Cyberwar (2016) s02e08 Episode Script
Mexico's War on Watchdogs
1 BEN: Government-owned spyware found on the phones of Mexican journalists They would use it to spy on journalists, use it to spy on politicians, and on defenders of human rights.
tech meant for the War on Drugs.
But if the cartels are as powerful as the authorities then being spied on may be the least of their problems.
The line between authorities and organized crime is at best blurry, many times non-existent.
Since 2006, the Mexican government has been locked in a deadly war with drug cartels.
By some estimates, more than 100,000 people have been killed since that conflict began.
By 2011, the Mexican government began buying Pegasus, the $80 million suite of surveillance malwares meant to hunt cartels.
Then something freaky happened.
Pegasus started showing up on the cellphones of government critics: journalists, activists, and human rights lawyers.
So who is the Mexican government really spying on: the cartels, or the groups that expose government wrongdoing? I m in Mexico City to meet the people targeted with Pegasus.
If journalists and activists are under surveillance, could this be a warning sign for people in any country where the government owns spyware? So I have some American sources who ve told me off the record that they know that Mexican authorities use some of this malware to target their political opponents, but they turned a blind eye as long as they're going after specific targets in the War on Drugs.
More than 50 Mexican journalists have been murdered since the drug war started in 2006, and 10 so far this year.
Most of these crimes are unsolved, and reporters here know that their next story could be their last.
That's why, with evidence suggesting the Mexican government is behind the spying, I need to dig deeper.
I know that shedding light on this story may be the best way to help protect those reporters.
To learn more about the malware used against the journalists and why they were targeted, I ve contacted Luis Fernando Garcia, Founder and Executive Director of R3D, an organization advocating on human rights in the digital space, and one of the first to address the abuses of Pegasus in Mexico.
So to you, what made the Pegasus malware sophisticated? Pegasus is a sophisticated malware because it s supposed to be, and it actually is difficult to detect.
The other thing is the extent of the surveillance that Pegasus is able to facilitate.
This is actually like a spy in your pocket.
It s someone following you everywhere, to your bathroom, to your kitchen, listening to everything you say, everything you type, everything you click.
Why don t you explain to me exactly how this NSO malware worked.
They send SMS messages that are tailored for the objective, and they try to make you click on a link.
So it was actually specified to the target.
Exactly, it has the name sometimes.
Then it gets darker.
For example, one of the more disturbing ones are your daughter - and the name of the daughter - just had an accident, and here are the details of the hospital she s in, for example.
So it tried to make you click on the link, and then once you click on the link, you get infected with some malware.
Once Pegasus was installed on a phone, not only could it monitor every call, it could also activate the microphone and camera at any time, picking up conversations in any room where the phone happened to be.
It could read every text, every email, and record every keystroke, picking up passwords and even encrypted messages.
And it could use the built-in GPS to follow a target everywhere they went.
What do you think the Mexican government was even doing with this intelligence? They can try to create obstacles for your strategies, for example, as a human rights group.
They can find your sources as a journalist.
They can find some dirty laundry and do some extortion on you.
They can even use that intelligence to actually harm you, to actually kill you.
And Mexico is one of the most dangerous places for journalists.
There's been journalists killed in record levels this year.
Human rights defenders are killed all the time.
So essentially, to be targeted by the Mexican government in this way is a pretty dangerous thing, if you find yourself on that kind of list.
Yeah, it s dangerous.
There s probably a lot of people that are that make it to this list, and they're just killed.
Mexico s president, Enrique Peña Nieto, denies using Pegasus against his critics, though he did admit acquiring it from NSO Group, an Israeli company that sells spyware to government agencies.
But once sold, NSO says it has no way of monitoring how their software is wielded.
So the Mexican government's been accused of buying and using basically the AK-47 of cellphone spying, and I m about to meet somebody who you wouldn t expect to be the victim of it.
This is Carmen Aristegui.
She's considered Mexico's Anderson Cooper.
And somehow, magically, Pegasus malware was on her phone.
