AMY GOODMAN: We turn now to Mexico, where a new report by the Citizen Lab has revealed the Mexican government used Israeli-made spy software to surveil a team of international investigators who had dispatched to Mexico to investigate the high-profile disappearance of 43 students at the Ayotzinapa teachers’ college in Guerrero in 2014. The targeted individuals included some of Latin America’s most prominent lawyers, who had been granted a form of diplomatic immunity to carry out their investigation. The Citizen Lab has also reported that the Mexican government also used the spying software called Pegasus to spy on Mexican human rights activists and journalists. Some of the targeted activists and journalists are now suing the Mexican government, after learning they had been surveilled. This is award-winning journalist Carmen Aristegui.

CARMEN ARISTEGUI: [translated] This is an operation by the state where the agents of the Mexican state, far from doing what they should do legally, have instead utilized our resources, our taxes, our money to commit serious crimes. And it has to be realized that the head of the Mexican states—that is, the president of Mexico—that is the first.

AMY GOODMAN: Citizen Lab reported that the infection attempts took place in early March of 2016, shortly after the international investigators had criticized the Mexican government for interference in their investigation and as they were preparing their final report of their findings about the students’ disappearance. The Israel-based NSO Group, the maker of Pegasus spyware, is backed by the United States private equity firm Francisco Partners.

For more, we’re joined by two guests. Ron Deibert is with us, director of Citizen Lab at Munk School of Global Affairs, University of Toronto, in Canada. And in Mexico City, we’re joined by Stephanie Erin Brewer, human rights attorney and the international area coordinator for Centro Prodh, which represents some of the families of the 43 Ayotzinapa students who disappeared in 2014. She and Centro Prodh were targets of the NSO Group’s Pegasus spyware attack.

We welcome you both to Democracy Now! I want to begin with Ronald Deibert in Toronto. Ronald, explain what Citizen Lab is and what you found, what exactly was done with this spyware and what it is.

RONALD DEIBERT: Citizen Lab is a research group at the University of Toronto. We combine a mixture of methods from different disciplines, from political science, computer science and engineering, to examine cybersecurity issues or digital security issues that arise out of human rights concerns. So, we’ve done extensive research and reporting on targeted digital attacks on civil society groups—effectively, cyberespionage campaigns. And as part of that, we’ve uncovered many cases of commercial spyware companies, like NSO Group and others, where their technology is being used by governments to target civil society groups.

AMY GOODMAN: And how did you find this out, that the Mexican government was using Pegasus, and how they were using it? Explain how it went into the phones that they were using.

RONALD DEIBERT: So, what happens here is that we have a variety of technical indicators. Essentially, these are—you could make an analogy to digital fingerprints—maybe domain names, other technical indicators, that are part of messages that are sent, text messages, that are received by targets. And had they clicked on them, their phones would have been infected, allowing the operators to effectively read every email, text message, listen in on phone calls, track geolocation, turn on the camera, audio, etc. Using those digital fingerprints and working with our partners, our civil society partners in Mexico and elsewhere, we’re able to find targets who have received these SMS messages. And we examine the content. We look at the links that are sent, the messages that are received, and are able to verify that these are part of the NSO Group’s infrastructure.

AMY GOODMAN: And explain exactly what happened. You had a key investigator who had his phone infected, and many of the other investigators were using his phone. Is that right? And explain what—

RONALD DEIBERT: That’s correct.

AMY GOODMAN: —the phone was doing and where it was transmitting to.

RONALD DEIBERT: OK. Well, actually, to really understand this, you have to go back. This is the latest in a series of reports that we have done over the last several months, going back to our first report, which found that advocates for a tax on sugary beverages in Mexico—three health scientists had received messages with links to NSO Group infrastructure. Following that, we found that a number of journalists and human rights activists and lawyers, including the other guest on your show, had received messages containing the same type of links, with domains associated with the NSO Group infrastructure. A few weeks ago, we published another report about Mexican opposition politicians.

And this latest one, I think, is the most egregious. It’s a phone belonging to the international investigators into the 2014 mass disappearances in Mexico of students. So this was a phone handled by one of the people involved in this international investigatory group. They received two messages just prior to the release of their major public report. The group, it should be said, had a kind of public falling out with the Mexico attorney general. And the report was quite critical of the Mexican government. So all of this together is adding up to a lot of circumstantial evidence pointing to some agency within the Mexican government or an individual associated with the Mexican government responsible for the targeting.

It should be said also that this type of technology is restricted to government clients. The NSO Group itself says that they only sell to Mexican—to government agencies and restrict the use of their technology to antiterror, national security or criminal investigations. I think, under anyone’s reasonable definition, these targets couldn’t fit into that category.

AMY GOODMAN: So, Pegasus could record anything picked up by your phone microphone, or even its camera. Even when you’re not using the phone, it can be transmitting audio and video back to the government.

RONALD DEIBERT: Absolutely. It’s effectively a very powerful wiretap. It can also be used to spoof messages, to read encrypted messages. In fact, a lot of the inspiration or the driving force for this type of service, this type of technology, comes from the fact that a lot of people are using end-to-end encrypted communications for chat messages, for email. And that drives those who want to intercept those communications to try to get inside the device. So this spyware has become very popular, very lucrative for the companies that sell it to government agencies.

