Spyware in Mexico Targeted Investigators Seeking Students

MEXICO CITY — A team of international investigators brought to Mexico to unravel one of the nation’s gravest human rights atrocities was targeted with sophisticated surveillance technology sold to the Mexican government to spy on criminals and terrorists.

The spying took place during what the investigators call a broad campaign of harassment and interference that prevented them from solving the haunting case of 43 students who disappeared after clashing with the police nearly three years ago.

Appointed by an international commission that polices human rights in the Americas, the investigators say they were quickly met with stonewalling by the Mexican government, a refusal to turn over documents or grant vital interviews, and even a retaliatory criminal investigation.

Now, forensic evidence shows that the international investigators were being targeted by advanced surveillance technology as well.

The main contact person for the group of investigators received text messages laced with spyware known as Pegasus, a cyberweapon that the government of Mexico spent tens of millions of dollars to acquire, according to an independent analysis. The coordinator’s phone was used by nearly all members of the group, often serving as a nexus of communication among the investigators, their sources, the international commission that appointed them and the Mexican government.

Beyond that, the investigators say they received identical text messages on their own phones, too, luring them to click on links that secretly unlock a target’s smartphone and turn it into a powerful surveillance device. Calls, emails, text messages, calendars and contacts can all be monitored that way. Encrypted messages become worthless. Even the microphone and camera on a smartphone can be used against its owner.

The effort to spy on international officials adds to a sweeping espionage offensive in Mexico, where some of the country’s most prominent journalists, human rights lawyers and anticorruption activists have been the targets of the same surveillance technology. But the new evidence shows that the spying campaign went beyond the nation’s domestic critics.

It also swept up international officials who had been granted a status akin to diplomatic immunity as well as unprecedented access to investigate a case that has come to define the nation’s broken rule of law — and the legacy of its president, Enrique Peña Nieto.

Surveillance under Mexican law can be conducted only with the authorization of a federal judge, and only if the government can show cause to do so. But the kind of diplomatic immunity the investigators received meant that it was extremely unlikely that a federal judge would have been allowed to sign off on such a warrant, the investigators said.

“You are not just hacking anyone’s phone, you are hacking the phone of someone who has been granted immunity,” said Francisco Cox, one of the investigators and a prominent Chilean lawyer. “They couldn’t even search my bags in the airport.”

“If this can happen to an independent body that has immunity and that is invited by the government, it is a bit scary to think of what could happen to a common citizen in Mexico,” he said.

Since 2011, Mexico has purchased at least $80 million worth of the spyware, which is sold exclusively to governments, and only on the condition that it be used against terrorists and criminals. But an investigation by The New York Times and forensic cyberanalysts in recent weeks determined that the software had been used against some of the country’s most influential academics, lawyers, journalists and their family members, including a teenage boy.

The government has denied responsibility for the espionage, adding that there is no ironclad proof because the spyware does not leave behind the hacker’s individual fingerprints. It has promised a thorough investigation, vowing to call on specialists from the United Nations and the F.B.I. for help. One of the surveillance targets, the forensic analysis showed, was a United States lawyer representing victims of sexual assault by the Mexican police.

But the United States ambassador to Mexico, Roberta S. Jacobson, said the United States was not involved in the investigation. Opposition lawmakers and international officials are now calling for an independent inquiry into the spying scandal, declaring Mexico unfit to investigate itself.

“This case just on its face — and presuming the veracity of the allegations — is serious enough to warrant the creation of an international commission,” said James L. Cavallaro, a commissioner on the Inter-American Commission on Human Rights, which appointed the group of experts. “The commission shares the concerns of others: How can the government be trusted to investigate its own alleged violation of citizen rights given its track record in this matter?”

Another commissioner, Esmeralda Arosemena de Troitiño, backed the idea of an independent inquiry. “This investigation should find both the material and intellectual authors of the alleged spying,” she said.

Top officials from the nation’s main opposition party have come forward to say that they, too, have been targeted, raising the pressure on the government. The head of the National Action Party, Ricardo Anaya, says his party is pushing for a congressional committee to conduct its own inquiry and will also formally demand an international investigation into the spying.

“The grand tragedy of Mexico is impunity. Horrible things occur, and nothing happens,” he said. “This time, we will not let that happen.”

The disappearance of the students in September 2014 ignited an enormous outcry in Mexico. Hundreds of thousands poured into the streets to protest a case that, to many, represented all that afflicts Mexico, a nation where about 30,000 people have disappeared and more than 100,000 have been killed in the decade-long churn of the drug war.

