Spying by Mexico’s Armed Forces Brings Fears of a ‘Military State’

"This is the first time a paper trail has emerged to prove definitively that the Mexican military spied on citizens who were trying to expose its misdeeds.

MEXICO CITY — Mexico’s armed forces spied on a human rights defender and journalists who were investigating allegations that soldiers had gunned down innocent people, documents show, providing clear evidence of the military’s illegal use of surveillance tools against civilians.

The government has been embroiled in scandal for years over the use of sophisticated spyware against a wide range of people who stand up to Mexico’s leaders. But surveillance experts say this is the first time a paper trail has emerged to prove definitively that the Mexican military spied on citizens who were trying to expose its misdeeds.

Documents and interviews show how the spying that tarnished the previous government has continued under President Andrés Manuel López Obrador, who vowed that his administration would not engage in such surveillance, which he called “illegal” and “immoral.”

Mexico’s armed forces are not authorized to spy on civilians, legal experts say, but the military has long wielded spying technology and has grown ever more powerful under Mr. López Obrador.

In a 2020 Defense Ministry report, unearthed last year in an extensive hack of the Mexican armed forces and reviewed by The New York Times, military officers described the details of private conversations between a human rights advocate and three journalists discussing allegations that soldiers just weeks earlier had executed three civilians in a confrontation with a cartel.

The report contended that the advocate, Raymundo Ramos, was trying to “discredit the armed forces” by discussing allegations of unlawful killings by the military with reporters.

It recommended that the military glean information from his private conversations, but not include it in official case files, perhaps in an attempt to keep its spying secret.

Forensic tests show that Mr. Ramos’s cellphone had been infected multiple times by Pegasus — extremely powerful spyware — around the same time that the military produced the report on his conversations, according to an analysis by Citizen Lab, a research institute at the University of Toronto.

Despite the president’s assertions, Mexico’s Ministry of Defense was actively using Pegasus in 2020, when Mr. Ramos’s phone was hacked, according to three people familiar with the export licenses required to sell the cyberweapon outside of Israel, where it is made.

Pegasus can extract enormous amounts of information from a digital device without any warning: texts, calls, contacts, photos — even its location.

“We’re talking about the military monitoring you, knowing your personal information, your friendships, everything,” Mr. Ramos said in an interview. “They know where I am at all times.”

Mr. López Obrador, who took office in 2018, promised that his administration would never spy on its opponents.

The new evidence of military spying suggests Mr. López Obrador, as commander in chief of the armed forces, either knew about the surveillance and tolerated it, experts said — or his own subordinates disobeyed him.

“Both scenarios are terrible, but all the evidence we have points to the army spying on its own initiative and for its own interests,” said Catalina Pérez Correa, an expert on the military at Mexico’s Center for Research and Teaching in Economics.

“Taking into account the enormous economic power it has and all the state functions it controls,” Ms. Pérez Correa said, “you could say that Mexico has the building blocks for a military state.”

Under Mr. López Obrador, the military has taken on far greater responsibility for policing, as well as controlling the nation’s ports and customs, building part of a 1,000-mile train line and even distributing medicine. The number of troops deployed across the country is at its highest point in recent history.

The Ministry of Defense did not respond to requests for comment, but has said that its intelligence gathering is focused on fighting organized crime and has acknowledged using Pegasus only from 2011 to 2013.

The Israeli manufacturer of Pegasus, NSO Group, said it could not confirm its clients because of confidentiality agreements.

“The company does not operate the technology, nor does it know who its customers are investigating,” the NSO Group said in a written statement, adding that the company “investigates any credible claim of misuse of its technology.”

The Biden administration blacklisted the NSO Group in 2021, citing the use of the company’s spyware by foreign governments to target activists and journalists.

Mexican news media reported in October that the military had purchased spyware under the current administration. At the time, Mr. López Obrador said the military was carrying out “intelligence work, not spying.”

What set off the spying on Mr. Ramos was a car chase in the violent town of Nuevo Laredo along the U.S. border one night in July 2020. Soldiers pursuing several pickup trucks ultimately killed a dozen passengers who the military said had been part of a local criminal group.

In the days and weeks that followed, Mr. Ramos said, he spoke to the parents of three of the victims, who said their sons had been killed even though they were innocent. They were traveling inside the pickups, but had been kidnapped by the cartel, the parents said.

Mr. Ramos began publicizing the allegations, and soon a local newspaper published damaging body camera footage of the confrontation. The video showed the officers spraying one of the trucks with bullets despite no one firing back, and then ordering the assassination of a survivor of the attack.

“He’s alive!” one officer yells in the video. “Kill him!” another responds.

That’s when Mr. Ramos’s phone was targeted by Pegasus. The spyware infected his phone five times in the days before and after the military emailed its report, according to Citizen Lab.

Mr. Ramos told The Times that all of the intercepted exchanges were from messages and one call made on Telegram, an encrypted app. The military’s intelligence report said Mr. Ramos had “links” to a Mexican cartel and would benefit financially from discrediting the armed forces.

Under Mexican law, the military does not appear to be allowed to intercept private messages, legal experts said. But even if it could, it would need a federal judge’s authorization — something the military has said in public disclosures it has not once requested in recent years.

In a criminal inquiry that was opened into Mr. Ramos’s case, the federal judiciary confirmed that there had been no requests to intercept his communications, according to three people familiar with the case who were not authorized to speak publicly.

The case represents one of the most significant breakthroughs in years of spyware research, digital investigators said.

“I’ve never seen anything like it,” said John Scott-Railton, a senior researcher at Citizen Lab. “For the first time, it shows us how the operators took this man’s private digital life, dumped it out on the table and then tried to select the parts that would be most harmful to him.”

The military’s report was first made public on Tuesday by three Mexican news outlets working with local rights groups.

The document, which was sent by email on Sept. 2, 2020, suggests that the most powerful people in the military were involved in the spying.

It appears to have been produced by the second-highest-ranking officer in the military, and appears to have been addressed to his superior, Secretary of Defense Luis Cresencio Sandoval.

That same day, Mr. Sandoval had a meeting scheduled with high-ranking officers and the head of the military agency that was investigating the killings, a copy of his calendar retrieved from the hacked files shows.

“The military wasn’t using Pegasus to combat crime,” said Luis Fernando García, the director of R3D, a local digital rights group, which helped uncover the military’s report. “The military was spying on civilians to protect itself.”

The report indicates that the spying was carried out by a secretive branch of the armed forces called the Military Intelligence Center.

The agency’s purpose is to generate “intelligence” from “information obtained in closed channels,” the military said in 2021.

One of the main risks facing the center, another document says, is “that the activities carried out by this center are revealed to the public.”"