Netizen Report: Mexican NGOs Push for Independent Investigation of Malware Attacks · Global Voices
Netizen Report Team

Cartoon by Doaa Eladl via Flickr, Web We Want ( CC BY-SA 2.0)
The Mexican government has failed to investigate allegations that government agencies used surveillance software to infect the smartphones of journalists and human rights advocates in the country, according to an official statement from groups affected by the software.
In June 2017, a group of experts revealed evidence of 76 incidents of journalists and human rights defenders being targeted with a surveillance software product called Pegasus, which is manufactured by NSO Group, an Israeli firm. Pegasus allows the attacker to access and monitor the victim’s mobile phone communications and activities. These incidents were documented by Article 19, the University of Toronto's Citizen Lab and Mexico City-based NGOs R3D and SocialTIC.
After the New York Times reported on the findings, President Enrique Peña Nieto asked the Attorney General’s office to respond to the allegations. The groups say that since June 2017, authorities have not sought documentation concerning the use of the software, nor have they investigated its technical deployments or interviewed any government employee who was trained to use the software.
They are now calling for an independent investigation of the findings, arguing that the Attorney General’s office is unable to do this, due to evidence that it was the agency that purchased the malware to begin with. And while the Mexican government has not yet to carry out a thorough investigation on its own, it has asked the US government to assist in the process — a request the US officials have rebuffed.
This is the latest update in a series of revelations and investigations into the use of surveillance software in Mexico that date back to 2013. Policymakers advocating for stronger public health policies and experts investigating the disappearances of 43 students in Ayotzinapa also have been among those targeted.
Nabeel Rajab, the outspoken leader of the Bahrain Center for Human Rights, was sentenced to five years in prison on February 21, over a series of tweets that prosecutors claimed were “insulting to national institutions” and “insulting to neighboring countries.” In the tweets, Rajab criticized Saudi Arabia’s position in Yemen’s civil war and also pointed to evidence of torture and ill treatment in Bahrain’s Jaw prison published by Human Rights Watch.
Malaysian cartoonist Fahmi Reza was prosecuted and found guilty of “uploading false communication” after he posted on Facebook a hand-painted cartoon of Malaysian Prime Minister Datuk Seri Najib Razak wearing clown makeup. In a subsequent post about the case, he wrote:
“Painting the portrait of the PM with an evil clown make-up over his face was an at of protest against this corrupt government that uses the Sedition Act and other draconian laws to silence dissenting voices.”
He has been sentenced to one month in prison and a RM30,000 fine, as per Section 233 of the 1998 Multimedia and Communications Act. His lawyer intends to appeal the case.
Kashmiri photojournalist Kamran Yousuf has been behind bars for 150 days, after being arrested in September 2017. He was finally charged on January 18 with being associated with “funding of terror and anti-state activities in the Kashmir Valley.” His charge sheet also claims that he has not met the “moral duty of a journalist” for having neglected to cover any “social/developmental activity by the state government or Government of India.”
Yousuf rose to fame last year after his photos and videos of funeral processions and stone pelting battles went viral on social media, regularly receiving tens of thousands of views and shares. The Press Council of India has expressed concern about his detention. The Kashmir Editors Guild and the Committee to Protect Journalists have called for his release.
Police in Macedonia pressed charges against a person who took photos of on-duty police officers during local elections and then posted them on Facebook. The photographer posted 30 photos, as part of an effort to demonstrate evidence of possible irregularities in the electoral process. The Basic Court of Gevgelija found the person guilty of “abuse of personal data” and issued a suspended sentence of three months in prison. The person, identified only by their initials K.K., is appealing the decision.
Six Turkish journalists were issued lifetime prison sentences for “attempting to overthrow the constitutional order” on the same day Turkish-German journalist Deniz Yucel was released after spending a year behind bars without charges. Yucel was arrested on suspicion of “inciting the people to racial hatred and enmity” and “spreading the propaganda of a terrorist organization.” His release came shortly after the Turkish Prime Minister’s visit to Germany. There are currently 155 journalists serving jail time in Turkey.
On February 16, a 22-year-old man in Spain was sentenced to two and a half years in prison by the country's Supreme Court for publishing tweets in 2015 and 2016 that “incited hate against women.” One of the tweets that authorities singled out read, “And 2015 will end with 56 women murdered, it's not a good record but was all that could be done, let's see if in 2016 we can double that figure, thanks.” The man had previously been sentenced to two years imprisonment for those tweets and for others that authorities said “glorified terrorism.” On review, the Supreme Court absolved the terrorism-related conviction, saying the tweets were “generic,” but increased the punishment for the anti-women messages.
The National Telecommunications Commission of Venezuela has expanded the (already long) list of personal data necessary to access telephone services in the country. It also has lengthened the period of time that operators should retain the data, from three months after a contract expires to five years.
The new rule makes Venezuela one of the countries with the longest data retention periods in Latin America, alongside Colombia. In addition to an identity document, signature, fingerprint, and complete name and address, users must now also disclose their email address, be photographed, and have their fingerprint taken with a biometric device. The commission said telephone operators should digitize the data collected, but did not specify how it should be protected, only that operators and the state's security apparatus should define the conditions for proper storage and treatment.
CORRECTION [March 13, 2018]: The original version of this report described the Basic Court of Gevgelija as having issued a sentence of three months in prison to the defendant in the case in Macedonia. The report has since been corrected to show that the sentence was suspended.
Afef Abrougui, Ellery Roberts Biddle, Marianne Diaz, L. Finch, Rohith Jyothish, Rezwan Islam, Inji Pennu, Karolle Rabarison, Elizabeth Rivera, Juke Carolina Rumuat and Sarah Myers West contributed to this report.