The anger also focused on Mr. Peña Nieto, whose determination to change the narrative of his country from one of desperate violence to economic promise was suddenly, and permanently, upended. The outrage has been matched only by the disbelief that, almost three years later, nearly all of the 43 students are still missing. The remains of one have been discovered. Fragments of another may also have been identified. The rest of the students, whether dead or alive, have not been found.

Many Mexicans believed that their best chance of finding out what really happened to the students lay with the international investigators, who were appointed by the Inter-American Commission on Human Rights, a regional body based in Washington that monitors countries and can refer cases to court. But the investigators said the government essentially obstructed their inquiry and then cast them out by refusing to extend their mandate — evidence, they said, that the government simply did not want the case solved.

Still, it is hard to prove who ordered the spying. Even the manufacturer of the spyware, an Israeli cyberarms manufacturer called the NSO Group, says it cannot determine who, precisely, is behind specific hacking attempts using its technology.

But the company says that it sells its surveillance tools only to governments, and that stringent safeguards prevent them from being used by anyone outside of the government agencies that purchase the technology.

Moreover, once a person’s phone is targeted, researchers can verify that the spyware has been deployed by examining the text message to determine whether it points to a server running NSO’s technology. They have confirmed at least 19 cases in Mexico involving human rights lawyers, anticorruption activists, journalists and, now, international officials.

“Citizen Lab and our partners are finding people targeted with NSO spyware almost wherever we look in Mexico,” said John Scott-Railton, a senior researcher at Citizen Lab at the Munk School of Global Affairs at the University of Toronto, which has worked with the digital rights group R3D in Mexico to identify the spyware on the phones of targeted activists and officials.

“I have never seen anything that matches the scale and scope of this case,” he said of the surveillance campaign in Mexico.

Hacking attempts disguised as text messages appeared on the cellphone of the executive secretary for the investigators, the point person for all contacts with the group, on March 1 and 4, 2016, the forensic analysis found. Around the same time, lawyers for Centro Prodh, a human rights group looking into the mass disappearance of the students, were also being targeted by the software.

“The Mexican government implored the commission to create this expert group, and then when their investigation did not ratify the official version, things changed,” said Mr. Cavallaro, who was the president of the Inter-American Commission at the time of the hacking attempts. “If it’s true that the government spied or tried to spy on our experts, that would be an outrage of historic proportions.”

The investigators sent a private letter to the Inter-American Commission late last month, detailing their suspicions after The Times published an article about the hacking campaign. They said some of their phones had also been subject to suspicious messages.

One message, sent to one of the investigators in March, was from someone posing as a close friend whose father had died. A link was attached with the details of the funeral. When the link was opened, the website of a well-known funeral home in Mexico popped up. A similar message, with the same link, was also sent last year to an academic trying to impose a sugar tax in Mexico. In that case, the message was confirmed as Pegasus.

During the hacking attempts on the investigators, the group was in the throes of a crisis. The investigators had just complained publicly of being harassed, and they were less than two months from publishing their final report, which rejected the government’s version of what happened to the students.

The mystery began on Sept. 26, 2014, when about 100 students from a teachers’ college in the town of Ayotzinapa struck out to commandeer some buses. As they had in years past, the students planned to take the buses to Mexico City to attend a commemorative march and then return them, a tradition both the bus companies and the authorities typically tolerated.

But that night soon turned into an ominous chapter in Mexico’s modern history. The police fired mercilessly on the students and the buses transporting them, leaving six dead and scores wounded. The police emptied two buses of students, detained them and whisked them away in patrol cars.

The government maintains that local police officers, along with the drug gang they worked for, kidnapped the students, killed them and incinerated their bodies in a nearby dump.

The government version, however, never offered a clear motive for the attack on the students, and Mexicans pushed for an international inquiry. Eventually, the government agreed, and the Inter-American Commission on Human Rights appointed a five-member team of prominent prosecutors and rights activists from across the Spanish-speaking world.

When the investigators arrived in Mexico, after months of local protests over the disappearances, it was an exceptional moment: a reclusive government opening itself up to external scrutiny.

But within a few months, the relationship between the government and the investigators began to sour. In its first report, the investigators contradicted a central tenet of the government’s version, saying it could find no evidence of a fire big enough to burn 43 bodies, nor any remnants or bone fragments that matched those of the missing.

The acrimony came quickly. Pro-government newspapers began attacking the group, and the Mexican government opened a criminal investigation against the executive secretary of the Inter-American Commission, based on unsubstantiated claims about the misuse of funds.

“We always worked in good faith, and we went with open eyes and an open mind, only going where the facts led us,” said Mr. Cox, one of the investigators. “Our purpose was to contribute to the rule of law in Mexico.”