Both she and her teenage son received personalized phishing texts after Aristegui broke what became known as the White House Scandal, involving Mexico s president receiving preferential treatment from one of the government's top contractors.
So why don't you explain to me from the beginning, when you got these strange text messages, what did you think of them? I mean, how does that make you feel, knowing that your government is treating you that way? Do you have any idea who it was in the government? Like what agency was spying on you? Do you fear for your life now? Aristegui thinks there s no question she and her son were singled out for her part in exposing government corruption.
She s not the only one.
My next source was targeted with Pegasus while proving his government was involved in the tragic disappearance and presumed murder of more than 40 students.
BEN: I m in Mexico City investigating the government's alleged use of powerful surveillance malware against its critics.
And it s not just journalists who were targeted: activists and lawyers were targets too.
So these are the images of 43 students who were alleged to have been murdered by cartel members.
It s a bit of a political cover up and scandal here in Mexico, and one of the men investigating it is actually the victim of government spying.
Mario Patrón is a lawyer and the director of one of the most respected human rights organizations in the country.
He was targeted by Pegasus after his team uncovered evidence suggesting that Mexican law enforcement, and even federal authorities, were involved in the disappearance of the students.
Patrón believes the cartels and the government are closely connected.
Like they could pass it to the cartels? This whole situation and story is really fishy, because you're a guy who works daily to expose human rights abuses in this country, and you were investigating the 43 students who were killed, which by all accounts is a really insidious, disgusting event.
I was reading that there was reason to believe that the cartels were also interested in keeping this 43 thing as quiet as possible.
Do you think that there was any possibility that the cartels were directing some of the spying through the government? So is it fair to say then in this country that the cartels and the government are basically one in the same? But if the government and the cartels are as closely connected as Patrón thinks they are, did anyone ever intend to use Pegasus to track cartel members? And is malware even an effective way to fight cartels to begin with? To get answers, I m going to one of the hottest regions of the current drug war, the state of Michoacan.
This is the town of Tepalcatepec, where the local citizens are the key to keeping the cartels at bay.
I really wanna figure out what the security situation is here in Michoacan, so I contacted a rural defense force made up of citizens, and one of their members has agreed to talk to me about what the level of cartel danger is here in this region.
Meet Jesus Carrillo, a volunteer with Defensas Rurales, a federal military defence force.
He claims his group is helping keep the town free from the violence of the cartels.
So you as citizens took up arms against the cartels yourselves? What s the security situation going on right now in this region? And obviously in nearby areas, there is some some level of violence from cartels.
Are you afraid of that sometimes spilling over into this region? Do you feel like the cartels are kind of like a shadow state to the actual government, and they re just as powerful? If Mario and Jesus are right, parts of the Mexican government work alongside the cartels, or are subservient to them.
And then it s possible the powerful cyberweapon Pegasus could be under the control of some of the most violent criminal organizations on the planet.
BEN: I m in Michoacan, Mexico, investigating government spying on journalists.
The malware used for it was purchased by the feds with the idea to fight the War on Drugs, but I m wondering if cartels even use devices like cellphones that can be hacked.
Aye! (SIGHING) So Jesus is about to take us to an anti-cartel blockade or checkpoint manned by some of the same security forces he was talking about.
Now does everybody communicate? I heard that the radio systems in town, that s how everyone talks.
The narcos, what kinds of radio networks do they use to communicate with each other? Or do they use something that s way more complex? If the cartels are using something as rudimentary as radios to communicate, it s hard to see how cellphone malware like Pegasus would even be worth it.
But maybe it s different in the cities.
So I m heading to Guadalajara, the centre of activity for CJNG, what the US government now considers Mexico s most powerful cartel.
So I scored an interview with the chief of police of Guadalajara, and what I m really trying to figure out is whether or not local police forces here in Mexico are using software to surveil and track cartels, or whether or not he ll even admit to it.
