The Israelis had come to Mexico to clinch a significant sale: The Mexican navy was about to turn into the first shopper ever to purchase their product, the world’s most superior spy ware.
But earlier than they might shut the deal, an argument erupted over worth and the way rapidly the spy software might be delivered. A Mexican common overseeing the negotiations referred to as for a pause till later that night, in keeping with two folks current and a 3rd with information of the talks.
“We’ll pick you up at your hotel and make sure to arrange a better atmosphere,” they recalled the common saying.
That evening, a convoy of automobiles arrived at the Israeli executives’ resort and took them to a brand new spot for the fateful negotiations: a strip membership in the coronary heart of Mexico City.
The common’s safety staff ordered all the different clientele to depart the membership, the three folks stated, and the talks resumed.
It was in that darkish cabaret in March 2011, amongst girls dancing onstage and photographs of tequila, that the strongest cyberweapon in existence acquired its begin.
The spy ware, often known as Pegasus, has since turn into a world byword for the chilling attain of state surveillance, a software utilized by governments from Europe to the Middle East to hack into hundreds of cellphones.
No place has had extra expertise with the promise and the peril of the expertise than Mexico, the nation that inaugurated its unfold round the globe.
A New York Times investigation primarily based on interviews, paperwork and forensic exams of hacked telephones reveals the secret dealings that led Mexico to turn into Pegasus’ first shopper, and divulges that the nation grew into the most prolific consumer of the world’s most notorious spy ware.
Mexico went on to wield the surveillance software towards civilians who stand as much as the state — abuses the nation insists it has stopped. But The Times discovered that Mexico has continued to make use of Pegasus to spy on individuals who defend human rights, even in current months.
Many instruments can infiltrate your digital life, however Pegasus is exceptionally potent. It can infect your cellphone with none signal of intrusion and extract every part on it — each e mail, textual content message, picture, calendar appointment — whereas monitoring every part you do with it, in actual time.
It can file each keystroke, even while you’re utilizing encrypted functions, and watch by way of your cellphone’s digital camera or hear by way of its microphone, even when your cellphone is turned off.
It has been used to battle crime, serving to to interrupt up child-abuse rings and arrest infamous figures like Joaquín Guzmán Loera, the drug lord often known as El Chapo.
But it has additionally been deployed illegally, repeatedly, with governments utilizing Pegasus to spy on and stifle human rights defenders, democracy advocates, journalists and different residents who problem corruption and abuse.
Alarmed at how Pegasus has been used to “maliciously target” dissidents throughout the globe, the Biden administration in 2021 blacklisted NSO Group, the Israeli firm that manufactures the spy ware.
Soon after, Israel’s protection ministry — which should approve the export of Pegasus to different nations — stated it will ban gross sales to international locations the place there was a threat of human rights violations.
Yet, regardless of ample proof of Pegasus abuses in Mexico, the Israeli authorities has not ordered an finish to its use in Mexico, in keeping with 4 folks with information of the contracts for the expertise.
In truth, Mexico’s navy isn’t solely Pegasus’ longest-running shopper, the 4 folks say, however it has additionally focused extra cellphones with the spy ware than every other authorities company in the world.
And the spy software continues to be deployed in the nation, not simply to fight crime.
After the revelations that Pegasus had been wielded towards authorities critics tarred his predecessor, President Andrés Manuel López Obrador, who got here to workplace in 2018, promised to cease what he referred to as the “illegal” spying of the previous.
He didn’t. Previously undisclosed exams present that, as lately as the second half of 2022, Pegasus infiltrated the cellphones of two of the nation’s main human rights defenders, who present authorized illustration to the victims of one of the most infamous mass disappearances in Mexican historical past.
The position of the navy in the mass disappearance has been a spotlight of the investigation for years. And as new allegations towards the navy surfaced in the case final 12 months, the two advocates had been focused by Pegasus repeatedly, in keeping with forensic testing carried out by Citizen Lab, a watchdog group primarily based at the University of Toronto.
The Mexican navy is the solely entity in the nation presently working Pegasus, the 4 folks acquainted with the contracts stated.
