- 8 months after the filing of the criminal complaint for Mexico’s illegal spying on activists and journalists, there are no advances in the investigation
- The case shows the Mexican Attorney General’s Office’s lack of will and ability to investigate
- Mexico’s forthcoming autonomous Attorney General’s Office must be able to carry out serious and impartial investigations to punish government abuse at all levels
Mexico City, February 20, 2018. Eight months ago, 11 journalists, activists, and human rights defenders filed a criminal complaint with the federal Attorney General’s Office (PGR) for the use of the malware known as Pegasus to spy on us. Today, Mexicans Against Corruption and Impunity (MCCI) and the New York Times have published new and relevant information on the case.
From the beginning, we have voiced our lack of confidence in the PGR’s ability to investigate itself, taking into account that the PGR itself had acquired the spyware, compounded by the President’s initial threats against the complainants and public comments directed towards bringing about the failure of the investigation by concluding with no evidence that the complaints were false.
These circumstances led us to insist on the need for a panel of independent experts to ensure that the investigation was complete, impartial, and professional. However, the Mexican government rejected this proposal.
As the New York Times revealed today, and as we have seen in the investigation file, the PGR is unwilling and unable to investigate our complaint. This is clear from the following:
- The PGR’s Criminal Investigation Agency (AIC) recognizes having acquired Pegasus, which operates out of its Mexico City office. Yet, the Special Prosecutor for Crimes against Freedom of Expression (FEADLE), which handles the case, has not investigated the AIC, despite repeated requests from the victims and the recommendations of experts such as Citizen Lab.
- The agents trained to use Pegasus have not been identified or questioned.
- FEADLE has not visited the offices from which Pegasus operates.
- There has been no review of security cameras, lists of agents on duty, or security measures applied to the use of the system.
- FEADLE has not requested the contract through which Pegasus was acquired, even though it was already published by the press.
- FEADLE has not requested additional documents or conducted forensic examinations of the servers and hardware used to operate Pegasus and seems satisfied with the AIC’s implausible explanation that it does not keep records of the people against whom it used Pegasus
- As forensic experts and the company that makes Pegasus (NSO Group) have informed the New York Times, the forensic analysis of the servers and hardware used to operate Pegasus should find the record of the spyware’s use; yet FEADLE has refused to follow this line of investigation.
- On the contrary, the investigation has centered on useless paperwork and Google searches, reviews of the social networks of the victims, and pointless information requests sent to more than 2000 towns in Mexico.
- FEADLE’s requests for technical assistance to international institutions have yielded no results. The New York Times revealed that an FBI source confirmed that the FBI will not participate in an investigation that threatens to be no more than a simulation. In this sense, today’s NYT report shows that the PGR may have used the name of institutions like the FBI in bad faith, stating that they would help the investigation as a way of seeking to show international scrutiny and assistance that has not materialized.
- In eight months, the PGR has not investigated the corruption presumably behind the illegal use of Pegasus. Civil society investigation (such as by MCCI) has advanced more than FEADLE, as MCCI revealed today that a PGR official was linked to a company connected to the business group that sold Pegasus to the PGR for USD $32 million, through a direct contract process for “national security” reasons, despite the fact that the company in question had no relevant experience. We have formally requested that PGR carry out 17 investigation activities to follow up on this line of investigation and include corruption in its inquiry.
Given the serious omissions in the investigation, the complainants and our lawyers have repeatedly proposed lines of investigation, seeking to collaborate with investigators. However, FEADLE ignored our requests, obliging us to file a constitutional action to which FEADLE responded that it would decide on our proposals “when it considers it opportune to do so.” This has not occurred so far, so we have asked a judge to order FEADLE to carry out investigative activities.
For the foregoing reasons, we call for:
- A mechanism to guarantee independence in the investigation, such as a panel of experts that includes participation of international human rights mechanisms.
- Thorough investigation of the AIC’s use of Pegasus, including questioning of the agents tasked with operating the spyware, forensic examination of the servers and equipment used, and reviews of the decision-making process and security measures applied to its use.
- In light of the PGR’s lack of will to investigate, we call on the Presidential candidates to support the creation of the independent expert panel to investigate this case, as well as to support the reform of article 102 of the Constitution, so that the incoming, autonomous Attorney General’s Office is capable of carrying out investigations.