Mexican official Alejandro Encinas victim of Pegasus spyware attack

He is a longtime friend of the president, a close political ally for decades who is now the government’s top human rights official.

And he was spied on, repeatedly.

Alejandro Encinas, Mexico’s undersecretary for human rights, was targeted by Pegasus, the world’s most notorious spyware, while investigating abuses by the national army, according to four people who told him talked about the hack and an independent forensic analysis that confirmed it.

Mexico has long been rocked by spy scandals. But this is the first confirmed case of such a high-ranking member of an administration — let alone someone so close to the president — monitored by Pegasus in more than a decade of use. spy tool in the country.

The previously unreported attacks on Mr. Encinas have seriously undermined President Andrés Manuel López Obrador’s commitment to ending what he called “illegal” espionage of the past. They are also a clear sign of how surveillance in Mexico has gone free, when no one, not even the president’s allies, seems to be off limits.

Pegasus is only licensed to government agencies, and while there’s no definitive proof who hacked Mr. Encinas’ phone, the military is the only entity in Mexico that has access to the spyware, according to five people familiar with contracts. In fact, the Mexican military has targeted more cell phones with this technology than any government agency in the world.

Mr. Encinas has long been at odds with the armed forces. He and his team accused them of being involved in the mass disappearance of 43 students, one of the worst human rights violations in the country’s recent history.

His mobile phone was repeatedly infected – as recently as last year while he was leading a government truth commission into kidnappings – giving hackers unrestricted access to his entire digital life, according to the four people who report on it. discussed with him.

Pegasus was used against some of Mexico’s most prominent journalists and democracy advocates several years ago, sparking an international scandal that tainted the previous administration.

Yet the attacks on Mr. Encinas are unlike anything Mexico has seen.

“If someone as close to the president as Alejandro Encinas is targeted, it is clear that there is no democratic control over the spy tool,” said Eduardo Bohorquez, director of the Mexican section. of Transparency International, an anti-corruption group.

“There are no checks and balances,” he added. “The military is a superpower without any democratic control.”

Mr. Encinas did not respond to multiple requests for comment. Mexico’s president and Mexico’s Defense Ministry also did not respond to requests for comment.

Pegasus can infect your phone without any sign of intrusion and extract everything from it – every email, text message, photo, calendar appointment. It can watch through your phone’s camera or listen through its microphone, even if your phone appears to be off.

People who spoke with Mr. Encinas about the hacks said they learned details of the infections after they were confirmed by Citizen Lab, a monitoring group based at the University of Toronto. He conducted a forensic analysis of his phone which has not been made public.

The group also found evidence that Pegasus had infiltrated the phones of two other government officials who work with Mr. Encinas and have been involved in investigations into rights abuses by the armed forces, three people with knowledge of the hacks said.

Citizen Lab declined to comment.

Israeli Pegasus maker NSO Group has opened an investigation into cyberattacks on human rights defenders in Mexico after recent New York Times reports of military use of the spyware, a person says familiar with NSO compliance investigations.

The company also began investigating the attacks on Mr. Encinas and his two colleagues after The Times asked about those hacks, the person said.

In a statement, NSO said it does not operate individual Pegasus systems but is “investigating all credible allegations of misuse”, adding: “NSO’s past investigations have resulted in the termination of several contracts regarding the inappropriate use of our technologies.”

The hack put Mr. Encinas and the president in a difficult position. In early March, Mr. Encinas met with Mr. López Obrador to discuss the espionage and whether to go public with it, according to multiple people briefed on the conversation.

But Mr. Encinas has remained silent about his Pegasus infection ever since, they said.

Over the summer, he and his team released a bombshell report into the disappearance of 43 students that accused the military of playing a role, calling the events a “state crime”.

Then questions emerged over the evidence, and Mr Encinas came under intense scrutiny – particularly after he admitted in an interview with The Times that key parts of the investigation had been ‘invalidated’.

Lawyers representing military officials involved in the case called for his resignation and sued him for tampering with evidence. Throughout, Mr. López Obrador stood by Mr. Encinas, calling him “an exemplary public servant in whom we have full confidence”.

The two men have been political partners for more than two decades; Mr. Encinas served in Mr. López Obrador’s cabinet when he became mayor of Mexico City in 2000.

“Andrés is my friend, he is my partner,” Mr Encinas reportedly said in 2011. “We are part of a team and a project.”

But since the entry into office of Mr. López Obrador, the two men are not always aligned on the rise in power of the military.

The country’s armed forces have greatly expanded their authority under Mr. López Obrador, accumulating broad control over the police as well as a formidable list of other activities, including the construction of much of a 1,000-mile railway and an airport, drug distribution, and port and customs management. .

Mr. Encinas was one of the few people willing to criticize the administration’s Home Army.

When soldiers killed five people in northern Mexico this year, Mr Encinas said publicly that the unarmed men had been “executed” by the military.

The president has not dried up his support for the armed forces. Despite mounting evidence of military misuse of Pegasus, Mr. López Obrador continued to deny any espionage.

“We’re not spying on anyone,” López Obrador said in March. He added: “It is an act of dishonesty and a lack of principle to spy.”

When the Israeli Defense Ministry authorizes the sale of Pegasus to government agencies, they must sign agreements to use the surveillance tool only to fight serious crime or terrorism, according to three Israeli defense officials.

NSO is now investigating whether the use of Pegasus in Mexico violated this agreement.

Faced with two lawsuits in the United States by Apple and Meta, the parent company of WhatsApp, NSO is under more pressure than ever to demonstrate that it applies its own rules. The Biden administration also blacklisted the Israeli company in 2021 over concerns about how Pegasus has been used to “maliciously target” dissidents around the world.

NSO has appealed the decision, but as part of the process the company hopes to show that it prevents abuse.

A senior NSO executive said the company disconnected 10 customers after breaking the terms of their contracts. One of them, the Emir of Dubai, used Pegasus to spy on his ex-wife, according to public court records.

If NSO confirms that Mr. Encinas and others were targeted for no legitimate reason by the Mexican military, the company could immediately shut down the institution’s access to Pegasus.

Publicly, Mr. López Obrador’s position has not changed. After The Times revealed how the Mexican military became the world’s first – and most prolific – Pegasus user, the president said the armed forces “respect human rights and no longer spy like before”.

Emiliano Rodriguez Mega contributed reporting from Mexico City.