AMY GOODMAN: I want to bring in Stephanie Erin Brewer in Mexico City. You’re a human rights attorney at Centro Prodh. Explain what the case is that we’re talking about, for those who are not familiar with the case of the 43 students from Ayotzinapa teachers’ college who were disappeared in 2014, and then how Pegasus spyware affected your work.

STEPHANIE ERIN BREWER: Well, in September of 2014, a group of police, in collusion with organized crime in the southern Mexican state of Guerrero, forcibly disappeared 43 students, students, as you say, who were training to be teachers. Three other students were killed, and there were a variety of other human rights violations committed the night of September 26th to 27th. And it’s important to say that this case is paradigmatic, on one hand, of the phenomenon of enforced disappearance in the country. We’re talking about a country where more than 32,000 people are currently missing or disappeared. And it’s also paradigmatic of a phenomenon that we call macrocriminality, which is to say, the people who participated in these disappearances were not simply organized crime or not simply private actors. They were police, and they were officials from all three levels of government, so municipal, state and federal level. This case remains unsolved. It remains unpunished. The families of the 43 students have spent the past now almost three years tirelessly searching for their children.

And because of the scale of this disappearance and the outrage that it provoked both nationally and internationally, the Inter-American Commission on Human Rights, which is our regional human rights commission, named a group of international experts, some of the best-known human rights investigators and lawyers and prosecutors from different countries in the region, to come to Mexico. And it’s important to say that the Mexican government accepted and even invited this group to come and to help in the investigation. And it’s only thanks to the investigation carried out by those international investigators that we were able to learn some of the facts of what happened that night, that we were able to learn that the Mexican federal government—specifically, the federal Attorney General’s Office—had put forth a completely false version of the case, saying that all the students had been killed and burned, cremated, that night, along with all their belongings. And we were able to show that that was scientifically impossible, thanks to the work of this international group.

So what we have now—as we’ve been discussing on this show, what we have now is proof that the Mexican government, instead of investing its time and resources in clearing up this case, in finding the students and explaining what happened and punishing those responsible, has instead invested its resources—and we’re speaking of hundreds of thousands or even millions of dollars—in spying on the lawyers, who represent these family members, and on the international experts, who came here with diplomatic immunity to aid the Mexican government in clearing up this horrendous crime.

AMY GOODMAN: [inaudible] you, how you were spied on? Explain how you were spied on.

STEPHANIE ERIN BREWER: So, in—so, in my case, I received the message in May of last year, which fits exactly into the pattern that’s already been described by Citizen Lab. And so, what this tells me is that apparently the Mexican government feels that its enemy is someone like me, who is a human rights lawyer, who’s representing not only the families in this case, also people in other paradigmatic cases that are being litigated, including in the Inter-American Court of Human Rights. And so, someone who’s seeking to strengthen the rule of law, who’s seeking justice for people who have been victims and survivors of some of the most serious and terrible crimes that can be imagined, apparently, I am the one, and my colleagues, being identified as a problem or as enemies of the administration, instead of the human rights violators or instead of the organized criminal groups, against whom this software is meant to be used when it’s sold to the government and who are responsible for Mexico’s warlike levels of violence in some regions of the country.

AMY GOODMAN: Ronald Deibert, it’s—you know, it’s hard for people to grasp all of this, laypeople, especially when there’s lots of alphabet soup involved. But you mentioned the NSO Group, the company behind the Pegasus technology. If you, very quickly, can talk about who some of their clients are and the majority owner of NSO Group, Francisco Partners?

RONALD DEIBERT: Sure. So, NSO Group—you know, you ask about their clients. I mean, that’s part of the question of the research that we’re engaged in at Citizen Lab, is to find out precisely that. And what we find is a pretty disturbing picture.

I should underline, first of all, that the makers and the sellers of this type of technology can be likened to the arms trade or private military contractors. So they don’t advertise their clients. They don’t even advertise their products. If you Google NSO Group, you’ll likely find links to Citizen Lab reporting rather than anything from the company itself. That’s precisely because they operate beneath the surface, in this kind of shadowy market to intelligence and law enforcement agencies.

What we have been able to determine, based on our research looking at technical indicators that we’re able to gather, is that they’re selling to some governments, like Mexico and other governments, that are either flawed democracies, authoritarian regimes, governments that lack public accountability and oversight. The majority owner, Francisco Partners, they’re an investment company that owns quite a few technology companies. Not all of them are in this category, but at least a couple of others certainly are. I would say Procera Technologies, which is a company that supplies surveillance technology, was recently implicated in the abuse of surveillance in Turkey.

Overall, this marketplace—this case that we’re seeing here in Mexico is symptomatic of a much larger global problem, where you have this type of very powerful, highly invasive technology being sold by companies for tens of millions of dollars to governments that are using them without checks and balances, typically targeting opposition members, lawyers—even, in this case, health advocates in an international investigation. There really needs to be a concerted global effort to better control and regulate the market for commercial spyware.

AMY GOODMAN: Well, Ronald Deibert, I want to thank you for being with us, director of the Citizen Lab. We’re going to do Part 2 of our conversation after the show and post it at democracynow.org, to see where Pegasus is used around the world, in places like the United Arab Emirates and other places. And Stephanie Erin Brewer, thanks so much for being with us from Mexico City, human rights attorney at Centro Prodh, involved in the case of the 43 students at the Ayotzinapa teachers’ college who were disappeared in 2014. She herself was spied on. And we have this conversation on the day of action around protecting the internet to keep it open and free.