Mexico's scandal of high-tech spying against journalists and human rights defenders widened Thursday, with experts confirming that leading members of a main opposition party were also targeted by Israeli-made spyware sold exclusively to governments.
The conservative National Action Party, or PAN, had asked internet watchdog Citizen Lab to investigate suspicious messages after the University of Toronto-based cybersleuths exposed the scandal last week.
On Thursday, Citizen Lab released a research note saying it had determined that the cellphones of the party president, its chief spokesman and the party's leader in the Senate were all sent text messages containing links to the same malware.
The spyware, known as Pegasus, is made by NSO Group, which says it sells only to government agencies for use against criminals and terrorists. It turns a cellphone into an eavesdropper with the ability to remotely activate its microphone and camera and access its data.
"This case makes it crystal clear that NSO has been used widely and recklessly across a swath of Mexican civil society and politics," said John Scott-Railton at Citizen Lab. "Once again we see 'government-exclusive' spyware being used for seemingly political ends."
Mexican President Enrique Pena Nieto last week dismissed allegations that his government was responsible and promised an investigation. Local media have reported that documents show the Mexican government bought rights to use the spy software.
The PAN is the party of former Mexican Presidents Vicente Fox and Felipe Calderon. The report says its Senate leader, Roberto Gil Zuarth, received three messages in June 2016 with links designed to surreptitiously plant Pegasus on his cellphone.
"As cases continue to emerge, it is clear that this is not an isolated case of misuse, but a sustained operation that lasted for more than a year and a half," Scott-Railton said.
Like other attempts against journalists and consumer and rights activists, the messages sought to entice the intended victim into clicking on an irresistible message. One message to Gil Zuarth was about a news article mentioning him. Another announced a death. The PAN president, Ricardo Anaya, received one message around the same time. About one month later, party spokesman Fernando Rodriguez Doval got a message.
"This is something an authoritarian regime would do," Rodriguez Doval said. "It must be investigated thoroughly and those responsible must be punished."
While the report reached no specific conclusions about who was responsible, it noted that anti-corruption legislation was being debated in Congress around the time the victims' phones were targeted.
Government critics targeted
Citizen Lab said in a June 19 report that while it had no proof of government involvement in the sending of 76 text messages targeting 12 prominent journalists and rights activists in Mexico, the targets were all investigating or critical of the government. Some had uncovered corruption.
Anaya said at a news conference two days later that PAN politicians also had been targeted. Out of caution, he said, none had clicked on the links.
"What is clear is that they tried to upload spyware onto our phones, to spy on us," Anaya said.
On Thursday, Anaya placed the blame squarely on the government.
Anaya said in a statement, "It is absolutely unacceptable for the government to spy on people, invading their privacy to this degree." He added, "We are not going to rest until those responsible resign their posts, are put on trial and are jailed."
The Centro Miguel Agustin Pro Juarez, a human rights group that has investigated a number of high-profile human rights cases, has said its staff members were targeted. Other targets included well-known journalists Carmen Aristegui and Carlos Loret de Mola.
In February, Citizen Lab and its Mexican partners published a report detailing how Mexican food scientists and anti-obesity campaigners who backed Mexico's soda tax were also targeted with Pegasus.
Last year, the watchdog group exposed the use of Pegasus to spy on a prominent human rights activist in the United Arab Emirates.