The Mexican Military bought, in 2019, a program for the “remote information monitoring service” that is used to tap cell phones, despite presidential statements to the contrary. Official documents confirm that the Ministry of National Defense (Sedena) made that contract with the company Comercializadora Antsua, SA de CV, representative in Mexico of the company NSO Group, owner of the Pegasus spy software.
That same year, the phones of at least three people were tapped with Pegasus to monitor calls and messages: a journalist from Political Animal; Raymundo Ramos, a human rights defender in Tamaulipas, and journalist and writer Ricardo Raphael, as Citizen Lab, from the University of Toronto, was able to verify after doing a forensic analysis of their teams.
In all three cases, the illegal tapping of the phones occurred when those affected were investigating issues related to alleged human rights violations committed by the Armed Forces.
Whoever spied on them was able to access all the content on the computer: passwords, files, photographs, email, contacts, messaging applications, even encrypted. Also, activate the microphone and camera to monitor all activity near the phone, as well as access messaging conversations made prior to the attack.
This journalistic investigation carried out jointly by Political Animal, the Network in Defense of Digital Rights (R3D), Process and Aristegui News it proves, for the first time, that espionage through the infection of the Pegasus system has continued during the government of Andrés Manuel López Obrador.
In 2017, during the administration of Enrique Peña Nieto, the Spy Government investigation made public the espionage against activists and human rights defenders without the Attorney General’s Office (FGR) having found those responsible so far.
John Scott, an expert at Citizen Lab, warns that currently “there is at least one Pegasus operator in Mexico, and there could be others, but the question is who is this customer?” He also explains that the system is much more sophisticated because it no longer requires the user to interact with a link, but can be used remotely and taking advantage of the vulnerabilities of messaging applications – as happened with WhatsApp – or the Apple system to perform the infection.
Shalev Hulio, director of NSO Group, has made statements under oath before US courts in which he has assured that his company only sells Pegasus software to governments to conduct investigations into serious crimes or terrorism.
Even the export and licensing of the system is under the control of the Israeli government through the Defense Export Control Agency (DECA). And for the sale of the software in each country, NSO Group appoints companies as its representatives so that governments can buy the system through them.
On this case, this Monday, October 3, the victims of espionage will file a criminal complaint with the FGR against whoever is responsible, with the legal support of the organizations R3D and Article 19.
The media group that did this research sent questionnaires to request positions on the issue to the Presidency, Sedena, NSO Group and the company Comercializadora Antsua, but in no case was there a response.
The tests
The journalists and human rights defenders spied on during the last six-year term filed a criminal complaint with the Special Prosecutor’s Office for the Attention of Crimes Committed against Freedom of Expression (Feadle) in 2017, and although the investigation practically did not advance for two years, Article 19 presented in 2019 a second complaint based on a protected witness who testified before the prosecutor’s office and provided information that gave rise to new proceedings.
Among them, the search of KBH Tracken, the company that heads the network of companies that sold pegasus software at the behest of the Mexican government. There were located computers, devices and documentation with logos of the Sedena, as can be seen in the photographic record of the search.
Among the documentation was the letter signed by NSO Group director Shalev Hulio in January 2018. In it, he reported that the company Air Cap, SA de CV — through which the Attorney General’s Office (PGR) had made a contract to renew Pegasus’ license — would cease to be a representative of his company and as of March of that year. Comercializadora Antsua would already be.
In another document, the Israeli company notified that Comercializadora Anstua was the “authorized to exclusively represent NSO Group before the Secretariat of National Defense (Sedena) until December 31, 2019, that is, the agency could make the purchase with said company, says the letter signed by Niv Ovadia Leibovitch and Evan Forte, company executives.
The information in both documents was obtained by sources who had access to the investigation folder and who handed it over for this investigation on condition of reserving their names.
Now it is also known that Sedena completed the purchase of the software with Comercializadora Antsua on April 12, 2019, as stated in the letter number SGE-3335, sent by the “Electronic Warfare” section of the General Directorate of Transmissions of the Sedena, in which it informs of the payment and fulfillment of the service.
The letter – classified as “secret” – refers to the contract DN-10 SAIT-1075/P/2019 for the “remote monitoring service of information established to the company ‘Comercializadora Antsua, SA de CV'”, whose service was valid from June 1 to 30, 2019.
The document is in an email with the subject “deadly trades”, which is part of the millions of files of the Sedena obtained by the group of hacktivists Guacamaya, which granted access to this information to the media participating in this investigation.
Read: AMLO confirms that there was a hack of the Sedena; minimizes importance of the information disclosed: “It is in the public domain”
The communication gave an account of the performance of the service, since the documents derived from the procedure “original invoice No. 197 duly legalized (second payment) were listed; letter of acceptance No. 1910-4950 dated July 15, 2019, in original issued by the end user, in which it is reported that the service was received from June 1 to 30, 2019”.
