Yet nearly two years after the president established a truth commission to pry open the secrets of that dark chapter, signs have emerged that the government’s lead investigator has been targeted with military grade spyware, according to a report obtained by The Washington Post.
Pegasus spyware was detected in the phone of Camilo Vicente Ovalle, according to the forensic analysis by Citizen Lab, a digital research center at the University of Toronto. Vicente Ovalle, who coordinates the work of the truth commission, had received an email in December from Apple warning he might have been targeted by “state-sponsored attackers.”
The alleged hack is part of a mounting trove of evidence that civilians looking into human rights abuses by Mexico’s armed forces — including activists, journalists, even officials close to the president — are being targeted with malware.
The Citizen Lab report did not address the question of who might have used Pegasus to hack Vicente Ovalle’s phone. The NSO Group, which developed the spyware, says it is licensed only to government agencies. (NSO questioned the Citizen Lab findings). Investigations by digital rights groups and media organizations have pointed to the Mexican army as the institution behind the alleged hacks. They have cited the timing and targets as well as documents on its acquisition of surveillance software in 2019. The New York Times in April reported that the army was the sole agency in Mexico still operating Pegasus, citing sources familiar with the contracts.
Under López Obrador’s predecessor, President Enrique Peña Nieto, the Mexican government aggressively used Pegasus to secretly track drug traffickers as well as journalists, activists and opposition politicians, according to investigations by Citizen Lab, digital-rights groups and journalists. But when López Obrador took office in 2018, he promised to end the illicit spying on Mexicans not suspected of crimes. He raised hopes that the country would finally unravel what happened during the Dirty War and another notorious case, the 2014 disappearance of 43 young men studying at the Ayotzinapa teachers college.
Now the reports of surveillance are casting hopes for a real reckoning into doubt.
“This is incredibly troubling,” said Jose Miguel Vivanco, the longtime Latin America director for Human Rights Watch who now works for Dentons Global Advisors. He said the latest revelation, along with recent reports that López Obrador’s top human rights official had been hacked with Pegasus, had created a defining moment for the president.
“This is probably the most serious evidence that the military today is not even under AMLO’s control,” he said, referring to the president by his initials.
Vicente Ovalle and Citizen Lab declined to comment. Neither Mexico’s defense ministry nor López Obrador’s spokesman responded to requests for comment.
López Obrador has denied that the military surveils journalists or human rights defenders. Last month, after the New York Times reported the discovery of Pegasus on the phone of Alejandro Encinas, the undersecretary for human rights in the government ministry and a longtime ally of López Obrador, the president reiterated: “We don’t spy.”
The president’s refusal to condemn the attacks suggested he was caught between his pledges on human rights and his increasing reliance on the military. Not only does López Obrador rely on the armed forces to fight drug cartels; he’s also expanded their responsibilities to include overseeing seaports, rolling out coronavirus vaccines and building major public works projects such as new airports.
Carlos Pérez Ricart, a member of the truth commission, said the president is at a crossroads.
“A democratic state has to have control over its security and intelligence institutions. Everything indicates this is not the case,” said Pérez Ricart, a political scientist at the Center for Research and Teaching in Economics. “The president has to put a stop to this. His public comments have not been satisfactory.”
Encinas oversees the executive branch’s investigations into the Dirty War and the Ayotzinapa disappearances, which have been attributed to local police and drug traffickers with the alleged complicity of the military. He’s also in charge of efforts to find the more than 110,000 people currently reported as disappeared, a toll that’s risen rapidly since the government launched its war on drug cartels in 2006. Vicente Ovalle works in his office.
Encinas did not respond to a request for comment.
Citizen Lab concluded that Vicente Ovalle’s phone — or other devices whose information was backed up to the phone — had been bugged by Pegasus. The analysis could not determine the dates of the infection, but an email from Apple warning about possible targeting by “state-sponsored attackers,” received by Vicente Ovalle and reviewed by The Post, suggests it took place in the second half of last year.
Surveillance has been part of Mexico’s political culture for decades. But Pegasus is an especially powerful tool, able to search a phone’s content and remotely activate the camera and microphone. The U.S. Commerce Department has limited the Israeli-based NSO Group’s access to American technology, saying its products have been used “to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.”
