BEN: Government-owned spyware found on the phones of
Mexican journalists...
They would use it to spy on journalists,
use it to spy on politicians,
and on defenders of human rights.
...tech meant for the War on Drugs.
But if the cartels are as powerful as the authorities...
...then being spied on may be the least of their problems.
The line between authorities and organized crime
is at best blurry, many times non-existent.
♪
Corrected & Synced by Bakugan
Since 2006, the Mexican government has been locked in
a deadly war with drug cartels.
By some estimates, more than 100,000 people have been killed
since that conflict began.
By 2011, the Mexican government began buying Pegasus,
the $80 million suite of surveillance malwares
meant to hunt cartels.
Then something freaky happened.
Pegasus started showing up on the cellphones of
government critics: journalists, activists,
and human rights lawyers.
So who is the Mexican government really spying on:
the cartels, or the groups that expose government wrongdoing?
I m in Mexico City to meet the people targeted with Pegasus.
If journalists and activists are under surveillance,
could this be a warning sign for people in any country
where the government owns spyware?
So I have some American sources who ve told me off the record
that they know that Mexican authorities use some of this
malware to target their political opponents,
but they turned a blind eye as long as they're going after
specific targets in the War on Drugs.
More than 50 Mexican journalists have been murdered since
the drug war started in 2006, and 10 so far this year.
Most of these crimes are unsolved, and reporters here
know that their next story could be their last.
That's why, with evidence suggesting
the Mexican government is behind the spying,
I need to dig deeper.
I know that shedding light on this story may be the best way
to help protect those reporters.
To learn more about the malware used against the journalists
and why they were targeted, I ve contacted Luis Fernando Garcia,
Founder and Executive Director of R3D, an organization
advocating on human rights in the digital space,
and one of the first to address the abuses of Pegasus in Mexico.
So to you, what made the Pegasus malware sophisticated?
Pegasus is a sophisticated malware
because it s supposed to be, and it actually is
difficult to detect.
The other thing is the extent of the surveillance that Pegasus
is able to facilitate.
This is actually like a spy in your pocket.
It s someone following you everywhere,
to your bathroom, to your kitchen,
listening to everything you say, everything you type,
everything you click.
Why don t you explain to me
exactly how this NSO malware worked.
They send SMS messages that are tailored for the objective,
and they try to make you click on a link.
So it was actually specified to the target.
Exactly, it has the name sometimes.
Then it gets darker.
For example, one of the more disturbing ones are
your daughter - and the name of the daughter -
just had an accident, and here are the details
of the hospital she s in, for example.
So it tried to make you click on the link,
and then once you click on the link,
you get infected with some malware.
Once Pegasus was installed on a phone,
not only could it monitor every call,
it could also activate the microphone and camera
at any time, picking up conversations in any room
where the phone happened to be.
It could read every text, every email,
and record every keystroke,
picking up passwords and even encrypted messages.
And it could use the built-in GPS
to follow a target everywhere they went.
What do you think the Mexican government was even doing
with this intelligence?
They can try to create obstacles for your strategies,
for example, as a human rights group.
They can find your sources as a journalist.
They can find some dirty laundry and do some extortion on you.
They can even use that intelligence
to actually harm you, to actually...
kill you.
And Mexico is one of the most dangerous places
for journalists.
There's been journalists killed in record levels this year.
Human rights defenders are killed all the time.
So essentially, to be targeted by the Mexican government
in this way is a pretty dangerous thing,
if you find yourself on that kind of list.
Yeah, it s dangerous.
There s probably a lot of people that are...
that make it to this list, and they're just killed.
Mexico s president, Enrique Peña Nieto,
denies using Pegasus against his critics,
though he did admit acquiring it from NSO Group,
an Israeli company that sells spyware to government agencies.
But once sold, NSO says it has no way of monitoring
how their software is wielded.
So the Mexican government's been accused of buying and using
basically the AK-47 of cellphone spying,
and I m about to meet somebody
who you wouldn t expect to be the victim of it.
This is Carmen Aristegui.
She's considered Mexico's Anderson Cooper.
And somehow, magically, Pegasus malware was on her phone.
Both she and her teenage son received
personalized phishing texts after Aristegui
broke what became known as the White House Scandal,
involving Mexico s president receiving preferential treatment
from one of the government's top contractors.
