Mexican government targets its citizens with spyware

As a source points out in a new story from the New York Times, once you sell an AK-47, you can’t control how it is used.

That is more or less the problem faced by an Israeli cyber-arms manufacturer, the NSO Group, which has sold about $80 million worth of spyware to the Mexican government. As Azam Ahmed and Nicole Perlroth report, the company “says it sells the tool exclusively to governments, with an explicit agreement that it be used only to battle terrorists or the drug cartels and criminal groups that have long kidnapped and killed Mexicans.”

It turns out, though, that the Mexican government has used the software, Pegasus, to go after prominent human rights lawyers, journalists, and anti-corruption campaigners. An attack begins with an enticing or aggressive text messages—one was an invitation to a wake, another told the recipient there were armed men outside his home. If targets click the attached links, software is installed on their smartphones that monitors calls, texts, and emails, and can even turn the phone into a surveillance device.

In a separate piece on how the hacking story came to be, Perlroth, who had reported on the NSO Group before, notes that there is no global body regulating the use of spyware. Which is worrisome as governments with terrible human rights records get their hands on it.

The latest issue of National Geographic details the story of a 2011 massacre, in which members of the Zeta drug cartel rampaged through the town of Allende, killing dozens of people. The bloodbath was triggered when the US Drug Enforcement Agency shared intelligence on two drug kingpins with a Mexican federal police unit—and the information was almost immediately leaked to the kingpins themselves, demonstrating that someone had betrayed them. The massacre was their revenge.

Drug cartels are among those Mexico should be targeting with advanced cyber-tools. Instead it appears to be collecting information on the kind of citizens—journalists, lawyers, activists—who tend to clash with drug cartels. If its law enforcement bodies are leaky and corrupt, the victims are doubly in danger.