Grieving Parents of Murdered Mexican Students on List of Suspected Targets of Military-Grade Israeli Spyware

Cristina Bautista grew up working in the corn fields of a dusty village high in the mountains of Mexico’s Guerrero state. For most of her life she’s survived by selling whatever she can scrounge up: bread, pozole, little trinkets made of palm leaves.

She counts herself lucky that her house is made of concrete and not corrugated metal or wood planks, a feat she pulled off only after a stint working in Connecticut.

She’s not wealthy, powerful, or famous. Even within Mexico, she’s one of the poorest of the poor. But her own government may have spent hundreds of thousands of dollars putting her under one of the most intensive forms of surveillance in the world, targeting her cell phone for hacking with powerful Israeli spyware.

What was so threatening about Bautista?

Nothing but the fact that she’s a victim. She and several dozen other grief-stricken parents have spent years demanding to know what happened to their children, 43 students at a rural teacher’s college who were abducted in 2014 after a bloody encounter with police in Iguala, a town in Mexico’s southwest.

Bautista’s 19-year-old son, Benjamin, was one of these desaparecidos – a term that, in Spanish, carries the chill of death. Given Mexico’s grisly track record of extrajudicial killings, those who “disappear” are nearly always found dead, after months or years of agony for their families.

For Mexicans, the case became emblematic of the violence that had convulsed the country since the mid-2000s – and highlighted the government’s inability to control it.

In a revelation that caused a scandal in 2017, it emerged that the Mexican state used Pegasus, a sophisticated piece of spyware sold by Israeli cyber intelligence firm NSO Group, to monitor international investigators looking into the case.

Now, it turns out that the surveillance campaign may have been more systematic than previously known.

Evidence obtained by The Pegasus Project, a collaborative investigation into NSO Group and people allegedly targeted by its Pegasus spyware system, suggests that the surveillance was extended to the students' desperate and impoverished families, as well as their advocates and at least one local official investigating the disappearances.

All of the phone numbers of these people appeared on a list of over 50,000 phone numbers allegedly selected as targets by clients of NSO Group between 2016 and 2020. Reporters were able to identify the owners of hundreds of those numbers. Amnesty International’s Security Lab conducted forensic analyses on dozens of their phones. The reporting was backed up by those analyses, as well as interviews, documents and other materials. Just because a number was included in the data does not mean it was necessarily compromised. The data may include phone numbers where an attempted infection was unsuccessful, or where no attempt was made. NSO Group has denied the allegations in a series of statements.

Carlos Martín Beristain, part of the group of investigators, called the revelations of family members being allegedly surveilled “extremely perverse.”

“Instead of investigating those responsible or the officials involved in the acts, the intent was to criminalize the victims,” he told OCCRP.

Pegasus was already known to be used in Mexico, where 25 people were confirmed to have been infected with the spyware, including journalists covering cartel violence, the widow of a murdered reporter, and public health advocates who supported a tax on soda. But those targets were discovered after they noticed suspicious text messages and reached out for help.

What’s different about the Pegasus Project data is that it exposes a wide swath of the phone numbers that evidence suggests were used by NSO clients for targeting, providing a more comprehensive understanding of their interests. The data contains over 15,000 Mexican numbers, many of which are consistent with people already known through forensics to have been targeted.

In addition to the Ayotzinapa parents, the leaked data shows clusters of phone numbers grouped around members of a teacher’s union, journalists and human rights activists across Mexico, and the inner circle of Andrés Manuel López Obrador, the progressive politician who would go on to win the 2018 national election.

Even a New York Times journalist was selected as a target shortly before he released a major article on how NSO software was used to spy on investigators and a human rights group working on the Ayotzinapa case.

NSO Group has insisted that it only sells its software to governments for use in legitimate law enforcement and intelligence operations. The Mexican government has made similar assurances. Then-President Enrique Peña Nieto admitted at a 2017 press conference that his administration had purchased Pegasus – but only to fight organized crime and “maintain national security.”

“This government categorically rejects any sort of intervention in the private lives of any citizen,” Peña Nieto said at the time.

Peña Nieto did not respond to multiple attempts to reach him for comment. Miguel Ángel Osorio Chong, his interior minister, told Pegasus Project journalists that the ministry “never, never authorized or had knowledge or information that Cisen [Mexico’s intelligence agency at the time] owned or acquired the Pegasus hacking kit, and never authorized anything to do with hacking.”

López Obrador, the current president, said his government was not using Pegasus, and that he would investigate whether any Mexican agencies still had active contracts for the spyware. “If the contract exists, it must be canceled,” he said, adding that it was “shameful” that his inner circle may have been targeted.

For the parents of Ayotzinapa, the revelation that they may have been spied on by their own government will come as little surprise. Most of them have felt for years that they were being surveilled.

“Oh yeah, they were watching us!” Bautista said emphatically. “Whenever we went out, a patrol followed us.”

Melitón Ortega, whose nephew Mauricio was abducted, was also on the list of selected targets. On hearing the news, he responded that Pegasus was just “the latest repressive tool used by the state.”