So why don't you explain to me from the beginning,
when you got these strange text messages,
what did you think of them?
_
I mean, how does that make you feel,
knowing that your government is treating you that way?
_
Do you have any idea who it was in the government?
Like what agency was spying on you?
_
Do you fear for your life now?
_
Aristegui thinks there s no question she and her son
were singled out for her part in exposing government corruption.
She s not the only one.
My next source was targeted with Pegasus while proving
his government was involved in the tragic disappearance
and presumed murder of more than 40 students.
BEN: I m in Mexico City
investigating the government's alleged use
of powerful surveillance malware against its critics.
And it s not just journalists who were targeted:
activists and lawyers were targets too.
So these are the images of 43 students who were alleged
to have been murdered by cartel members.
It s a bit of a political cover up and scandal here in Mexico,
and one of the men investigating it
is actually the victim of government spying.
Mario Patrón is a lawyer and the director of one of the most
respected human rights organizations in the country.
He was targeted by Pegasus after his team uncovered evidence
suggesting that Mexican law enforcement,
and even federal authorities,
were involved in the disappearance of the students.
Patrón believes the cartels and the government
are closely connected.
Like they could pass it to the cartels?
_
This whole situation and story is really fishy,
because you're a guy who works daily to expose
human rights abuses in this country,
and you were investigating the 43 students
who were killed, which by all accounts
is a really insidious, disgusting event.
_
I was reading that there was reason to believe that
the cartels were also interested in keeping this 43 thing
as quiet as possible.
Do you think that there was any possibility that the cartels
were directing some of the spying through the government?
_
So is it fair to say then in this country that the cartels
and the government are basically one in the same?
_
But if the government and the cartels are
as closely connected as Patrón thinks they are,
did anyone ever intend to use Pegasus to track cartel members?
And is malware even an effective way
to fight cartels to begin with?
To get answers, I m going to one of the hottest regions
of the current drug war, the state of Michoacan.
This is the town of Tepalcatepec,
where the local citizens are the key
to keeping the cartels at bay.
♪
I really wanna figure out what the security situation is here
in Michoacan, so I contacted a rural defense force made up of
citizens, and one of their members has agreed to talk to me
about what the level of cartel danger is here in this region.
Meet Jesus Carrillo, a volunteer with Defensas Rurales,
a federal military defence force.
He claims his group is helping keep the town
free from the violence of the cartels.
So you as citizens took up arms against the cartels yourselves?
_
What s the security situation
going on right now in this region?
_
And obviously in nearby areas, there is some...
some level of violence from cartels.
Are you afraid of that sometimes spilling over into this region?
_
Do you feel like the cartels are kind of like a shadow state
to the actual government, and they re just as powerful?
_
If Mario and Jesus are right, parts of the Mexican government
work alongside the cartels, or are subservient to them.
And then it s possible the powerful cyberweapon Pegasus
could be under the control of some of the most
violent criminal organizations on the planet.
BEN: I m in Michoacan, Mexico,
investigating government spying on journalists.
The malware used for it was purchased by the feds with
the idea to fight the War on Drugs, but I m wondering if
cartels even use devices like cellphones that can be hacked.
Aye!
(SIGHING)
So Jesus is about to take us to an anti-cartel blockade
or checkpoint manned by some of the same security forces
he was talking about.
♪
Now does everybody communicate?
I heard that the radio systems in town,
that s how everyone talks.
_
The narcos, what kinds of radio networks do they use
to communicate with each other?
Or do they use something that s way more complex?
_
If the cartels are using something as rudimentary
as radios to communicate, it s hard to see how
cellphone malware like Pegasus would even be worth it.
But maybe it s different in the cities.
So I m heading to Guadalajara, the centre of activity for CJNG,
what the US government now considers
Mexico s most powerful cartel.
So I scored an interview with the chief of police
of Guadalajara, and what I m really trying to figure out is
whether or not local police forces here in Mexico
are using software to surveil and track cartels,
or whether or not he ll even admit to it.
Does your department use anything like software
to surveil and find cartels?
_
So you have to wonder: if the police chief of the...
one of the biggest cities in Mexico,
that deals with the most powerful and upstart cartel
in all of Mexico, is not using these technologies
to track them because he says his police force
isn t even capable of it, then why is the government
buying these things in the first place?
