Mexican Journalists Targeted with Pegasus Days After Colleague's Assassination

On May 15, 2017, award-winning Mexican journalist Javier Valdez Cárdenas, co-founder of the investigative outlet Río Doce and renowned for reporting on drug trafficking and organized crime in Sinaloa, is assassinated in broad daylight in Culiacán. Just two days later, on May 17, two of his colleagues at Río Doce, Andrés Villarreal and Ismael Bojórquez, begin receiving text messages laden with NSO Group’s Pegasus spyware.

Citizen Lab’s forensic investigation, published as “Reckless VI,” reveals that the malicious messages were sent using exploit infrastructure linked to an NSO Group operator code-named “RECKLESS-1,” the same entity that had been targeting Mexican civil society since at least 2015. The targeting occurs immediately after representatives of Mexico’s Criminal Investigation Agency arrive in Culiacán to investigate Valdez’s murder, raising disturbing questions about whether government surveillance is being used to monitor journalists investigating their colleague’s assassination.

This case represents one of the most egregious documented abuses of commercial spyware: targeting journalists investigating a colleague’s murder with government surveillance tools. By the time of this targeting in May 2017, it had been publicly known for almost eight months that Pegasus was being systematically abused in Mexico, yet the attacks continued unabated. With this seventh publication on NSO Group abuses in Mexico, Citizen Lab and partners R3D, SocialTic, and Article 19 document a total of 24 cases of targeting, establishing Mexico as the most prolific documented abuser of commercial spyware against its own citizens.