“I’ve always suspected that the authorities could be monitoring me,” he told The Guardian.

In response to revelations made this week by the Pegasus Project, NSO Group reiterated that the data used by reporters was misinterpreted and that the company does not allow its clients to abuse its software.

The company released a statement from Tel Aviv on Wednesday that said: “Enough is enough! … NSO is announcing it will no longer be responding to media inquiries on this matter and it will not play along with the vicious and slanderous campaign.” The company reiterated that the numbers on the list were not necessarily Pegasus targets, and said it would “thoroughly investigate” any proof that its technologies had been misused.

“NSO will continue its mission of saving lives, helping governments around the world prevent terror attacks, break up pedophilia, sex, and drug-trafficking rings, locate missing and kidnapped children, locate survivors trapped under collapsed buildings, and protect airspace against disruptive penetration by dangerous drones,” it said.

“They Didn’t Feel the Slightest Pity”

Everything seems to grow wildly in Guerrero state, a wedge of land tucked along Mexico’s Pacific coast where cacti brush shoulders with forests and small family farms where corn and beans are staple crops.

Despite its lush landscape, it’s one of the poorest areas of Mexico, heavily dependent on poppy flower cultivation. There aren’t many options for Guerrero boys who want to get ahead in life. They can migrate north, join the local narcos – dominated by a gang known as the Guerreros Unidos – or, if they’re studious and civic-minded, apply for a slot at the best school around.

Raúl Isidro Burgos Rural Teachers College, almost universally known as Ayotzinapa, was founded in the 1920s amid the Mexican Revolution, as part of a nationwide movement to train young peasants to teach in their own communities. Over the years, the college has also become known for a tradition of raucous left-wing political activism among its students.

Because the school gets almost no government funding, students have another longstanding tradition: commandeering local buses to drive themselves to classroom observation assignments or protests.

The practice was grudgingly tolerated, and bus companies sometimes instructed drivers not to resist if a band of students boarded and took over. On September 26, 2014, a group of rowdy freshmen and sophomores set off to do just that. Giddy after finishing up a grueling orientation week, they were ordered by leaders of the school’s “Struggle Committee” to rustle up buses and solicit donations to get them to Mexico City for an upcoming demonstration.

But things quickly turned strange. After being stymied by federal police roadblocks on the highway near the town of Chilipancingo, they changed course and headed into Iguala. Then police and gunmen opened fire on the buses. What followed was a coordinated and still largely unexplained attack on the unarmed students, at multiple sites, that would last for hours.

Six people were shot dead, and 40 more were wounded. One of the students was found later with his body mutilated and his face torn off. Survivors reported that their cries for help, or pleas to be allowed to help their fallen “compañeros,” as they called each other, were met with more gunshots.

“We screamed to the police that we were unarmed, that we had nothing to hurt them with,” recalled Edgar Yair, an 18-year-old freshman. “We screamed for them to stop shooting at us, because if you leaned out just a bit, they shot at you. They didn’t feel the slightest pity.”

Amid the chaos, 43 students were taken away in patrol cars — to the police station, their friends assumed. They were never seen again.

The next day, their parents mobilized.

“We, the parents, started to unite,” Cristina Bautista said. “Some came from Oaxaca, others from Tlaxcala, others from Morelos.”

They flooded into the school – Bautista recalls that they recognized each other in the crowd immediately, because they were all weeping – and commandeered it as a headquarters, sleeping on mattresses on the floors of classrooms as they waited for news of their sons.

It wasn’t long before their persistence and moral authority became troublesome to the federal government as it tried to manage the situation.

“Historic Truth” or Historic Lie?

Shortly after, the Guerrero government announced that it knew who was behind the killings: The mayor of Iguala and his wife, who supposedly became incensed that the students’ disorderly behavior was interfering with a political event and ordered them handed over to the Guerreros Unidos drug cartel.

This story soon fell apart, while evidence of federal-level collusion accumulated. Students who survived the attack had reported seeing federal and state police at the scene – they wouldn’t have answered to the mayor.

Authorities then announced that they’d found the bodies of the lost students in various pits around the Iguala. But when the remains were tested, none turned out to belong to the students; instead, they were from at least 28 unrelated people. In the end, so many unrelated mass graves were found in the area that some local families formed a new group, “The Other Disappeared of Iguala,” to advocate for their recovery and identification. Their efforts have led to the exhumation of more than 160 bodies, according to Human Rights Watch.

This series of injustices and blunders left Mexicans outraged. “Only a few days after the attacks … [it] seemed clear that the government would do everything in its power to make it impossible to find the 43 students, and equally impossible to know what happened that night,” wrote Gibler. The families of the 43 led a procession of 15,000 in Mexico City, carrying images of their lost loved ones.

In January 2015, then-Attorney General Jesus Murillo Karam officially closed the case at a press conference that quickly became infamous. He announced that as far as the Mexican government was concerned, the “historic truth” had been established and there was nothing more to say about the matter: All 43 students had been held by police and turned over to a drug gang, who allegedly executed them and incinerated their remains.