Does your department use anything like software to surveil and find cartels? So you have to wonder: if the police chief of the one of the biggest cities in Mexico, that deals with the most powerful and upstart cartel in all of Mexico, is not using these technologies to track them because he says his police force isn t even capable of it, then why is the government buying these things in the first place? He also says that the cartels are using them, so I m going to try to find out of that s true.
Sources have told me that the weapons and technology the Mexican government buys sometimes end up in the hands of cartels.
And if you re a hacker in cartel country, you may also end up in the pocket of the bad guys.
This is Software, a hacker from Michoacan who gained notoriety after breaking into a high-ranking cartel member s cellphone and posting pictures of his girlfriend online, something that almost got him killed.
Software understands the cartels, and says they re becoming more tech savvy.
And even if cartel members don t use smartphones themselves, they sometimes hire hackers to track their enemies who do.
Do you know of any hackers that have been hired by cartels before? What kinds of things were they asked to do? So the government says that they're buying stuff like Pegasus so they can track criminals, but do you think cartels can actually evade that type of technology already? So the cartels are in fact using hackers.
Even if they don t have Pegasus, the Mexican government does, and it s hard to know what s stopping the narcos from leaning on their contacts in the administration to give them intel on anyone they want.
That relationship between government and cartels is a fascinating one, and I wanna know how it relates to Pegasus, so I m going back to Mexico City.
BEN: I m in Mexico city investigating government spying on journalists.
So far, no one s been able to tell me if Pegasus, the malware used in the surveillance, was ever actually used on cartel targets.
Jesús Esquivel might have the answers.
He s the Washington correspondent for the magazine Proceso, and an expert on Mexico s War on Drugs.
You being a cartel, War on Drugs reporter who's been in the thick of it, what do you make of cartels being tracked with those types of tools? Something like Pegasus? It's impossible.
Why? The narcos, they don't use smartphones.
They just use the most rustic or simple cellular phone, and Pegasus works only if you open a link.
They use the phones just for communication.
So just like a Nokia flip phone kinda thing? Yeah, they talk to one and they destroy the phone.
So they just have tons of these phones? Absolutely! (LAUGHING) A lot! Why do you think they're still on the market? In Mexico, at least? And if you go to any border, it's a lot of those phones on the streets.
So to evade surveillance, they just go to the most basic shit possible? They are smart people.
They know how those intelligence agencies from the Mexican side, from the US side track you.
Do they ever hire hackers for anything? Yes, yes they do that, but only for the money.
Not for the business or coordinating the transport and buying drugs or arms.
No, no.
If there's one thing I've learned in Mexico so far, it's that the government and the cartels are almost indistinguishable.
Ah, they always they always work together.
So given that level of collusion, if some agencies in Mexico had hacking tools and were collecting intelligence, could they collect intelligence or at least share it with cartels that they seem so in bed with already? Probably.
They know when the government has a new "toy", as they say.
The cartels know everything.
If Esquivel is right and the cartels know what the government knows, then any intel gleaned by Pegasus is possibly in the hands of cartels.
And grilling the Mexican government on that fact? Not easy.
So I ve reached out to so many Mexican government agencies to get them to comment on NSO, and absolutely not one official will do it.
And at this point, I just don t think it s gonna happen whatsoever.
It s not surprising.
Ever since the Pegasus scandal broke, the government has played innocent, even in the face of damning evidence.
There s no independent oversight body within Mexico, so it s unlikely the administration will ever have to answer for its spying.
That means if there s ever going to be an investigation, making that happen is up to the international community.
Mexico is under a human rights crisis.
The line between authorities and organized crime is at best blurry, many times non-existent.
There s definitely some responsibility outside of Mexico for propping up this fraudulent scheme.
I mean, how confident are you that they're even going to give you any justice at any point? 'Cause that would require them to look at themselves and also prosecute some people who are involved in this.
Many of the journalists and lawyers we spoke to were grateful we were even covering this story.
They know Mexico needs international pressure to make sure their government is held accountable, and they know their lives are at risk.
But this issue isn t confined to Mexico.
