A new analysis by Citizen Lab, of the University of Toronto, has confirmed that Mexican lawyers and human rights activists Karla Micheel Salas Ramírez and David Peña Rodríguez received messages containing links to the Pegasus spyware, between September and October 2015. The infection attempts add to the more than 90 messages identified as being linked to the use of this software, which is sold by the NSO Group, and has been acquired by at least three branches of the Mexican government and found to have been used against activists, journalists, legislators and international experts.
Karla Micheel Salas Ramírez is a feminist lawyer and human rights defender who currently serves as Director of the Action Group for Human Rights and Social Justice A.C. in Mexico City. David Peña Rodríguez is a lawyer and human rights defender working as the Legal Coordinator of the Action Group for Human Rights and Social Justice A.C. Both are members of the National Association of Democratic Lawyers.
During 2015, Salas and Peña provided legal assistance in several cases of human rights violations. Between March and September, for example, they provided legal counsel and support in hundreds applications for amparo brought by listeners of the MVS Noticias Primera Emisión Programme, presented by Carmen Aristegui, after it was taken off air.
Additionally, Salas and Peña both worked on the amparoapplication challenging the July 2015 decision by the Public Prosecutor’s Office of the Federal District (Mexico City) to discontinue criminal proceedings in the case of the human trafficking network headed by Cuauhtémoc Gutiérrez de la Torre, leader of the Institutional Revolutionary Party (PRI) in Mexico City.
In August 2015, they took up the case of three victims of the multiple femicide and homicide in the Narvarte neighbourhood of Mexico city (known as the ‘Narvarte case’), in which five people were killed, including the activist and cultural promoter Nadia Vera and the photojournalist Rubén Espinosa Becerril.
Between September and October 2015, the human rights defenders reported having received three messages containing suspicious links.
Background to the murders in Navarte and circumstances of the messages
On 31 July 2015, photojournalist Rubén Espinosa Becerril, activist Nadia Vera, model Mile Virginia Martín, make-up artist Yesenia Quiroz and domestic worker Olivia Alejandra Negrete were murdered in an apartment on Luz Saviñón Street in the Narvarte neighbourhood of Mexico City. The victims were found in the bedrooms and bathroom of the flat; they had been executed with a gunshot to the head and their bodies showed injuries, signs of torture and sexual violence.
Rubén Espinosa, one of the victims, had relocated to Mexico City from Veracruz as a result of threats he had received due to his work as a photojournalist. Activist and cultural promoter Nadia Vera had moved from Veracruz for similar reasons; in November 2014, she reported in an interview that she had received death threats and stated that the then governor of Veracruz, Javier Duarte, was responsible for anything that might happen to her.
On 4 August 2015, public prosecutor Rodolfo Ríos Garza linked three people to the multiple femicide and homicide. The main line of investigation pursued by the Public Prosecutor’s Office of Mexico City (then known as the Public Prosecutor’s Office of the Federal District, or PGJDF by its acronym in Spanish) was robbery, despite the fact that Nadia’s house-mate (who was working at the time of the crime) confirmed that the criminals had only stolen six thousand pesos and had left several valuables in the apartment.
On 11 August, the then governor of Veracruz Javier Duarte, gave a statement before the public prosecutor denying any responsibility. On 31 August, ARTICLE 19 Mexico and Central America – acting as representatives for the family of photojournalist Rubén Espinosa – accused the PGJDF of violating investigative protocols by leaking confidential information regarding the case to the press, including photos of the bodies and the results of chemical analysis performed on the victims.
On 10 September, the lawyers of the victims in the Narvarte case, including David Peña Rodríguez and Karla Micheel Salas Ramírez, requested the PGJDF, among other things, to seek additional statements from the Secretary for Public Security in Veracruz, Arturo Bermúdez Zurita; as well as his predecessor, Benito González Morales.
The call for Bermúdez to give further evidence was made in the context of previous reports by Nadia Vera and Rubén Espinosa, alleging the Secretary of Public Security in Veracruz to have been involved in assaults on students and activists from the University of Veracruz. A subsequent investigation by journalist Juan Omar Fierro revealed that six private security companies, owned by Bermúdez, are located on the outskirts of the Narvarte neighbourhood. In their report, Salas and Peña note that the PGJDF dismissed any political or journalistic link as a line of investigation.
On 23 September, lawyer David Peña indicated that those implicated in the multiple femicide in the Narvarte neighbourhood sent and received at least 30 telephone calls and text messages between the time of the murders and up to two hours after the crime. Peña asked the Public Prosecutor’s Office to investigate those communications in order to determine whom they were in contact with.