The Israeli protection ministry declined requests for remark. The Mexican protection ministry wouldn’t talk about the current hack however stated it adopted the authorities’s place, which asserts that intelligence gathering is “in no way aimed” at invading the non-public life of political, civic and media figures.
This was the second wave of assaults on the cellphone of Santiago Aguirre, one of the human rights defenders. He had been focused with Pegasus throughout the earlier administration, too, Citizen Lab discovered.
“This government made so many promises that things would be different,” Mr. Aguirre stated. “Our first response was to say, ‘This can’t be occurring once more.’”
A spokesman for the Mexican president declined to remark. In a press release, NSO Group stated it “adheres to strict regulation and cannot disclose the identity of its customers.” The firm challenged the conclusiveness of Citizen Lab’s forensic analyses, whereas Citizen Lab stated it had no doubts about its findings.
To confirm whether or not Pegasus hacked the two Mexican human rights advocates in current months, NSO Group stated it will must be “given access to the data.” But the advocates stated they weren’t prepared to provide the authorities’s spying accomplice any extra of their non-public data.
Pegasus’ beginnings in Mexico have lengthy been shrouded in secrecy. After the evening at the strip membership, the Israeli executives of NSO Group, then a fledgling start-up, returned to Tel Aviv with the outlines of their first sale. The subsequent step was an precise contract.
So, a couple of months later, a staff of NSO representatives returned to Mexico to point out off the spy ware to some of the strongest folks in the nation.
On May 25, 2011, Eran Reshef, an Israeli protection business govt who helped dealer the deal, stated in an e mail to NSO’s chairman and its two founders that “the demo to the Secretary of Defense and President will take place next Friday,” referring to the president at the time, Felipe Calderón, and his secretary of protection, Guillermo Galván Galván. A replica of the e mail surfaced in an Israeli lawsuit over commissions from the sale of Pegasus to Mexico.
Two of the folks at the demonstration stated it had taken place on a sprawling navy base on the outskirts of Mexico City, the place the first Pegasus machine can be put in.
Fearing leaks, the Mexican Army made the Israeli executives wait in a tiny room the place cleansing provides had been stored so nobody would see them earlier than they made their presentation. An armed soldier was stationed exterior the door.
When Mr. Calderón and Mr. Galván Galván arrived, they sat in entrance of giant screens on the wall — and watched a cellphone get hacked, the attendees stated.
Udi Doenyas, the chief expertise officer of NSO Group who invented the Pegasus structure and led the staff that wrote the code behind the first model of the spy ware, confirmed that he had related the Pegasus system to a display and handed a BlackBerry cellphone to senior Mexican officers. He requested them to make use of it.
As they did, the cellphone confirmed no indicators of being compromised, however the Pegasus system methodically started extracting every bit of information, beaming it onto the display for all to see.
This was the spy ware’s superpower: the sneak assault.
Miguel Ángel Sosa, a spokesman for Mr. Calderón, acknowledged that the former president had paid a go to to a navy facility, the place he was “given various presentations about the tasks” being carried out, “including the gathering of information and intelligence.”
But he stated Mr. Calderón was by no means knowledgeable whether or not the spy ware was ultimately bought, and that the former president was by no means instructed — “nor did he inquire” — what instruments had been used to seize criminals.
At the time, Mexico desperately wanted a method to reliably crack into BlackBerry telephones, a tool of alternative for the nation’s fearsome drug cartels. From the begin of his time period in 2006, Mr. Calderón had pushed a so-called kingpin technique for confronting organized crime, specializing in the teams’ prime leaders.
Pinpointing the drug lords required expertise that allowed spies to comply with their location continually. The criminals had been cautious, former legislation enforcement officers stated, transferring round and shutting down their telephones to keep away from being captured.
“It didn’t give you enough time to launch an operation,” stated Guillermo Valdés, the former director of CISEN, which was the nation’s equal of the C.I.A., from 2007 to 2011. “If someone turned off his phone, we no longer knew where he was.”
Up to that time, Mexico had relied closely on the United States.
“The pressure on the military to raise its game in terms of intelligence capabilities was intense,” stated Alejandro Hope, a former intelligence officer throughout the Calderón administration. A possible draw of Pegasus, he stated, is that it will give Mexico its personal capabilities.
“They no longer wanted to be dependent on the Americans,” Mr. Hope stated.
