Dozens of teachers in Mexico may have been picked for targeting with highly invasive spyware, according to data from a large-scale investigation into the Pegasus spyware system. The selections took place during a period when they were in conflict with the Mexican government over its proposed educational reforms.
Most of the alleged targets belonged to a hard-line faction of Mexico’s politically powerful teacher’s union, which had fiercely opposed the reforms. In at least one case, a unionist was arrested shortly after his phone number was selected.
The Pegasus spyware, made by Israel-based NSO Group, can gain access to victims’ cell phones without their knowledge. Once installed, it can see nearly everything on the phone, and even activate microphones and cameras — all without the target having any idea they’re being watched.
The new information about possible surveillance of Mexican union leaders emerged from a leak of over 50,000 phone numbers that were obtained by a consortium of journalists including OCCRP. Based on a wide range of evidence, including forensic analysis of dozens of phones, journalists concluded that the list represents numbers selected for targeting by NSO Group’s Pegasus system. The collaborative investigation, called The Pegasus Project, was coordinated by Forbidden Stories and received technical support from Amnesty International’s Security Lab.
The Mexican government has admitted to being a client of NSO Group, and this week the government released copies of its contracts to use the spyware, but it has denied reports that it targeted journalists, activists, and public health advocates.
Former President Enrique Peña Nieto insisted that Pegasus had only been used against serious criminals. He did not respond to a request for comment from the Pegasus Project. Osorio Chong, who was Secretary of the Interior under Peña Nieto, said his office had never used Pegasus.
But the new findings suggest that ordinary Mexican citizens may have been systematically targeted for expressing public dissent. In addition to the teachers, phone numbers of water-rights activists, and parents whose children were abducted in the town of Ayotzinapa were also found in the Pegasus Project data.
It’s yet more evidence that NSO Group’s flagship spyware is being misused in Mexico. The company says it sells Pegasus only to governments as a crime-fighting tool. But there were over 15,000 Mexican phone numbers in the data, and dozens were identified as belonging to journalists, activists, academics, and members of the political opposition.
“Espionage was for a long time a systematic … practice of the state against its opponents ,” Alejandro Encinas, a senior Interior Ministry official, told the Washington Post, a partner on The Pegasus Project.
In a series of responses, NSO Group denied that the data was related to their software, declined to comment on any of its customers, and said it would investigate any cases of misuse that could be proven.
A Massacre in Nochixtlán
The National Educational Workers’ Syndicate, best known by its Spanish abbreviation SNTE, is Latin America’s largest labor union and a potent political force in Mexico, with the ability to make or break elections.
It’s also notorious for maintaining a stranglehold on Mexico’s education system, which is one of the worst performers in the OECD despite relatively high salaries for teachers.
In the 2000s, SNTE broke from its longstanding support of the Institutional Revolutionary Party (PRI), which had ruled Mexico for decades and to which the union had been bound through entrenched systems of patronage. Instead, union leader Elba Esther Gordillo threw her power behind a rival party whose candidate won the presidency in 2006.
When the PRI was voted back into office in 2012, educational reform was at the top of incoming President Enrique Peña Nieto’s agenda, putting SNTE in his crosshairs.
SNTE had traditionally controlled the hiring and promotion of teachers, but the new Education Reform Bill would require them to take annual exams. It put more responsibility for certification and salary distribution in the hands of the federal government.
This move was fiercely opposed by teachers and set off years of protests, especially among the Coordinadora Nacional de Trabajadores de la Educación (CNTE), a dissident group within the SNTE that rejected what they saw as a corrupt and decadent union leadership.
It was during this period that the numbers of CNTE leaders began appearing on the leaked list of phone numbers allegedly selected for targeting with Pegasus. At least one of them, Francisco Villalobos, was arrested shortly after his number appeared on the list. He said he was apprehended by plainclothes police in an unmarked car.
“It was almost like a kidnapping,” he told OCCRP, adding that after he was picked up, he was taken to an airport he didn’t recognize and put on a helicopter. From there, he was taken to a prison in Sonora, across the country, and charged with "violent robbery" before being released.
The Pegasus Project data doesn’t precede 2016, making it hard to know if any teachers or activists were targeted before that year.
However, it shows that many other unionists’ phone numbers were selected for targeting in mid-2016, at the peak of huge CNTE-led protests against Peña Nieto’s educational reform. They simmered all summer in states where CNTE was strongest: Chiapas, Michoacan, and especially Oaxaca, where teachers angered state and federal officials by barricading highways leading to Mexico City.
The tension came to a head on June 19, when federal police forces sent to clear a barricade from the streets of the town of Nochixtlán began advancing on a few dozen unarmed protesters with live ammunition.
Images from that day show scenes of shocking violence. Burning overturned cars served as a backdrop as civilians faced off against heavily armored officers. When it was all over, 180 people had been hurt and 12 were dead, according to Santiago Ambrosio, a teacher who was wounded and has since become a victims’ rights advocate.
It’s still unclear why the police approached a small crowd with such disproportionate force on that day.
“We need to consider that there were some local political interests as part of the attack in Nochixtlán, but these are things we will probably never know,” Jan Jarab, a former representative of the U.N.’s Office of the High Commissioner on Human Rights in Mexico, told OCCRP.
But in the following days, as the shooting became a national scandal, at least nine more union leaders had their numbers entered into the Pegasus system.
At least seven more unionists’ numbers were added in early February 2017, not long after CNTE called for a new round of protests.