Around the world in Turkey, Russia, even in the US and my home in Canada, reporters are being targeted by the authorities.
So in other words, we ve all gotta watch each others backs.
tech meant for the War on Drugs.
But if the cartels are as powerful as the authorities then being spied on may be the least of their problems.
The line between authorities and organized crime is at best blurry, many times non-existent.
Since 2006, the Mexican government has been locked in a deadly war with drug cartels.
By some estimates, more than 100,000 people have been killed since that conflict began.
By 2011, the Mexican government began buying Pegasus, the $80 million suite of surveillance malwares meant to hunt cartels.
Then something freaky happened.
Pegasus started showing up on the cellphones of government critics: journalists, activists, and human rights lawyers.
So who is the Mexican government really spying on: the cartels, or the groups that expose government wrongdoing? I m in Mexico City to meet the people targeted with Pegasus.
If journalists and activists are under surveillance, could this be a warning sign for people in any country where the government owns spyware? So I have some American sources who ve told me off the record that they know that Mexican authorities use some of this malware to target their political opponents, but they turned a blind eye as long as they're going after specific targets in the War on Drugs.
More than 50 Mexican journalists have been murdered since the drug war started in 2006, and 10 so far this year.
Most of these crimes are unsolved, and reporters here know that their next story could be their last.
That's why, with evidence suggesting the Mexican government is behind the spying, I need to dig deeper.
I know that shedding light on this story may be the best way to help protect those reporters.
To learn more about the malware used against the journalists and why they were targeted, I ve contacted Luis Fernando Garcia, Founder and Executive Director of R3D, an organization advocating on human rights in the digital space, and one of the first to address the abuses of Pegasus in Mexico.
So to you, what made the Pegasus malware sophisticated? Pegasus is a sophisticated malware because it s supposed to be, and it actually is difficult to detect.
The other thing is the extent of the surveillance that Pegasus is able to facilitate.
This is actually like a spy in your pocket.
It s someone following you everywhere, to your bathroom, to your kitchen, listening to everything you say, everything you type, everything you click.
Why don t you explain to me exactly how this NSO malware worked.
They send SMS messages that are tailored for the objective, and they try to make you click on a link.
So it was actually specified to the target.
Exactly, it has the name sometimes.
Then it gets darker.
For example, one of the more disturbing ones are your daughter - and the name of the daughter - just had an accident, and here are the details of the hospital she s in, for example.
So it tried to make you click on the link, and then once you click on the link, you get infected with some malware.
Once Pegasus was installed on a phone, not only could it monitor every call, it could also activate the microphone and camera at any time, picking up conversations in any room where the phone happened to be.
It could read every text, every email, and record every keystroke, picking up passwords and even encrypted messages.
And it could use the built-in GPS to follow a target everywhere they went.
What do you think the Mexican government was even doing with this intelligence? They can try to create obstacles for your strategies, for example, as a human rights group.
They can find your sources as a journalist.
They can find some dirty laundry and do some extortion on you.
They can even use that intelligence to actually harm you, to actually kill you.
And Mexico is one of the most dangerous places for journalists.
There's been journalists killed in record levels this year.
Human rights defenders are killed all the time.
So essentially, to be targeted by the Mexican government in this way is a pretty dangerous thing, if you find yourself on that kind of list.
Yeah, it s dangerous.
There s probably a lot of people that are that make it to this list, and they're just killed.
Mexico s president, Enrique Peña Nieto, denies using Pegasus against his critics, though he did admit acquiring it from NSO Group, an Israeli company that sells spyware to government agencies.
But once sold, NSO says it has no way of monitoring how their software is wielded.
So the Mexican government's been accused of buying and using basically the AK-47 of cellphone spying, and I m about to meet somebody who you wouldn t expect to be the victim of it.
This is Carmen Aristegui.
She's considered Mexico's Anderson Cooper.
And somehow, magically, Pegasus malware was on her phone.
Both she and her teenage son received personalized phishing texts after Aristegui broke what became known as the White House Scandal, involving Mexico s president receiving preferential treatment from one of the government's top contractors.