Among the documents obtained by Guacamaya is also the information regarding the guarantee for 12 million pesos that the company Fianzas y Cauciones Atlas, SA, granted to Comercializadora Antsua for said contract, a requirement requested in the public administration to finalize the contract.
Eight months after Sedena signed this contract, President López Obrador said in his conference on November 6, 2019 that his government no longer allocated resources to acquire spying software: “We have not bought equipment for eavesdropping, among other things because of the corruption that meant buying all this equipment at very high prices from foreign companies, spy systems, a lot of money was spent.”
On several occasions he has also declared that there was no longer espionage: “In our case we decided not to spy on anyone, there was that practice of spying on opponents, and we have given instructions that there be no espionage, because it was very shameful that, in addition to the fact that they are illegal, immoral practices. We suffered it, we suffered a lot of that.”
Sedena kept this contract hidden despite requests by different means.
The journalists participating in this investigation requested via transparency the contracts they had made with Comercializadora Antsua la Sedena, the Navy, the National Guard, the National Intelligence Center (CNI), the Federal Police and the PGR (today FGR), but in all cases they responded that they had not made any.
Even, the Sedena also denied information to the Superior Audit of the Federation (ASF), as evidenced by an email sent by the institution –also located in the information of the Guacamaya group–, in which it reiterates the request for the agency to deliver the contracts and payments made to Comercializadora Antsua in 2019 and 2020, and that it had previously made as part of the audit process applied to the secretariat.
“It should be noted that in the 3 meetings held with the staff of the information was indicated and it was specified that in case of not being able to send it, it was available for the audit team to review it on the site,” says the email of September 1, 2021.
The Political Animal Case
The journalist of Political Animal, whose name is withheld for security reasons, was conducting a journalistic investigation into human rights violations allegedly committed by the military in a troubled area of the country in 2021, when his phone was infected.
Daniel Moreno, director of Political Animal, warns that, with the infection on the phone of one of its journalists, who carried out the espionage had access not only to that information, but to the entire media, because during the pandemic the communication between all theTeam concentrated through the phone. In addition, in the meetings between journalists everyone talks about the reports they are working on: “This makes spying on a single phone violate the entire newsroom.”
“First: there is no legal reason for this journalist to have been spied on. Second, journalistic work involves establishing conversations with sources of information that are automatically threatened when a phone is tapped. And in addition, it always opens the possibility of threats or pressure to the media and the journalist himself, to limit the right to information and freedom of the press due to the risks involved in investigating. This is an attack on many things.”
Espionage is even more worrying in a country considered deadly for the press, since, in the first eight months of this year alone, 15 journalists have been killed, adding to the 150 counted since 2000. There is also evidence that Cecilio Pineda, a Guerrero reporter killed in 2017, had been spied on with Pegasus.
For this reason, Moreno insists: “What this espionage does is further violate the insecurity in which journalists and defenders live (…) Journalists need to have the peace of mind that we can carry out our work without the pressure that they are spying on us illegally and that they are spying on us in a country where the guarantees to practice journalism are frankly limited. Because by attacking the right to information and freedom of expression, it does not affect the journalist and the media, it affects us all.”
After the criminal complaint that the victims will file, the FGR is again responsible for finding those responsible. “They are the ones who should tell us who it was. What we at least have to demand is that the investigation be concluded and they tell us who spied, what agency did it, under what criteria, how much it cost, why it did it illegally, who else is spying on, “says Moreno.
They blame the Army
Raymundo Ramos has been a human rights defender for 25 years and a victim of espionage since the last six years. According to Citizen Lab’s forensic analysis, his cell phone was infected on three dates: around August 28, September 2 and 3, 2020.
Just four days before the first attack, the newspaper The Universal revealed that, after a confrontation with alleged members of organized crime on July 3, 2020, the military ordered the killing of a survivor, and showed that in the current government the Armed Forces continued to commit human rights violations, despite the contrary speech of President López Obrador.
The Nuevo Laredo State Human Rights Committee (CEDHNL) continued to document that case following complaints filed against the military by relatives of the murdered civilians, who are presumed to be victims of kidnapping. That is why Ramos participated in the public denunciations in the media and had meetings with officials of the Ministry of the Interior, in the Office of the UN High Commissioner.
At that time, it also carried out activities related to other cases of human rights violations that occurred previously: the disappearance of 47 people during a special operation carried out between January and June 2018 by the Navy and the extrajudicial execution of eight people in Nuevo Laredo during an operation by the Ministry of Public Security of Tamaulipas, the intelligence group and the Army, in 2019.
That is why, he says, “I have no doubt that not only military intelligence and naval intelligence are attentive to my work and to the defense we do of the victims.” He has also been the victim of smear campaigns in publications that accuse him of links to criminal groups.
