The Mexican Government declared the contracts on the software program for spying on journalists secret

Enrique Peña Nieto’s government has rejected the espionage accusations made this Monday by a group of critical journalists and human rights defenders. In a brief letter addressed to The New York Times, the newspaper that published how they tried to infect mobile phones with the Pegasus malware to steal information, the presidency noted that “there is no evidence that Mexican government agencies are responsible for the alleged espionage.” The letter signed by Daniel Millán, director general of international media for the Mexican presidency, indicates that the Government condemns “any attempt to violate the right to privacy of any person.”

However, three Mexican government agencies have left traces of having traded with NSO Group, the Israeli cybersecurity company that sells the Pegasus program primarily to governments. They are the Secretariat of National Defense (Sedena), the Office of the Attorney General of the Republic (PGR, Prosecutor’s Office) and the Center for Intelligence and National Security (Cisen), the body that concentrates all the intelligence and classified information apparatus in Mexico.

The newspaper Reform published in September 2016 that the Mexican Prosecutor’s Office had purchased the Pegasus system for $ 15 million. The purchase would have occurred between 2014 and 2015, during the period of Jesús Murillo Karam, the controversial prosecutor in charge of directing the investigation of the 43 missing students in Iguala, Guerrero. The authorities would have sought the malware to use it as a tool in the war against organized crime.

The PGR has refused to respond clearly if it has signed contracts with NSO Group, the company that markets Pegasus. In the fall of 2016, digital activists officially asked the Prosecutor’s Office what services it had acquired from the Israeli firm. The official response was ambiguous. “The Criminal Investigation Agency [un área de la PGR] located the requested information… it constitutes classified information as reserved ”, was the response of the PGR, contained in the Government spy report carried out by the Network for the Defense of Digital Rights. The information will be public for up to five years, in 2021.

But the links between the Mexican government and the NSO Group can be traced earlier. In January 2014, an email leak from the Italian firm Hacking Team, the NSO’s competitor, revealed that Cisen employees already knew about the mobile phone infection program. This was reported by engineer Sergio Rodríguez Solís to his bosses after visiting the spy center. “They complained about why we don’t have infection vectors that don’t require user interaction like NSO does,” the Hacking Team employee wrote in an email. The communication assures that the Mexican government spies had tested the software on several mobiles from different operating systems such as Android, BlackBerry, and iOS.

Another email from Sergio Rodríguez Solís from 2014 ensures that Sedena already knew about the Pegasus program. “They have NSO for mobiles and they are in love with it,” wrote the engineer. In 2012, two media published information about the army’s contracts with the Israeli firm, some of which were under investigation by the Federal Superior Audit and the Comptroller of the Armed Forces. Carmen Aristegui, one of the journalists whom an attempt was made to monitor, also published in July 2012 three documents that closed the acquisition of the malware program by the Ministry of National Defense.

The NSO Group was already on the radar of several digital rights activists. Research by the Citizen Lab at the University of Toronto documented the use of Pegasus to infect communications from activist Ahmed Mansoor in the United Arab Emirates. Canadian researchers were struck by the fact that many servers in Mexico had similar activity. The program tried to impersonate domains from news sites, social networks and others as a decoy. In February 2017, Citizen Lab demonstrated in a report how the program had been used against Alejandro Calvillo, Luis Encarnación and Simón Barquera, two activists and a scientist who had pushed in favor of taxing sugary drinks.