So why don't you explain to me from the beginning, when you got these strange text messages, what did you think of them? I mean, how does that make you feel, knowing that your government is treating you that way? Do you have any idea who it was in the government? Like what agency was spying on you? Do you fear for your life now? Aristegui thinks there s no question she and her son were singled out for her part in exposing government corruption.
She s not the only one.
My next source was targeted with Pegasus while proving his government was involved in the tragic disappearance and presumed murder of more than 40 students.
BEN: I m in Mexico City investigating the government's alleged use of powerful surveillance malware against its critics.
And it s not just journalists who were targeted: activists and lawyers were targets too.
So these are the images of 43 students who were alleged to have been murdered by cartel members.
It s a bit of a political cover up and scandal here in Mexico, and one of the men investigating it is actually the victim of government spying.
Mario Patrón is a lawyer and the director of one of the most respected human rights organizations in the country.
He was targeted by Pegasus after his team uncovered evidence suggesting that Mexican law enforcement, and even federal authorities, were involved in the disappearance of the students.
Patrón believes the cartels and the government are closely connected.
Like they could pass it to the cartels? This whole situation and story is really fishy, because you're a guy who works daily to expose human rights abuses in this country, and you were investigating the 43 students who were killed, which by all accounts is a really insidious, disgusting event.
I was reading that there was reason to believe that the cartels were also interested in keeping this 43 thing as quiet as possible.
Do you think that there was any possibility that the cartels were directing some of the spying through the government? So is it fair to say then in this country that the cartels and the government are basically one in the same? But if the government and the cartels are as closely connected as Patrón thinks they are, did anyone ever intend to use Pegasus to track cartel members? And is malware even an effective way to fight cartels to begin with? To get answers, I m going to one of the hottest regions of the current drug war, the state of Michoacan.
This is the town of Tepalcatepec, where the local citizens are the key to keeping the cartels at bay.
I really wanna figure out what the security situation is here in Michoacan, so I contacted a rural defense force made up of citizens, and one of their members has agreed to talk to me about what the level of cartel danger is here in this region.
Meet Jesus Carrillo, a volunteer with Defensas Rurales, a federal military defence force.
He claims his group is helping keep the town free from the violence of the cartels.
So you as citizens took up arms against the cartels yourselves? What s the security situation going on right now in this region? And obviously in nearby areas, there is some some level of violence from cartels.
Are you afraid of that sometimes spilling over into this region? Do you feel like the cartels are kind of like a shadow state to the actual government, and they re just as powerful? If Mario and Jesus are right, parts of the Mexican government work alongside the cartels, or are subservient to them.
And then it s possible the powerful cyberweapon Pegasus could be under the control of some of the most violent criminal organizations on the planet.
BEN: I m in Michoacan, Mexico, investigating government spying on journalists.
The malware used for it was purchased by the feds with the idea to fight the War on Drugs, but I m wondering if cartels even use devices like cellphones that can be hacked.
Aye! (SIGHING) So Jesus is about to take us to an anti-cartel blockade or checkpoint manned by some of the same security forces he was talking about.
Now does everybody communicate? I heard that the radio systems in town, that s how everyone talks.
The narcos, what kinds of radio networks do they use to communicate with each other? Or do they use something that s way more complex? If the cartels are using something as rudimentary as radios to communicate, it s hard to see how cellphone malware like Pegasus would even be worth it.
But maybe it s different in the cities.
So I m heading to Guadalajara, the centre of activity for CJNG, what the US government now considers Mexico s most powerful cartel.
So I scored an interview with the chief of police of Guadalajara, and what I m really trying to figure out is whether or not local police forces here in Mexico are using software to surveil and track cartels, or whether or not he ll even admit to it.
Does your department use anything like software to surveil and find cartels? So you have to wonder: if the police chief of the one of the biggest cities in Mexico, that deals with the most powerful and upstart cartel in all of Mexico, is not using these technologies to track them because he says his police force isn t even capable of it, then why is the government buying these things in the first place? He also says that the cartels are using them, so I m going to try to find out of that s true.
