Spyware in Mexico targeted international experts

MEXICO CITY -- Investigators said Monday targets of high-tech spying in Mexico included an international group of experts backed by the Organization of American States who had criticized the government's probe into the disappearance of 43 students.

Previous investigations by the internet watchdog group Citizen Lab found the spyware had been directed at journalists, activists and opposition politicians in Mexico.

But targeting foreign experts operating under the aegis of an international body marks an escalation of the scandal, which so far involves 19 people or groups. The experts had diplomatic status, making the spying attempt even graver.

"This must be investigated to find out who sent these messages, because they could put at risk a lot of contacts and sources," said former Colombian prosecutor Angela Buitrago, a member of the group of experts.

Buitrago said she and another expert, Carlos Beristain, received the messages. She said she didn't open them.

"I didn't open it, because I am used to spying," Buitrago said. "When you work in a prosecutors' office, a government office, there are strange messages, and you pass them on to the analysts."

A report released by the University of Toronto- based cybersleuths found someone sent emails with links to the spyware to the International Group of Independent Experts, named by the Inter-American Commission on Human Rights. The experts had been critical of the government's investigation into the 2014 disappearance of 43 students from a rural teachers college in Guerrero state -- a politically sensitive incident that embarrassed the government.

While the Mexican government bought such software, it's not clear who used it. Mexican President Enrique Pena Nieto last week dismissed allegations his government was responsible and promised an investigation. Arely Gomez, who was attorney general at the time some of the hacking attempts occurred and leads the country's anti-corruption agency, said Thursday her office had intelligence tools "like any other attorney general's office in Mexico and anywhere else in the world."

"During my term, they were always applied in accordance with the legal framework," Gomez said.

The spyware, known as Pegasus, is made by the Israel-based NSO Group, which said it sells only to government agencies for use against criminals and terrorists.

It turns a cellphone into an eavesdropper, giving snoopers the ability to activate its microphone and camera and access its data remotely.

The spyware is uploaded when users click on a link in email messages designed to pique their interest.

Citizen Lab said the spyware attempts against the international experts occurred in March 2016 as the group was preparing its final, critical report on the government investigation into the disappearances.

"In March 2016 a phone belonging to the GIEI group received two messages designed to trick the recipient into clicking. The two messages related to the purported death of a relative," the group reported.

It was unclear if the link was opened or the phones were compromised.

The 43 students from a rural teachers college in Guerrero state were detained by local police in the city of Iguala on Sept. 26, 2014, and were turned over to a crime gang. After an initial investigation, the government said it had determined the "historical truth:" that all of the students were killed and that their bodies were incinerated at a dump and then tossed into a river.

But only one student's remains have been identified, with a partial DNA match on another. The experts criticized the government's conclusions, saying there was no evidence of a fire large enough to incinerate the bodies and that government investigators had not looked in to other evidence.

Citizen Lab said it found similarities in the messages or the sender's phone number with a previous spyware attack. In a June 19 report, the group said at least 76 spyware text messages were sent to 12 prominent journalists and rights activists in Mexico, all of whom were investigating or critical of the government. Some had uncovered corruption.

The conservative National Action Party was also a target.

The investigators said they had no conclusive proof of government involvement in the attacks, but John Scott-Railton of Citizen Lab said National Action case "makes it crystal clear that NSO has been used widely and recklessly across a swath of Mexican civil society and politics. Once again we see 'government-exclusive' spyware being used for seemingly political ends."

"As cases continue to emerge, it is clear that this is not an isolated case of misuse, but a sustained operation that lasted for more than a year and a half," Scott-Railton said.

The Centro Miguel Agustin Pro Juarez, a human rights group that has investigated a number of high-profile human rights cases, has said its staff members were targeted. Other targets included well-known journalists Carmen Aristegui and Carlos Loret de Mola.

In February, Citizen Lab and its Mexican partners published a report detailing how Mexican food scientists and anti-obesity campaigners who backed Mexico's soda tax were also targeted with Pegasus.