NSO, asked for comment on the Vicente Ovalle case, said it “only sells to intelligence and law enforcement customers who use these technologies to prevent crime and terror daily.” In an emailed statement, it said Citizen Lab “continues to produce inconclusive reports that are unable to differentiate between the various cyber tools in use.”
“Although NSO does not operate its technology and is not privy to the collected intelligence, it initiated the industry’s leading compliance and human rights policy to investigate all credible allegations of misuse,” the company said. It said it had terminated “multiple contracts” after determining its technologies were used improperly.
López Obrador’s administration has said the attorney general’s office and CISEN, the domestic spy agency, once used Pegasus but no longer do. The military has said it employed the malware only between 2011 and 2013.
A coalition of Mexican rights groups and media organizations last year published documents obtained from the Mexican defense ministry by a group of hackers that showed the army had acquired a “remote monitoring service” in 2019 from a vendor called Antsua. That firm had been exclusively authorized to sell Pegasus spyware to the Mexican army, according to other documents cited by Mexican media outlets.
The organizations have noted that Pegasus infections appear to coincide with the targets’ publications or investigations related to the military. In March, for example, digital rights groups and Mexican media outlets made public hacked documents indicating the military was spying in August 2020 on the conversations of a human rights activist in the border city of Nuevo Laredo who had been looking into alleged army abuses. The phone of the activist, Raymundo Ramos, was subsequently found by Citizen Lab to have been attacked by Pegasus around that time.
“The evidence is there,” Luis Fernando García, director of the digital rights group R3D, tweeted last week, before the alleged hack of Vicente Ovalle’s phone was revealed. “Multiple people were spied on during the time when their work was related to military abuses.”
On Friday, the Inter-American Commission on Human Rights called on Mexico to “redouble its efforts” to investigate the use of Pegasus to track journalists and human-rights defenders, noting the “impact these types of actions have in a democracy.”
The Dirty War is among the most repressive episodes in the history of the one-party system that ruled Mexico for most of the 20th century. At the height of the Cold War, the Mexican military and other security forces detained and tortured hundreds of leftist guerrillas, students, poor farmers and others.
Many were never seen or heard from again.
In Guerrero state, where an armed rural rebellion was met with a violent crackdown, at least 239 people were disappeared, according to a state truth commission report. Some were likely buried in unmarked graves; others were thrown out of military airplanes, their bodies sinking in the Pacific Ocean.
Yet unlike other Latin American countries that suffered similar human rights abuses at the time, Mexico has never really reckoned with that history. There has been widespread impunity for those who carried out the Dirty War disappearances.
In 2002, then-president Vicente Fox established a special prosecutor’s office to investigate Dirty War crimes. But its results were “deeply disappointing,” Human Rights Watch said in a 2006 report. The group blamed a lack of resources and resistance from the military.
López Obrador, who campaigned on promises to transform the government, said his administration would finally make amends. In 2021, he launched the first national truth commission to probe what took place during the Dirty War, locate the missing and lay the groundwork for potential prosecutions. It is examining the period from 1965 to 1990.
“We are in a new and different era, even for the institutions known as rigid and severe, such as the army and navy,” López Obrador said in inaugurating the commission. “Look at how things have been changing; that’s why I’m optimistic.”
Vicente Ovalle was charged with overseeing the day-to-day operations of the government’s investigation. A noted historian, he has spent years studying forced disappearances and other abuses by the government during the Dirty War. He also has a personal connection to the period: When he was 5, his parents, from a city in Oaxaca state known for leftist activism, were detained by security forces and held incommunicado. They were eventually released.
Under his leadership, the commission gained access to the former sites of clandestine prisons inside army installations, allowing survivors and relatives of the disappeared to visit. The commission also accessed previously secret archives.
But the military’s uneasiness with the scrutiny has been clear.
In a speech last June marking the opening of army bases to the commission’s investigation, Defense Minister Luis Cresencio Sandoval sparked outrage by stating that soldiers killed during the counterinsurgency campaign would be honored, too.
“The commission is uncomfortable for the military, that’s the truth,” said Pérez Ricart. “They fear our mission, our methodology and our possible findings.”
