Mexican Journalists Investigating Cartels Targeted with NSO Spyware Following Assassination of Colleague

Toronto, Canada (November 27, 2018) -- A new report released today by the Citizen Lab at the Munk School of Global Affairs and Public Policy at the University of Toronto details continued abuse of spyware technology used to target journalists in Mexico. Specifically, the report details how two colleagues of a slain Mexican journalist investigating cartels were targeted with NSO Group’s Pegasus spyware in the days immediately following his killing. 

Award winning journalist Javier Valdez Cárdenas was the founder of Río Doce, a Mexican newspaper known for investigating cartels. He was gunned down near his office in May 2017. Two days after his murder, two of his colleagues-- Andrés Villarreal and Ismael Bojórquez-- started receiving text messages that were personalized and carefully crafted, claiming to have information about Cárdenas’ death. Had Villarreal or Bojórquez clicked on the links in these messages, their phones would have been silently infected with Pegasus, an extremely powerful form of spyware manufactured by Israeli-based NSO Group and capable of reading a target’s encrypted messages, examining photos, and even turning on a phone’s camera and microphone functions, ostensibly transforming a phone into a spy in someone’s pocket. 

“These infection attempts are reckless, and probably indefensible. Worse, the Mexican Pegasus customer had already been publicly exposed for abuses by this point. Where was the internal oversight? And where was NSO's oversight?”-- John Scott-Railton, Senior Researcher, The Citizen Lab

According to NSO Group, Pegasus is exclusively sold to governments for the purposes of fighting terror and investigating crime. However, in the past two years, Citizen Lab researchers have discovered that Pegasus has been used by repressive governments to spy on human rights defenders, journalists, and others who they may deem as threats to their power. In the United Arab Emirates, a human rights defender critical of the government was targeted with Pegasus and later imprisoned. In Canada, a critic of the Saudi regime and confidant of slain journalist Jamal Khashoggi was targeted in the months prior to Khashoggi’s killing. An Amnesty International researcher and a prominent Saudi blogger were targeted by the same NSO Group customer, as was a Saudi dissident based in the UK. In the United States, the minor child of a Mexican journalist was targeted while at boarding school. 

The targeting of Villarreal and Bojórquez illustrate an alarming trend of spyware attacks around the world specifically aimed at journalists. Past Citizen Lab reporting has identified journalists in Mexico, Canada, and the UK being targeted with Pegasus. Last month, the Committee to Protect Journalists issued a safety advisory to journalists and members of civil society, warning them of the dangers associated with Pegasus. 

The Mexican government-linked NSO Group customer had already been publicly exposed for abusing Pegasus months before these new cases, suggesting that NSO Group failed to take effective action to prevent the continuing abuse. 

“Thanks to companies like NSO Group, unscrupulous dictators and autocrats now have a powerful tool to aid in their sinister aims to stifle dissent and quell controversial reporting. We are now facing a crisis rich in terrible irony: a service marketed to government clients to assist in ‘cyber security’ is quickly becoming one of the greatest sources of widespread insecurity instead.”-- Ron Deibert, Professor of Political Science and Director of the Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy

To date, 24 targets of Pegasus spyware have been identified in Mexico, including journalists, human rights lawyers, anti-corruption advocates, public health officials, and international investigators.

For Media Inquiries

Guide on Citing in Media