More than a year after Mexican journalist and writer Javier Valdez was murdered, the details of his case are finally coming to light. Towards the end of 2019, a new wrinkle emerged: Just one day after Valdez's death, two of his colleagues received mobile phone messages infected with the surveillance software Pegasus.
Javier Valdez was a dedicated journalist who, among other things, covered stories about corruption, impunity and organized crime for the independent media outlet Ríodoce, which he co-founded in Culiacán, Sinaloa (a disputed territory that both the Jalisco Cartel and the Sinaloa Cartel claim). On May 17, 2017 Valdez was shot 12 times in broad daylight, just outside Ríodoce's offices.
According to a research report by the Digital Rights Defense Network (R3D) and a partnership of international NGOs, both Ismael Bojórquez (director of Ríodoce) and its director of information, Andrés Villarreal, suffered hacking attempts on their cell phones via text message.
Combined with other cases that we have reported previously, this amounts to a total of 28 cases of attempted infection with Pegasus, against various journalists, activists, and human rights defenders in the country.
The report, jointly researched by Article 19, Digital Rights Advocacy Network (R3D), SocialTIC and the University of Toronto's Citizen Lab, shows how journalists have been detected as targets of espionage through such malware:
Journalists and civic media have been a favorite target of government users of NSO Group spyware. Pictured below is a list of journalists @citizenlab has identified targeted with Pegasus. https://t.co/8j6fTVOoqk pic.twitter.com/PSA2KZTQ7S
— profdeibert (@RonDeibert) November 27 2018
Attempts to infect Valdez's colleagues followed a similar procedure to other attacks with Pegasus. The messages were received via SMS, and were allegedly sent by a popular news service called “UnoTV”. The content was difficult to ignore — particularly since the messages referencing the then-recent murder of Valdez and significant related events.
At the end of each message there was a suspicious link that, when clicked, would immediately install the surveillance software or spyware. This allowed the spyware to monitor any information hosted on the device and even take control of the microphone and camera.
One of the most noteworthy conclusions of the report was that there seemed to be a common attacker in all cases, given the methods of infection and the use of the same infrastructure. Moreover, it was noted that the software was used in situations affecting Peña Nieto's outgoing administration.
Pegasus is a sophisticated tool sold exclusively to government agencies. The technology was acquired by the Mexican government in 2014 and 2015 for the alleged purpose of fighting organized crime. As such, this series of revelations is now colloquially referred to online under the label #GobiernoEspía (#SpyGovernment in English).
The report listed their most recent findings alongside other uses of spyware in Mexico. With this information in hand, the organizations involved called on the new government to ensure an independent investigation into government use of surveillance software. They asked officials to carry out a comprehensive reform of the possession and use of surveillance systems by the government:
With this seventh publication on abuses of NSO Group spyware in Mexico, Citizen Lab and our partners R3D, SocialTic, and Article 19 have identified a total of 24 cases of abusive targeting by Mexico-linked NSO Group customers. Our previous investigations identified infection attempts against multiple journalists, lawyers, international investigators, public health practitioners, senior politicians, and anti-corruption activists.
‘It's as if we have a target on our backs’
A correspondent for media outlets AFP and La Jornada, and a co-founder of Ríodoce, Javier Valdez was a prolific writer who wrote at least nine books on drug trafficking in Mexico, always putting victims at the center of his stories. He was credited with numerous awards, including the 2011 International Freedom of the Press Prize, awarded by the Committee to Protect Journalists (CPJ). At the awards ceremony, Valdez said:
Ahora en Culiacán, Sinaloa, es un peligro estar vivo; y hacer periodismo es caminar sobre una invisible línea marcada [por los que están en el narcotráfico y en el gobierno] en un piso filoso y lleno de explosivos. Esto se vive en casi todo el país. Uno debe cuidarse de todo y de todos; no parece haber opciones ni salvación y muchas veces no hay a quién acudir […] Esta es una guerra, sí […] por el control del narco. Pero nosotros, los ciudadanos, ponemos los muertos; y los gobiernos de México y Estados Unidos las armas. Y ellos, los encumbrados invisibles y agazapados dentro y fuera de los gobiernos, se llevan las ganancias…
Right now in Culiacán, Sinaloa, it dangerous to be alive, and to be a journalist is to walk on an invisible line drawn [by those inside drug trafficking and the government] on a sharp floor full of explosives. This is the case in most of the country. One must protect oneself from everything and everyone. There seems to be no option or salvation, and often times there is no one to turn to […] Yes, this is a war […] for the control of drug trafficking. But we, the citizens, supply the dead, while Mexico and the United States supply the weapons. And they, the ones that are invisible but high above, crouching in and out of those governments, take all the profits for themselves…
After more than two decades of pursuing critical journalism, Javier Valdez became an exemplar, on a national and international level, on issues related to the violence that is devastating the northern part of the country. Many thought that this would protect him, but it did not.
The journalists’ guild showed profound indignation in response to Valdez's death, through protests, acts of denunciation, and labor strikes throughout the country.
The assassination also marked a breaking point for journalism in Mexico, as Froylán Enciso described in an essay for Horizontal, a digital media outlet:
Si matan a Javier Valdez, nuestro querido Javier, el más conocido, el más premiado, el más divertido, el más protegido del gremio: ¿qué puede esperar el resto? Es como si a todos nos hubieran puesto un blanco en el pecho.
If they killed Javier Valdez, our beloved Javier, the most well-known, most acclaimed, most fun and most protected member in the field, what can the rest of us expect? It is as if we all have a target on our backs.
On this note, the organizations that are reporting on #SpyGovernment cases see it as a positive sign that current president Andrés Manuel López Obrador recently stated at a press conference that his government will not engage in such practices. However, those declarations will not be much of a guarantee if crimes against journalists remain unpunished.