Human rights official target of spying
Mexican military may have used controversial Israeli spyware to hack leader of investigation
He is a longtime friend of the president, a close political ally for decades who is now the government’s top human rights official.
And he has been spied on, repeatedly.
Alejandro Encinas, Mexico’s undersecretary for human rights, was targeted with Pegasus, the world’s most notorious spyware, while investigating abuses by the nation’s military, according to four people who spoke with him about the hack and an independent forensic analysis that confirmed it.
Mexico has long been shaken by spying scandals. But this is the first confirmed case of such a senior member of an administration — let alone someone so close to the president — being surveilled by Pegasus in more than a decade of the spy tool’s use in the country.
The attacks on Encinas, which have not been reported previously, seriously undercut President Andrés Manuel López Obrador’s pledge to end what he has called the “illegal” spying of the past. They’re also a clear sign of how freewheeling the surveillance in Mexico has become, when no one, not even the president’s allies, appears to be off limits.
Pegasus is licensed only to government agencies, and while there’s no definitive proof which one carried out the hack of Encinas’ phone, the military is the only entity in Mexico that has access to the spyware, according to five people familiar with the contracts. In fact, the Mexican military has targeted more cellphones with the technology than any government agency in the world.
Encinas has long been at odds with the armed forces. He and his team have accused them of being involved in the mass disappearance of 43 students, one of the worst human rights violations in the country’s recent history.
His cellphone has been infected multiple times — as recently as last year while he was leading a government truth commission into the abductions — giving the hackers unfettered access to his entire digital life, according to the four people who have discussed it with him.
Pegasus was wielded against some of Mexico’s most prominent journalists and democracy advocates several years ago, igniting an international scandal that stained the previous administration.
Now, new cases have emerged in recent months, confirming the spyware has targeted human rights defenders and local journalists during López Obrador’s tenure, as well.
Still, the attacks on Encinas are unlike anything Mexico has witnessed.
“If someone as close to the president as Alejandro Encinas is targeted, it’s clear there’s no democratic control over the spy tool,” said Eduardo Bohorquez, the director of the Mexican chapter of Transparency International, an anti-corruption group.
“There’s no checks and balances,” he added. “The military is a superpower with zero democratic oversight.”
Encinas did not respond to multiple requests for comment. The Mexican president and the Mexican Defense Ministry did not respond to requests for comment, either.
Pegasus can infect your phone without any sign of intrusion and extract everything on it — every email, text message, photo, calendar appointment. It can watch through your phone’s camera or listen through its microphone, even if your phone appears to be turned off.
People who spoke with Encinas about the hacks said he learned the details of the infections after they were confirmed by Citizen Lab, a watchdog group based out of the University of Toronto. It conducted a forensic analysis of his phone that has not been made public.
The group also found evidence Pegasus had infiltrated the phones of two other government officials who work with Encinas and have been involved in inquiries into rights violations by the armed forces, three people with knowledge of the hacks said.
Citizen Lab declined to comment.
The Israeli manufacturer of Pegasus, NSO Group, opened an investigation into cyberattacks on human rights defenders in Mexico after recent reports by The New York Times about the military’s use of the spyware, according to a person familiar with the NSO compliance investigations.
The company also began looking into the attacks on Encinas and his two colleagues after The Times asked about those hacks, the person said.
In a statement, NSO said it does not operate individual Pegasus systems but “investigates all credible allegations of misuse,” adding: “Past NSO investigations have resulted in the termination of multiple contracts regarding the improper use of our technologies.”
The hacking has put Encinas and the president in a tough position. In early March, Encinas met with López Obrador to talk about the spying and whether to go public with it, according to several people briefed on the conversation.
But Encinas has kept quiet about his Pegasus infection since, they said.
The two men have been political partners for more than two decades; Encinas served in López Obrador’s Cabinet when he became mayor of Mexico City in 2000.
“Andrés is my friend; he is my partner,” Encinas was quoted as saying in 2011. “We are part of a team and a project.”
But since López Obrador took office, the two men have not always been aligned on the growing power of the military.
The nation’s armed forces have vastly expanded their authority under López Obrador, accumulating broad control over policing as well as a formidable slate of other activities, including building much of a 1,000-mile railway and an airport, distributing medicine and managing ports and customs.
Encinas has been one of the few people willing to criticize the military from inside the administration.
When the Israeli Ministry of Defense licenses the sale of Pegasus to government agencies, they must sign agreements to use the surveillance tool solely for fighting severe crime or terrorism, according to three Israeli defense officials.
NSO is now looking into whether the use of Pegasus in Mexico violated that agreement.
If NSO confirms Encinas and others were targeted for no legitimate reason by the Mexican military, the company could immediately shut down the institution’s access to Pegasus.
Publicly, López Obrador’s stance has not changed. After The Times revealed how the Mexican military became the world’s first — and most prolific — user of Pegasus, the president said the armed forces “are respectful of human rights and don’t do spying like before.”