Mexico, where a new report by the Citizen Lab has revealed the Mexican government used Israeli-made spy software to surveil a team of international investigators who had dispatched to Mexico to investigate the high-profile disappearance of 43 students at the Ayotzinapa teachers’ college in Guerrero in 2014. The targeted individuals included some of Latin America’s most prominent lawyers, who had been granted a form of diplomatic immunity to carry out their investigation. The Citizen Lab has also reported that the Mexican government also used the spying software called Pegasus to spy on Mexican human rights activists and journalists. Some of the targeted activists and journalists are now suing the Mexican government, after learning they had been surveilled.
Citizen Lab reported that the infection attempts took place in early March of 2016, shortly after the international investigators had criticized the Mexican government for interference in their investigation and as they were preparing their final report of their findings about the students’ disappearance. The Israel-based NSO Group, the maker of Pegasus spyware, is backed by the United States private equity firm Francisco Partners.
Ronald Deibert talking:
Citizen Lab is a research group at the University of Toronto. We combine a mixture of methods from different disciplines, from political science, computer science and engineering, to examine cybersecurity issues or digital security issues that arise out of human rights concerns. So, we’ve done extensive research and reporting on targeted digital attacks on civil society groups—effectively, cyberespionage campaigns. And as part of that, we’ve uncovered many cases of commercial spyware companies, like NSO Group and others, where their technology is being used by governments to target civil society groups.
what happens here is that we have a variety of technical indicators. Essentially, these are—you could make an analogy to digital fingerprints—maybe domain names, other technical indicators, that are part of messages that are sent, text messages, that are received by targets. And had they clicked on them, their phones would have been infected, allowing the operators to effectively read every email, text message, listen in on phone calls, track geolocation, turn on the camera, audio, etc. Using those digital fingerprints and working with our partners, our civil society partners in Mexico and elsewhere, we’re able to find targets who have received these SMS messages. And we examine the content. We look at the links that are sent, the messages that are received, and are able to verify that these are part of the NSO Group’s infrastructure.
This is the latest in a series of reports that we have done over the last several months, going back to our first report, which found that advocates for a tax on sugary beverages in Mexico—three health scientists had received messages with links to NSO Group infrastructure. Following that, we found that a number of journalists and human rights activists and lawyers, including the other guest on your show, had received messages containing the same type of links, with domains associated with the NSO Group infrastructure. A few weeks ago, we published another report about Mexican opposition politicians.
And this latest one, I think, is the most egregious. It’s a phone belonging to the international investigators into the 2014 mass disappearances in Mexico of students. So this was a phone handled by one of the people involved in this international investigatory group. They received two messages just prior to the release of their major public report. The group, it should be said, had a kind of public falling out with the Mexico attorney general. And the report was quite critical of the Mexican government. So all of this together is adding up to a lot of circumstantial evidence pointing to some agency within the Mexican government or an individual associated with the Mexican government responsible for the targeting.
It should be said also that this type of technology is restricted to government clients. The NSO Group itself says that they only sell to Mexican—to government agencies and restrict the use of their technology to antiterror, national security or criminal investigations. I think, under anyone’s reasonable definition, these targets couldn’t fit into that category.
Pegasus could record anything picked up by your phone microphone, or even its camera. Even when you’re not using the phone, it can be transmitting audio and video back to the government.
It’s effectively a very powerful wiretap. It can also be used to spoof messages, to read encrypted messages. In fact, a lot of the inspiration or the driving force for this type of service, this type of technology, comes from the fact that a lot of people are using end-to-end encrypted communications for chat messages, for email. And that drives those who want to intercept those communications to try to get inside the device. So this spyware has become very popular, very lucrative for the companies that sell it to government agencies.
