While investigating abuses by the military, the country’s top human rights official was infected with the spyware, the Times found.
A man with gray hair and a gray beard stands behind a podium with the emblem of Mexico on it.
Alejandro Encinas, Mexico’s undersecretary for human rights, speaking last year about the case of the disappearance of 43 students.
He is an old friend of the president, and a close political ally for decades and is now the government’s top human rights official.
And he has been spied on, repeatedly.
Alejandro Encinas, Mexico’s undersecretary for human rights, was targeted by Pegasus, the notorious spyware, while investigating abuses by the national army, according to four people who spoke to him about the attack. An independent forensic analysis confirmed the hack.
Mexico has long been plagued by spy scandals. But this is the first confirmed case in which a high-ranking member of a government — and someone so close to the president — has been monitored by Pegasus more than ten years that the spy tool has been used in the country.
The attacks on Encinas, which had not been reported before, seriously undermine the promise of President Andrés Manuel López Obrador, who said he would put an end to espionage practices, which he has described as “illegal”, that have occurred in the past. And, when even the president’s allies do not appear to be safe, the attacks are also a clear indication of the careless use of surveillance in Mexico.
The Pegasus license is allowed only to government agencies, and while there is no definitive proof as to who hacked into Encinas’ cell phone, the military is the only entity in Mexico that has access to the spyware, according to five people with knowledge of contracts. In fact, the Mexican military has infected more cell phones with this technology than any other government agency in the world.
For a long time, Encinas has been in tension with the armed forces. He and his team have accused them of being involved in the disappearance of 43 students, a case that constitutes one of the worst human rights violations in the country’s recent history.
His cell phone has been infected multiple times — including last year, while he was leading the government’s truth commission on the disappearance — giving hackers unrestricted access to his entire digital life, according to the four people who have discussed this matter with him.
Several years ago, Pegasus was used against some of Mexico’s most prominent journalists and defenders of democracy, sparking an international scandal that marked the past six-year term.
Now, in recent months, new cases have emerged confirming that the spyware was used against human rights defenders and local journalists also during the López Obrador government.
Even so, the attacks on Encinas stand out among the cases that have been seen in Mexico.
“If someone as close to the president as Alejandro Encinas is being watched, it is clear that there is no democratic control of the spyware,” said Eduardo Bohórquez, director of the Mexican chapter of Transparency International, an anti-corruption group.
“There are no checks and balances,” he added. “The army has enormous power and has no democratic oversight.”
Encinas did not respond to multiple requests for comment. Mexico’s president and the defense ministry also did not respond to requests for comment.
Pegasus can infect a cell phone without showing signs of invasion and extract everything from it: every email, text message, photo, calendar appointment. He can see what’s on the phone’s camera or hear through his microphone, even if the phone appears to be turned off.
People who spoke to Encinas about the hacks said he learned the details of the infections after they were confirmed by Citizen Lab, a watchdog group based at the University of Toronto. This group performed a forensic analysis of his phone that has not been released.
The group also found evidence that other cell phones had been infiltrated with Pegasus.
There are two government officials who work with Encinas and have been involved in investigations of human rights violations by the armed forces, according to three people with knowledge of the hacks.
Citizen Lab declined to comment.
NSO Group, the Israeli maker of Pegasus, has opened an investigation into cyber attacks on human rights defenders in Mexico following recent reports by The New York Times about the use of spyware by the military, according to a person familiar with the investigations.
The company also began looking into the attacks on Encinas and her two colleagues after the Times asked about the hacks, that person said.
NSO assured, through a statement, that it does not operate individual Pegasus systems, but rather “investigates all credible allegations of misuse,” adding: “Past investigations by NSO have resulted in the cancellation of several contracts regarding inappropriate use of our technologies.
The cyberattack has put Encinas and the president in a difficult position. In early March, Encinas met with López Obrador to discuss the espionage and whether he should come forward, according to several people who were briefed on the conversation.
But since then, they said, Encinas has remained silent about the Pegasus infection.
In the summer, Encinas and his team published an explosive report on the disappearance of the 43 students that indicated that the military had played a role and described the events as a “state crime.”
Doubts about the evidence then arose and Encinas came under intense scrutiny, especially after he admitted in an interview with The Times that key information from the investigation had been “invalidated.”
The lawyers representing the military involved in the case asked for his resignation and sued him for falsifying evidence. From the beginning, López Obrador has supported Encinas, and has said that he is “an exemplary public servant, in whom we have full confidence.”
For more than two decades the two men have been allies and political partners: Encinas was part of López Obrador’s cabinet in 2000, when he took over as head of government for Mexico City.
“Andrés is my friend, he is my partner,” Encinas was reported to have said in 2011. “We are part of a team and a project.”
But since López Obrador took office, they have not always been aligned on the issue of the growing power of the army.
The country’s armed forces have vastly increased their authority under López Obrador, amassing control over surveillance as well as a formidable array of other activities, including much of the construction of a 900-mile train and an airport, the distribution of medicines and the administration of ports and customs.
Encinas has been one of the few people within the government willing to criticize the army.
When soldiers killed five people in northern Mexico earlier this year, Encinas said publicly that the unarmed men had been “executed” by the military.
But the president has not toned down his support for the military. Despite mounting evidence of the military’s misuse of Pegasus, López Obrador has continued to deny that espionage is taking place.
“We do not spy on anyone,” López Obrador said in March. And he added: “It is an act of dishonesty and lack of principles.”
When the Israeli Defense Ministry grants licenses to sell Pegasus to government agencies, they must sign a contract agreeing to use the surveillance tool exclusively to combat serious crime and terrorism, according to three Israel Defense officials.
NSO is now investigating whether the use of Pegasus in Mexico violated that agreement.
Facing two lawsuits in the US from Apple and WhatsApp’s owner Meta, NSO is under more pressure than ever to prove it abides by its own rules. The Joe Biden administration also put the Israeli company on a restricted list in 2021, out of concern about how Pegasus was being used to “maliciously attack” dissidents around the world.
NSO appealed the decision, but as part of the process, the company must show how it is preventing its misuse.
A senior NSO executive said the company had deactivated 10 clients after they breached the terms of their contracts. One of them, the emir of Dubai, used Pegasus to spy on his ex-wife, according to court records made public.
If NSO confirms that Encinas and the others were targeted for no legitimate reason, the company could immediately terminate the Mexican military’s access to Pegasus.
In public, López Obrador’s position has not changed. After the Times revealed how the Mexican military became the first and most prolific user of Pegasus, the president declared that the armed forces “are respectful of human rights and don’t do espionage, as It was done before.”
Source: NYT
