Spyware in Mexico targeted outside critics, group says

International rights experts among those to be hit.

MEXICO CITY — Investigators said Monday that targets of high-tech spying in Mexico included an international group of experts backed by the Organization of American States who had criticized the government’s probe into the disappearance of 43 students.

Previous investigations by the internet watchdog group Citizen Lab found that the spyware had been directed at journalists, activists and opposition politicians in Mexico. But targeting foreign experts operating under the aegis of an international body marks an escalation of the scandal, which so far involves 19 individuals or groups. The experts had diplomatic status, making the spying attempt even graver.

“This must be investigated to find out who sent these messages, because they could put at risk a lot of contacts and sources,” said former Colombian prosecutor Angela Buitrago, a member of the group of experts.

Buitrago said she and another expert, Carlos Beristain, received the messages.

“I didn’t open it because I am used to spying,” Buitrago said. “When you work in a prosecutors’ office, a government office, there are strange messages and you pass them on to the analysts.”

A report released by the University of Toronto-based cyber-sleuths found that someone sent emails with links to the spyware to the International Group of Independent Experts, named by the Inter-American Commission on Human Rights. The experts had been critical of the government’s investigation into the 2014 disappearance of 43 students from a rural teachers college in Guerrero state — a politically sensitive incident that deeply embarrassed the government.

While the Mexican government bought such software, it’s not clear who used it. Mexican President Enrique Peña Nieto last week dismissed allegations that his government was responsible and promised an investigation. Arely Gomez, who was attorney general at the time some of the hacking attempts occurred but now heads the country’s anti-corruption agency, said Thursday that her office had intelligence tools “like any other attorney general’s office in Mexico and anywhere else in the world.”

“During my term, they were always applied in accordance with the legal framework,” Gomez said.

The spyware, known as Pegasus, is made by the Israel-based NSO Group, which says it sells only to government agencies for use against criminals and terrorists. It turns a cellphone into an eavesdropper, giving snoopers the ability to remotely activate its microphone and camera and access its data.

The spyware is uploaded when users click on a link in email messages designed to pique their interest.

Citizen Lab said the spyware attempts against the international experts occurred in March 2016 as the group was preparing its final, critical report on the government investigation into the disappearances.

“In March 2016 a phone belonging to the GIEI group received two messages designed to trick the recipient into clicking,” the group reported.

It was unclear if the link was opened or the phones were compromised.

The 43 students from a rural teachers college in Guerrero state were detained by local police in the city of Iguala on Sept. 26, 2014, and were turned over to a crime gang. After an initial investigation, the government said it had determined the “historical truth:” that all of the students were killed and that their bodies were incinerated at a dump and then tossed into a river.

But only one student’s remains have been identified, with a partial DNA match on another. The experts criticized the government’s conclusions, saying there was no evidence of a fire large enough to incinerate the bodies and that government investigators had not looked in to other evidence.

Citizen Lab said it found similarities in the messages or the sender’s phone number with a previous spyware attack. In a June 19 report, the group said at least 76 spyware text messages were sent to 12 prominent journalists and rights activists in Mexico, all of whom were investigating or critical of the government. Some had uncovered corruption.

The conservative National Action Party was also a target.

The investigators said they had no conclusive proof of government involvement in the attacks, but John Scott-Railton of Citizen Lab said National Action case “makes it crystal clear that NSO has been used widely and recklessly across a swath of Mexican civil society and politics. Once again we see ‘government-exclusive’ spyware being used for seemingly political ends.”