Stephanie Erin Brewer talking:
in September of 2014, a group of police, in collusion with organized crime in the southern Mexican state of Guerrero, forcibly disappeared 43 students, students, as you say, who were training to be teachers. Three other students were killed, and there were a variety of other human rights violations committed the night of September 26th to 27th. And it’s important to say that this case is paradigmatic, on one hand, of the phenomenon of enforced disappearance in the country. We’re talking about a country where more than 32,000 people are currently missing or disappeared. And it’s also paradigmatic of a phenomenon that we call macrocriminality, which is to say, the people who participated in these disappearances were not simply organized crime or not simply private actors. They were police, and they were officials from all three levels of government, so municipal, state and federal level. This case remains unsolved. It remains unpunished. The families of the 43 students have spent the past now almost three years tirelessly searching for their children.
And because of the scale of this disappearance and the outrage that it provoked both nationally and internationally, the Inter-American Commission on Human Rights, which is our regional human rights commission, named a group of international experts, some of the best-known human rights investigators and lawyers and prosecutors from different countries in the region, to come to Mexico. And it’s important to say that the Mexican government accepted and even invited this group to come and to help in the investigation. And it’s only thanks to the investigation carried out by those international investigators that we were able to learn some of the facts of what happened that night, that we were able to learn that the Mexican federal government—specifically, the federal Attorney General’s Office—had put forth a completely false version of the case, saying that all the students had been killed and burned, cremated, that night, along with all their belongings. And we were able to show that that was scientifically impossible, thanks to the work of this international group.
So what we have now—as we’ve been discussing on this show, what we have now is proof that the Mexican government, instead of investing its time and resources in clearing up this case, in finding the students and explaining what happened and punishing those responsible, has instead invested its resources—and we’re speaking of hundreds of thousands or even millions of dollars—in spying on the lawyers, who represent these family members, and on the international experts, who came here with diplomatic immunity to aid the Mexican government in clearing up this horrendous crime.
in my case, I received the message in May of last year, which fits exactly into the pattern that’s already been described by Citizen Lab. And so, what this tells me is that apparently the Mexican government feels that its enemy is someone like me, who is a human rights lawyer, who’s representing not only the families in this case, also people in other paradigmatic cases that are being litigated, including in the Inter-American Court of Human Rights. And so, someone who’s seeking to strengthen the rule of law, who’s seeking justice for people who have been victims and survivors of some of the most serious and terrible crimes that can be imagined, apparently, I am the one, and my colleagues, being identified as a problem or as enemies of the administration, instead of the human rights violators or instead of the organized criminal groups, against whom this software is meant to be used when it’s sold to the government and who are responsible for Mexico’s warlike levels of violence in some regions of the country.
Ronald Deibert talking:
NSO Group their clients. that’s part of the question of the research that we’re engaged in at Citizen Lab, is to find out precisely that. And what we find is a pretty disturbing picture.
I should underline, first of all, that the makers and the sellers of this type of technology can be likened to the arms trade or private military contractors. So they don’t advertise their clients. They don’t even advertise their products. If you search NSO Group, you’ll likely find links to Citizen Lab reporting rather than anything from the company itself. That’s precisely because they operate beneath the surface, in this kind of shadowy market to intelligence and law enforcement agencies.
What we have been able to determine, based on our research looking at technical indicators that we’re able to gather, is that they’re selling to some governments, like Mexico and other governments, that are either flawed democracies, authoritarian regimes, governments that lack public accountability and oversight. The majority owner, Francisco Partners, they’re an investment company that owns quite a few technology companies. Not all of them are in this category, but at least a couple of others certainly are. I would say Procera Technologies, which is a company that supplies surveillance technology, was recently implicated in the abuse of surveillance in Turkey.
Overall, this marketplace—this case that we’re seeing here in Mexico is symptomatic of a much larger global problem, where you have this type of very powerful, highly invasive technology being sold by companies for tens of millions of dollars to governments that are using them without checks and balances, typically targeting opposition members, lawyers—even, in this case, health advocates in an international investigation. There really needs to be a concerted global effort to better control and regulate the market for commercial spyware.
____
Ronald Deibert
director of the Citizen Lab at the Munk School of Global Affairs, University of Toronto.
Stephanie Erin Brewer
human rights attorney and the international area coordinator for Centro Prodh, which represents some of the families of the 43 Ayotzinapa students.
— source democracynow.org
[Part II]