Sources have told me that the weapons and technology the Mexican government buys sometimes end up in the hands of cartels.
And if you re a hacker in cartel country, you may also end up in the pocket of the bad guys.
This is Software, a hacker from Michoacan who gained notoriety after breaking into a high-ranking cartel member s cellphone and posting pictures of his girlfriend online, something that almost got him killed.
Software understands the cartels, and says they re becoming more tech savvy.
And even if cartel members don t use smartphones themselves, they sometimes hire hackers to track their enemies who do.
Do you know of any hackers that have been hired by cartels before? What kinds of things were they asked to do? So the government says that they're buying stuff like Pegasus so they can track criminals, but do you think cartels can actually evade that type of technology already? So the cartels are in fact using hackers.
Even if they don t have Pegasus, the Mexican government does, and it s hard to know what s stopping the narcos from leaning on their contacts in the administration to give them intel on anyone they want.
That relationship between government and cartels is a fascinating one, and I wanna know how it relates to Pegasus, so I m going back to Mexico City.
BEN: I m in Mexico city investigating government spying on journalists.
So far, no one s been able to tell me if Pegasus, the malware used in the surveillance, was ever actually used on cartel targets.
Jesús Esquivel might have the answers.
He s the Washington correspondent for the magazine Proceso, and an expert on Mexico s War on Drugs.
You being a cartel, War on Drugs reporter who's been in the thick of it, what do you make of cartels being tracked with those types of tools? Something like Pegasus? It's impossible.
Why? The narcos, they don't use smartphones.
They just use the most rustic or simple cellular phone, and Pegasus works only if you open a link.
They use the phones just for communication.
So just like a Nokia flip phone kinda thing? Yeah, they talk to one and they destroy the phone.
So they just have tons of these phones? Absolutely! (LAUGHING) A lot! Why do you think they're still on the market? In Mexico, at least? And if you go to any border, it's a lot of those phones on the streets.
So to evade surveillance, they just go to the most basic shit possible? They are smart people.
They know how those intelligence agencies from the Mexican side, from the US side track you.
Do they ever hire hackers for anything? Yes, yes they do that, but only for the money.
Not for the business or coordinating the transport and buying drugs or arms.
No, no.
If there's one thing I've learned in Mexico so far, it's that the government and the cartels are almost indistinguishable.
Ah, they always they always work together.
So given that level of collusion, if some agencies in Mexico had hacking tools and were collecting intelligence, could they collect intelligence or at least share it with cartels that they seem so in bed with already? Probably.
They know when the government has a new "toy", as they say.
The cartels know everything.
If Esquivel is right and the cartels know what the government knows, then any intel gleaned by Pegasus is possibly in the hands of cartels.
And grilling the Mexican government on that fact? Not easy.
So I ve reached out to so many Mexican government agencies to get them to comment on NSO, and absolutely not one official will do it.
And at this point, I just don t think it s gonna happen whatsoever.
It s not surprising.
Ever since the Pegasus scandal broke, the government has played innocent, even in the face of damning evidence.
There s no independent oversight body within Mexico, so it s unlikely the administration will ever have to answer for its spying.
That means if there s ever going to be an investigation, making that happen is up to the international community.
Mexico is under a human rights crisis.
The line between authorities and organized crime is at best blurry, many times non-existent.
There s definitely some responsibility outside of Mexico for propping up this fraudulent scheme.
I mean, how confident are you that they're even going to give you any justice at any point? 'Cause that would require them to look at themselves and also prosecute some people who are involved in this.
Many of the journalists and lawyers we spoke to were grateful we were even covering this story.
They know Mexico needs international pressure to make sure their government is held accountable, and they know their lives are at risk.
But this issue isn t confined to Mexico.
Around the world in Turkey, Russia, even in the US and my home in Canada, reporters are being targeted by the authorities.
So in other words, we ve all gotta watch each others backs.