Although he has “learned” to live with the risks, at this moment he says he has elements to suspect the existence of a relationship between the Armed Forces and criminal groups, which they could take advantage of to harm him. “I can be the victim of an attack by organized crime, but acting under orders from the Army or the Navy for them to be free of all suspicion.”
“I hold the Army, the Navy, responsible for what may happen to my family, to my collaborators, to me, in these moments of crisis, of strengthening the Armed Forces above the institutions and of presidential weakness (…) From being the supreme commander of the Armed Forces, the president has been evidenced as a public defender of the Armed Forces, “warns Ramos.
Journalist and writer Ricardo Raphael was spied on through his cell phone infection on three dates in 2019 and one in 2020, in addition to having other ataqThese were detected in 2016 in citizen lab forensics. His columns published in 2020 included coverage of violence and enforced disappearances in Tamaulipas, the judicial process of former Defense Secretary Salvador Cienfuegos, and the Ayotzinapa case.
The infection date of November 7, 2019 coincides almost exactly with the start of the round of interviews for his book Son of war, in which he addresses the origin of Los Zetas, a group made up of deserters from the Army and that was born practically as a paramilitary force. There he includes the interview he did with Galdino Mellado Cruz, who presents himself as one of the founders of the organization.
“The book is a critique of the decisions that have been made in the aftermath, where the Army has tried to hide this story and, somewhat worse, present itself as the solution to a problem that the Army itself started,” explains the writer.
Therefore, “I do understand why I would have been spied on with this malware. The hypothesis is consistent that the only instance that Pegasus currently has in its possession is the Army or any of the instances directed by the military (…) I locate and point directly to those authorities as responsible for this espionage and I want to assume that the president has been deceived and that he has not been informed that they are spying on us.”
Shortly after that infection, her underage son received a phone message asking about his father and grandfather. Then a manipulated audio was published on Twitter derived from a phone call he had had with Salvador Leyva Morelos Zaragoza, an official of the Federal Institute of Public Defender (IFDP), in which they talked about the cases of Israel Vallarta Cisneros and Juana Hilda González Lomelí, sentenced to 78 years in prison for the kidnapping of Hugo Alberto Wallace Miranda.
This audio was used by Isabel Miranda de Wallace to sue Ricardo Raphael, accusing him of belonging to a criminal organization and bribing the president of the Supreme Court, Arturo Zaldívar.
This, Raphael says, shows that Miranda de Wallace “used contacts within the Army, they provided him with this recording (…) And if they give it to this lady, who else will they not have given it to? In who else will be my bank accounts, my operations, my consumption habits, the data of my familiar and friendly networks, the data of my sources? Who are the real customers of the military agenda that ordered these interceptions and then handed them out?”
With all this evidence, Ricardo Raphael believes that “the president has to call to account the military leadership that has been giving us these limitations typical of an authoritarian, militarized state of military control.”
In previous cases it has been confirmed that Sedena is one of the institutions that have used Pegasus.
Just this September 29, the Interdisciplinary Group of Independent Experts (GIEI), which is investigating the disappearance of the 43 ayotzinapa students, reported that Sedena operated the Regional Intelligence Command North Iguala Zone, within the 27th Infantry Battalion – despite the fact that the institution had denied its existence – and where it used Pegasus software for monitoring and telephone interception.
You may be interested: The GIEI points to the Army and the FGR for stopping the investigations of the Ayotzinapa case; supports the work of the Special Unit
Meanwhile, the journalistic investigation Pegasus Project documented that governments in 10 countries used Pegasus to spy on journalists, human rights defenders and political opponents. In Mexico, Sedena, the Center for Investigation and National Security (Cisen, now CNI) and the defunct Criminal Investigation Agency used the software during the six-year term of Enrique Peña Nieto – between 2016 and 2017 – and the first two did so without a court order.
In this research, the analysis of thousands of data of potential victims to be spied on in each country was made. In the case of Mexico, there were people related to the investigation of the disappearance of the Ayotzinapa students as Vidulfo Rosales, lawyer for mothers and fathers, and the then prosecutor of Guerrero, Miguel Ángel Godínez Muñoz.
There were also opponents such as Alejandro Moreno, then governor of Campeche and now leader of the PRI, whose conversations allegedly obtained by espionage have been published by the current governor of Campeche, Layda Sansores, of Morena. Likewise, other governors of that time, such as Jaime Rodríguez, of Nuevo León; Javier Corral, from Chihuahua; Graco Ramírez, from Morelos, and Omar Fayad, from Hidalgo, among others.
What we do in Animal Político requires professional journalists, trabaJo as a team, maintain dialogue with readers and something very important: independence. You can help us keep going. Be part of the team.
Subscribe to Animal Político, receive benefits and support free journalism.#YoSoyAnimal
