MEXICO CITY – Mexico’s surveillance scandal widened Wednesday to encompass a pair of prominent human rights attorneys probing a multiple homicide case whose victims include a photojournalist and an activist.
The internet watchdog Citizen Lab said Karla Micheel Salas and David Peña were targeted in 2015, weeks after they questioned prosecutors’ handling of the killings of activist Nadia Vera, journalist Rubén Espinosa and three other women in a Mexico City apartment in July that year. The victims were tortured and shot to death.
The lawyers’ cellphones were targeted by messages designed to infect them with the same spyware that Citizen Lab previously determined was sent to 19 Mexican individuals or groups, the cyber-sleuths said in a research note. One said she believed she was infected by it.
Other Mexican targets of the sophisticated Pegasus spyware, made by Israel-based NSO Group, have included journalists investigating high-level corruption, opposition politicians and activists, and international experts critical of the government’s probe into the 2014 disappearance of 43 students from a rural teachers college.
NSO Group says it only sells Pegasus — which lets attackers siphon away the contents of cell phones and clandestinely convert them into eavesdropping devices — to governments for use against criminals and terrorists.
University of Toronto-based Citizen Lab said those conditions were clearly violated in Mexico — though it says it has no conclusive proof of government involvement.
President Enrique Peña Nieto has dismissed any suggestion that his government is responsible. The Attorney General’s Office, one of the state agencies that bought Pegasus, has opened an investigation. But victims have said they doubt its impartiality and have called for an independent, international probe.
John Scott-Railton, a senior Citizen Lab researcher, said “a pattern has emerged” in the Mexico cases: “Lawyers and investigators whose work contradicts official accounts have been targeted with NSO spyware on at least three occasions.”
Salas and Peña were both targeted with links sent to their cell phones that Citizen Lab said pointed back to the same online infrastructure used to sow the Pegasus malware in the other Mexico cases.
“I think the only people interested in spying on us are state agents,” Salas told press.
Pena said he didn’t fall for either of two infection attempts.
But Salas said she did, on Oct. 1, 2015. The message purported to include information about a wake for a friend’s deceased father.
Salas is worried. Her phone contained sensitive information that could put lives in jeopardy.
When her phone was infected, Salas and Pena had just presented a report to the Mexico City council on 10 emblematic crimes in the capital that had gone unpunished.
The two attorneys have constantly questioned official accounts in high-impact cases, including their representation of the families of Vera and two of the women killed with her. Vera and her friend Espinosa had fled the state of Veracruz after receiving death threats from agents of the state government, which was then headed by Javier Duarte, who is currently in prison facing corruption charges after being extradited from Guatemala.
Pena said he thinks he and Salas could have been targeted because of their handling of the quintuple homicide “for its relevance, for its complexity and to find out what we know, which has implications in Veracruz and with groups of hitmen operating in Mexico City.”
The capital’s Human Rights Commission has accused the prosecutor handling the case of negligence, violating due process and of dishonesty.
A Mexican cyber expert who has worked with Citizen Lab on the investigation, Luis Fernando Garcia of the collective R3D, said they are currently analyzing more messages in an attempt to identify additional Pegasus victims.
MARIA VERZA
FRANK BAJAK
