’s Ministry of Defense was actively using Pegasus in 2020, when Ramos’ phone was hacked, according to three people familiar with the export licenses required to sell the cyberweapon outside of Israel, where it is made.
Pegasus can extract enormous amounts of information from a digital device without any warning: texts, calls, contacts, photos — even its location.
“We’re talking about the military monitoring you, knowing your personal information, your friendships, everything,” Ramos said in an interview. “They know where I am at all times.”
López Obrador, who took office in 2018, promised that his administration would never spy on its opponents.
The new evidence of military spying suggests López Obrador, as commander in chief of the armed forces, either knew about the surveillance and tolerated it, experts said — or his own subordinates disobeyed him.
“Both scenarios are terrible, but all the evidence we have points to the army spying on its own initiative and for its own interests,” said Catalina Pérez Correa, an expert on the military at Mexico’s Center for Research and Teaching in Economics.
“Taking into account the enormous economic power it has and all the state functions it controls,” Pérez Correa said, “you could say that Mexico has the building blocks for a military state.”
Under López Obrador, the military has taken on far greater responsibility for policing, as well as controlling the nation’s ports and customs, building part of a 1,000-mile train line and even distributing medicine. The number of troops deployed across the country is at its highest point in recent history.
The Ministry of Defense did not respond to requests for comment, but has said that its intelligence gathering is focused on fighting organized crime and has acknowledged using Pegasus only from 2011 to 2013.
The Israeli manufacturer of Pegasus, NSO Group, said it could not confirm its clients because of confidentiality agreements.
“The company does not operate the technology, nor does it know who its customers are investigating,” the NSO Group said in a written statement, adding that the company “investigates any credible claim of misuse of its technology.”
The Biden administration blacklisted the NSO Group in 2021, citing the use of the company’s spyware by foreign governments to target activists and journalists.
Mexican news media reported in October that the military had purchased spyware under the current administration. At the time, López Obrador said the military was carrying out “intelligence work, not spying.”
What set off the spying on Ramos was a car chase in the violent town of Nuevo Laredo along the U.S. border one night in July 2020. Soldiers pursuing several pickup trucks ultimately killed a dozen passengers who the military said had been part of a local criminal group.
In the days and weeks that followed, Ramos said, he spoke to the parents of three of the victims, who said their sons had been killed even though they were innocent. They were traveling inside the pickups, but had been kidnapped by the cartel, the parents said.
Ramos began publicizing the allegations, and soon a local newspaper published damaging body camera footage of the confrontation. The video showed the officers spraying one of the trucks with bullets despite no one firing back, and then ordering the assassination of a survivor of the attack.
“He’s alive!” one officer yells in the video. “Kill him!” another responds.
That’s when Ramos’ phone was targeted by Pegasus. The spyware infected his phone five times in the days before and after the military emailed its report, according to Citizen Lab.
Ramos told the Times that all of the intercepted exchanges were from messages and one call made on Telegram, an encrypted app. The military’s intelligence report said Ramos had “links” to a Mexican cartel and would benefit financially from discrediting the armed forces.
The case represents one of the most significant breakthroughs in years of spyware research, digital investigators said.
“I’ve never seen anything like it,” said John Scott-Railton, a senior researcher at Citizen Lab. “For the first time, it shows us how the operators took this man’s private digital life, dumped it out on the table and then tried to select the parts that would be most harmful to him.”