The navy signed the contract to purchase the spy ware quickly after the demonstration.
In September 2011, about 30 NSO staff, most of the firm’s employees, flew to Mexico to arrange Pegasus, take a look at it and instruct a staff of about 30 Mexican troopers and officers how one can function the expertise, in keeping with three folks acquainted with the set up. The Mexican unit chosen to function it was referred to as the Military Intelligence Center, a secretive arm of the military about which little has been made public.
Once the Mexicans had been able to run Pegasus on their very own, a brief ceremony came about that December as a means of “handing over the keys,” two of the folks stated.
A doc from 2019, unearthed in an infinite hack of Mexican navy emails final 12 months, point out that the Mexican intelligence middle is housed in a horseshoe-shape complicated. Three folks acquainted with it say commanders can watch by way of inside glass partitions as data unspools on big screens.
In a 2021 doc, additionally made public by the hack, the military says that one of the foremost dangers dealing with the middle is “that the activities carried out by this center are revealed to the public.”
Pegasus was rapidly embraced by the Mexican authorities, and after Enrique Peña Nieto took workplace as president in 2012, two extra authorities businesses purchased it: the lawyer common’s workplace and CISEN, in keeping with Mexican officers and three folks with information of the contracts.
Within a couple of years, the spy ware started infiltrating the telephones of some of Mexico’s most distinguished human rights attorneys, journalists and anti-corruption activists — surveillance that strayed removed from the settlement with the Israelis to focus on severe crime and terrorism.
Condemnation got here swiftly from at house and overseas, and the scandal clung to Mr. Peña Nieto for the relaxation of his presidency. In all, Mexico has spent greater than $60 million on Pegasus, in keeping with Mexican officers, citing spending by previous administrations.
The Mexican navy has acknowledged having Pegasus solely from 2011 to 2013. But a gaggle of unbiased specialists investigating the disappearance of 43 college students who had been planning to attend a protest said the military had Pegasus once they had been kidnapped in 2014, and was spying on the telephones of peopleinvolved in the crime on the evening the occasions unfolded.
It isn’t clear why the navy was spying, however the intelligence was not used to assist discover the college students, the specialists stated.
After Mr. López Obrador took workplace in 2018, he dissolved the federal police and changed the Mexican spy company with a brand new entity.
From 2019 by way of right now, solely the navy has had Pegasus, 4 folks with information of the contracts say. And throughout that point, the spy ware has continued to be deployed towards journalists, human rights defenders and an opposition politician, in keeping with Citizen Lab’s analyses.
Under Mexican legislation, authorities entities want a choose’s authorization to spy on non-public communications. But in public disclosures, the navy has stated it has not made any request to do this variety of surveillance in recent times.
On a Thursday afternoon final December, Mr. Aguirre acquired an e mail that learn like one thing out of a spy novel.
“Apple believes you are being targeted by state-sponsored attackers who are trying to remotely compromise the iPhone associated with your Apple ID,” stated the message, which was reviewed by The Times. “These attackers are likely targeting you individually because of who you are or what you do.”
In 2021, Apple introduced it will start sending warnings like this to customers whose cellphones had been hacked by refined spy ware. The e mail went on to say that “sensitive data” on Mr. Aguirre’s cellphone could also be compromised, “even the camera and microphone.”
Mr. Aguirre, the govt director of the Miguel Agustín Pro Juárez Human Rights Center, had been focused years earlier with Pegasus.
His abdomen sank pondering of authorities spies poring over his complete digital life, from messages with torture survivors to household photographs along with his younger daughter.
Then it hit him: Others is likely to be compromised, too.
He ran down the corridor to the workplace of María Luisa Aguilar, the lead advocate dealing with the group’s worldwide work. She had gotten the similar e mail.
The two advocates contacted the Mexican digital rights group often known as R3D, which had their cellphone information analyzed by Citizen Lab. It confirmed that each had been hacked a number of instances by Pegasus from June by way of September 2022.
“In the eyes of the armed forces, we represent a risk,” Ms. Aguilar stated. “They don’t want to lose the power they have accumulated.”
Natalie Kitroeff reported from Mexico City, and Ronen Bergman from Tel Aviv.