It was a good story. The only problem was that there wasn’t much evidence for it. An international team of investigators set up by the Inter-American Commission on Human Rights found evidence confirming students’ accounts that federal police had been on the scene of the shootings — and that the army had been monitoring the students all night from a command center in Iguala. But they were blocked from interviewing soldiers or visiting their barracks, despite multiple requests.

Citizen Lab, a research center at the University of Toronto, later found that, while these investigators were in Guerrero, not long after they publicly criticized the government for interfering with their investigation, two attempts were made to inject NSO Group’s Pegasus spyware into their phones.

Beristain, the group member, said they strongly felt they were being surveilled while in Guerrero. When they later learned about the Mexican government’s use of Pegasus, “it sounded a lot like the things we had suffered,” he said.

“We had many problems with the phones we used … there were suspicious people present when we met, we received strange messages, especially SMSes with links.”

In one case, he said, three members of the group received strange text messages just at a moment when they were drained after performing a particularly grisly task: exhuming the student who had been tortured.

“We left the exhumation and I received a message that said — I don’t know exactly, because that phone broke — but it said something like, ‘We are waiting for you to organize the funeral.’ That is, it was not a general message, it was a message designed so that obviously I would click it.” He said he didn’t take the bait.

When the investigators’ report was finally released, in April 2016, it rubbished the government’s “historic truth” narrative, saying there was no evidence that any bodies had been burned at the dump – in fact, it appeared to be scientifically impossible to generate enough heat there. While the remains of 19 people were found at the dump, analysts couldn’t find evidence tying them to the missing students.

This caused an outcry. It also confirmed the suspicions of the parents of the 43, who had insisted for years that the conflicting and incomplete narratives offered up by authorities pointed to a cover-up.

“What would be the point of covering up for ... police from Iguala?” a lawyer for the families, Vidulfo Rosales, told OCCRP. “That’s not very logical. In the case of Ayotzinapa, high-level officials are involved who wanted to erase evidence, who wanted to cover up for senior officials, and that is why a very messy investigation was carried out.”

In the aftermath of this chaos, new Pegasus Project data shows, the phone numbers of at least four Ayotzinapa family members were selected for targeting with Pegasus: Bautista, Ortega, Felipe de la Cruz, the father of a surviving student, and David Cabanas, the brother of a disappeared student.

So was Rosales, along with his colleague Abel Barrera, a renowned anthropologist who runs a human rights center providing legal aid to poor indigenous families.

Although Pegasus Project data doesn’t allow reporters to pinpoint exactly who placed the Ayotzinapa families on the list and why, there aren’t many possibilities. Just three government agencies in Mexico reportedly have access to the tool: the National Intelligence Center, the National Defense Secretariat, and the attorney general’s office, which signed the $32 million contract for the Mexican government’s acquisition of Pegasus in 2014.

The head of the office at the time was Jesus Murillo Karam — who would later become attorney general who closed the investigation into the missing students. He did not respond to requests for comment.

“A Great Struggle”

Parents and lawyers had complained for years that they felt harassed by the Peña Nieto government. The president made no secret of his distaste for their noisy protests against the government’s handling of the case. At one point, he suggested they were backed by forces seeking to destabilize the country and “attack the national project that we have been building.”

“It was very difficult for us,” said Bautista, recalling a constant whir of helicopters above her home during those years.

The families made the rounds of universities and human rights groups in Mexico and other Latin American countries to meet with activists and experts. They even testified at a hearing in Peru, and one in Washington. Rosales and de la Cruz joined a program called Caravan 43 that allowed them to travel widely to talk to community groups about their experience.

“We were in this fight demanding the continuation of the investigation, continuing the search, and obviously the government had the position: ‘We already investigated, the truth has been told, and what you are doing is denying the truth,’” explained Rosales.

In April 2016, private telephone conversations between him and his wife were splashed across the front pages of Mexico’s biggest newspapers and magazines. They captured him, in a moment of frustration, speaking with contempt about the indigenous families he was helping. “Fucking lousy Indians,” he called them. An army of Twitter bots emerged to denounce him, all using the hashtag #fuckinglousyindians.

It’s still unclear how the conversations were leaked. Pegasus Project data shows that Rosales’s name was included on the list of alleged targets in 2017, but the data does not precede 2016, making it difficult to know if he might have been spied on earlier.

The families say that Peña Nieto’s successor in the presidency, Andrés Manuel López Obrador, has been more responsive to their concerns. Three days after he took office, he set up the Presidential Commission for Truth and Access to Justice in the Ayotzinapa Case, and since then there have been a number of arrests and other developments in the case.

Cristina Bautista, though, isn’t satisfied. The remains of her son have never been found. She still speaks of “Benja” in the present tense – “My son is very affectionate and respectful,” she told reporters in a shaky voice. “We are looking for him.”

She knows that he is almost certainly dead, but she can’t rest, or revert to the past tense, until she knows. Still, she is comforted by the fact that she and the other parents of Ayotzinapa refused to accept that their children could simply disappear.

“They built their historical lie – it was easy for them because we are peasants. It was easy for them to ‘disappear our children,’ because we are peasants – what are we going to do?” said Bautista.

“But they were wrong about us.”