On 25 September, it was made public that the family of Mile Virginia Martín, the murdered Colombian model, had accepted legal representation from Peña and Salas. That same day, Peña received a text message with a link to the Pegasus spyware infrastructure. The message came from the number 5549576224; the same telephone number was used on 5 and 6 September, in two infection attempts targeting journalist Carlos Loret de Mola.
On 1 October, the authorities reported that the van, which the murderers had used to travel to the apartment in the Narvarte neighbourhood, had been found. On the same day, ARTICLE 19 Mexico and Central America, issued a special reporthighlighting that the Prosecutor’s Office had still not managed to clarify the reasons behind the multiple femicide.
On the same day, Karla Micheel Salas received a text message with a link to the Pegasus spyware. The message’s content shows similarities with those seen in other documented cases, containing tailored phrases that seek to manipulate the intended target into clicking the link; the telephone number (5535044351) the message was received from matches the number used in two infection attempts targeting Carlos Loret de Mola, on September 1 and 3.
On 13 October, several organisations submitted the First Report on the Denial of Justice in the Federal District (Mexico City), in response to prosecutor Rodolfo Ríos Garza’s appearance before the Legislative Assembly of the Federal District (Mexico City). In the report, it was said that the PGJDF “constructed an alternative truth via leaks and paid articles in the media, disregarding the possible political motivations [for the femicides in the Narvarte case]”.
Two days later, Peña received a text message about alleged news which linked a member of the ANAD (National Democratic Attorneys Association, to which he belongs) and Perla Gómez, Director for the Human Rights Committee of the Federal District (Mexico City), with an extortion attempt. Similarly to other documented cases, the text message was disguised as an article by UNO TV and attempted to manipulate the intended target into clicking the link using tailored content.
Similarities to previous attacks
The attempts at infection with Pegasus spyware targeting David Peña and Karla Micheel Salas have several similarities with the cases documented in previous reports by Citizen Lab.
1. The text message links to a website in the NSO infrastructure used in other attempts at spyware infection in Mexico
The three messages received by the legal representatives of the victims in the Narvarte case contain links that direct to the domain smsmensaje[.]mx. This domain was used in 49 documented occasions.
2. Messages with similar content were sent to other Pegasus spyware targets in Mexico
The content of the text message received by Karla Micheel Salas on 1 October 2015 was used subsequently in attempts to infect other targets with spyware. The only personalisation, in comparison to other cases, was to add her name to the beginning of the message.
3. Two of the text messages were sent from a telephone number previously used in infection attempts with Pegasus spyware
The messages sent to David Peña on 25 September 2015 and to Karla Micheel Salas on 1 October used telephone numbers related to other infection attempts; specifically, the text message received by journalist Carlos Loret de Mola.
Conclusions
With the two cases described in this article, the number of people for whom there is technical evidence that they were targets of infection attempts with Pegasus spyware increases to 21.
The similarities in the content of the text messages, the NSO domain infrastructure used, the telephone numbers from which the text messages were sent, as well as the profile of all the individuals that have been targets of these attacks, confirms that the illegal use of Pegasus was part of a broad and systematic surveillance operation targeting human rights defenders, journalists, anti-corruption activists, opposition politicians and members of an international technical assistance mechanism, as is the case for the International Group of Independent Experts (GIEI).
The confirmation of this pattern, added to recent revelations pointing to irregularities in the Pegasus software contracting process followed by the Federal Public Prosecutor’s Office, further supports the need for the two basic demands repeatedly reiterated by those targeted by the Pegasus spyware, and the organisations that support them, to be immediately met:
- To establish additional and special mechanisms to ensure that the investigation is truly independent, such as a Panel of Independent Experts, which provides for the participation of international human right mechanisms.
- To urgently make public all the contracts and other documents related to the contracting process and operational use of Pegasus by all branches of the government that could have acquired this spyware from the NSO Group.
If these basic demands are not complied with, the official investigation will lack credibility and there is an increased risk that, as in the case of the multiple femicide of Nadia Vera, Virginia Martín, Yesenia Quiroz, Alejandra Negrete and murder of Rubén Espinosa two years ago, the surveillance of those representing the families of the victims will remain in impunity.
ARTICLE 19 Office for Mexico and Central America
R3D: Digital Rights Defence Network
SocialTIC
For more information, please contact Juan Vázquez, Deputy Coordinator for the Communication Department of ARTICLE 19, via the email [email protected] or call +52 55 1054 6500 ext. 110