Mexican authorities continue to use the notorious Israeli-developed Pegasus spyware, ignoring mounting criticism at home and abroad, the New York Times reported on Tuesday.
Related stories:
The report, co-authored by Yedioth Ahronoth reporter Ronen Bergman, exposed new salacious details about a 2011 deal struck at a strip club between Israeli cyber firm NSO Group and representatives of the Mexican government — the company's first and biggest client.
The investigation also reveals that, contrary to Mexico City's official statements, it continues to hack the mobile phones of human rights activists using the spyware and monitor them.
Pegasus is a highly potent surveillance software that enables monitoring of all user actions on a phone without them being aware, and even covertly activating the device's microphone and camera. It is an intelligence system that many consider an actual weapon, and it is the subject of controversy worldwide.
On one hand, this tool is used to break up pedophile rings, capture cartel leaders like El Chapo, and foil terrorist attacks. However, since it first arrived in Mexico, numerous reports have surfaced globally about how authoritarian governments have exploited it to spy on their critics, human rights activists, and journalists.
In response to the allegations, the United States blacklisted NSO in 2021, although later reports, including in the New York Times, suggest that Washington also continues to employ the Israeli company's tools.
The Times's latest report indicated that despite abundant evidence pointing to Mexican authorities abusing Pegasus, the Israeli government - whose approval is required to export the software, has not ordered the cessation of its use in Mexico, despite the Defense Ministry vowing it would ensure that Pegasus is no longer used for harm.
The Defense Ministry refused to comment on the issues raised in the article.
NSO was founded in Israel in 2010, and its first contract was with the Mexican army. The Times cites two people present and a third with knowledge of the talks who confirmed that the deal was struck at a strip club in the center of Mexico City in March 2011.
The report notes that during another meeting held on the same day, there has been an argument over price and how quickly the spy tool could be delivered.
The parties reportedly took a brief "pause," and a Mexican general who was leading the negotiations told the Israeli representatives, “We’ll pick you up at your hotel and make sure to arrange a better atmosphere.”
The second meeting occurred later that evening in completely different scenery, with dancing strippers and shots of tequila, ultimately leading to the signing of the deal. The actual signing of the contract happened several months later when an NSO team presented the Pegasus system secretly with a demonstration performance at a military base near Mexico City, where the first system would be first installed.
Eran Reshef, an Israeli defense industry executive who helped broker the deal, reportedly sent an email to NSO Chairman Avigdor (Yanush) Ben Gal, as well as to its two co-founders Omri Lavie and Shalev Julio on May 25, 2011, that “the demo to the Secretary of Defense and President will take place next Friday,” referring to the president at the time, Felipe Calderón, and his secretary of defense, Guillermo Galván Galván.
Two of the people at the demonstration told the Times it had taken place on a sprawling military base on the outskirts of Mexico City.
Fearing leaks, the Mexican Army made the Israeli executives wait in a tiny room where cleaning supplies were kept so no one would see them before they made their presentation. An armed soldier was stationed outside the door, to make sure the Israelis don't go anywhere.
The demonstration reportedly began only after President Calderon and his defense minister arrived at the operations room, watched as Pegasus broke into phones through a large screen on the wall. Ben Gal passed away in 2016, Julio left the company in 2022, and Lavie remains the sole shareholder.
A spokesman for Calderón acknowledged to the Times that the former president had paid a visit to a military facility, where he was “given various presentations about the tasks” being carried out, “including the gathering of information and intelligence.”
But he said Mr. Calderón was never informed whether the spyware was eventually purchased, and that the former president was never told — “nor did he inquire” — what tools were used to capture criminals.
The software was purchased shortly after the demonstration and in September 2011, about 30 NSO employees, most of the company’s staff, flew to Mexico to set up Pegasus, test it and instruct a team of about 30 Mexican soldiers and officers how to operate the technology, the Times reported citing three people familiar with the installation. The Mexican unit chosen to operate it was called the Military Intelligence Center, a secretive arm of the army about which little has been made public.
In December 2011, a short ceremony took place as a way of “handing over the keys” once the Mexicans were ready to run Pegasus on their own, two of the people said.
According to the report, a document from 2019, unearthed in an enormous hack of Mexican military emails last year, indicates that the Mexican intelligence center is housed in a horseshoe-shaped complex. Three people familiar with it say commanders can watch through internal glass walls as information unspools on huge screens.
According to the investigation, Mexico initially began using Pegasus to track devices of drug cartel leaders using Blackberry phones, which were considered secure at the time.
Mexico was heavily dependent on the United States for advanced technological measures to track criminal organizations until then, and according to the report, it sought to become more independent by adopting the Israeli software.
Mexico's use of the software gained momentum after Enrique Pena Nieto became president in 2012, and other government agencies in addition to the military also adopted the tool. In total, Mexico reportedly paid $60 million to use the software.
Although the Mexican military officially only acknowledged using the software between 2011 and 2013, according to the investigation, it also used it years later.
In 2014, for example, it used the tool to track individuals involved in the case of the disappearance of 43 students who planned to protest against the government.
It is unclear who the military was using Pegasus to track at that time, but the intelligence gathered did not assist investigators in locating the students who are believed to have been murdered in a mystery that Mexico is still pursuing to this day.
After taking office in 2018, President Andres Manuel Lopez Obrador, who succeeded Pena Nieto, pledged to end what he referred to as his country's "surveillance state."
However, the investigation discovered that his government is also using the Israeli spyware tool. According to four insiders, only the Mexican military has been utilizing Pegasus since 2019.
The report also disclosed that the software was used to hack the phones of two Mexican human rights activists in the past year. The hacks were allegedly carried out against the backdrop of new disclosures last year about the military's implication in the disappearance of students in 2014.
The hacks were uncovered by an analysis of mobile phones conducted by an organization called Citizen Lab, which operates from Canada.
In response to the investigation, NSO issued a statement that they cannot disclose information about their clients, but Citizen Lab’s findings cast doubt on their claim.
The Canadian group stated in response that they are confident in their findings. The lawyers whose phones were hacked declined the Israeli company's request for access to the phone-related information in order to verify the claims.
One of the activists whose phone was hacked last year is Santiago Aguirre, whose phone was hacked in the past as well, and in December of last year, he received a rather worrisome email from Apple, warning about the additional breach.
“Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID,” said the message, which was reviewed by The Times. “These attackers are likely targeting you individually because of who you are or what you do.”
Apple announced in 2021 that it would warn its users about breaches through sophisticated spyware programs.