He also says that the cartels are using them,
so I m going to try to find out of that s true.
Sources have told me that the weapons and technology
the Mexican government buys sometimes end up
in the hands of cartels.
And if you re a hacker in cartel country,
you may also end up in the pocket of the bad guys.
_
This is Software, a hacker from Michoacan who gained notoriety
after breaking into a high-ranking cartel member s
cellphone and posting pictures of his girlfriend online,
something that almost got him killed.
Software understands the cartels, and says
they re becoming more tech savvy.
And even if cartel members don t use smartphones themselves,
they sometimes hire hackers to track their enemies who do.
Do you know of any hackers
that have been hired by cartels before?
_
What kinds of things were they asked to do?
_
So the government says that they're buying stuff
like Pegasus so they can track criminals,
but do you think cartels can actually evade
that type of technology already?
_
So the cartels are in fact using hackers.
Even if they don t have Pegasus, the Mexican government does,
and it s hard to know what s stopping the narcos
from leaning on their contacts in the administration
to give them intel on anyone they want.
That relationship between government and cartels
is a fascinating one, and I wanna know how it relates to
Pegasus, so I m going back to Mexico City.
BEN: I m in Mexico city
investigating government spying on journalists.
So far, no one s been able to tell me if Pegasus,
the malware used in the surveillance,
was ever actually used on cartel targets.
Jesús Esquivel might have the answers.
He s the Washington correspondent for the magazine
Proceso, and an expert on Mexico s War on Drugs.
You being a cartel, War on Drugs reporter
who's been in the thick of it, what do you make of cartels
being tracked with those types of tools?
Something like Pegasus?
It's impossible.
Why?
The narcos, they don't use smartphones.
They just use the most...
rustic or simple cellular phone,
and Pegasus works only if you open a link.
They use the phones just for communication.
So just like a Nokia flip phone kinda thing?
Yeah, they talk to one and they destroy the phone.
So they just have tons of these phones?
Absolutely! (LAUGHING)
A lot!
Why do you think they're still on the market?
In Mexico, at least?
And if you go to any border,
it's a lot of those phones on the streets.
So to evade surveillance,
they just go to the most basic shit possible?
They are smart people.
They know how those intelligence agencies from the Mexican side,
from the US side track you.
Do they ever hire hackers for anything?
Yes, yes they do that, but only for the money.
Not for the business or coordinating the transport
and buying drugs or arms.
No, no.
If there's one thing I've learned in Mexico so far,
it's that the government and the cartels are
almost indistinguishable.
Ah, they always... they always work together.
So given that level of collusion,
if some agencies in Mexico had hacking tools
and were collecting intelligence, could they
collect intelligence or at least share it
with cartels that they seem so in bed with already?
Probably.
They know when the government has a new "toy", as they say.
The cartels know everything.
If Esquivel is right and the cartels know
what the government knows, then any intel gleaned by Pegasus
is possibly in the hands of cartels.
And grilling the Mexican government on that fact?
Not easy.
So I ve reached out to so many Mexican government agencies
to get them to comment on NSO,
and absolutely not one official will do it.
And at this point, I just don t think
it s gonna happen whatsoever.
It s not surprising.
Ever since the Pegasus scandal broke,
the government has played innocent,
even in the face of damning evidence.
There s no independent oversight body within Mexico,
so it s unlikely the administration will ever have to
answer for its spying.
That means if there s ever going to be an investigation,
making that happen is up to the international community.
Mexico is under a human rights crisis.
The line between authorities and organized crime
is at best blurry, many times non-existent.
There s definitely some responsibility outside of Mexico
for propping up this fraudulent scheme.
I mean, how confident are you that they're even
going to give you any justice at any point?
'Cause that would require them to look at themselves
and also prosecute some people who are involved in this.
_
Many of the journalists and lawyers we spoke to
were grateful we were even covering this story.
They know Mexico needs international pressure
to make sure their government is held accountable,
and they know their lives are at risk.
But this issue isn t confined to Mexico.
Around the world in Turkey, Russia,
even in the US and my home in Canada,
reporters are being targeted by the authorities.
So in other words, we ve all gotta watch each others backs.
Corrected & Synced by Bakugan