It is a plot straight out of Crime Fiction 101: everyone is pretty sure they know who dunnit, but no one may ever be able to prove it.
Oh, the circumstantial evidence could hardly be clearer: the victims form a clear pattern, implicating a party with both a logical motive and a documented opportunity. And there are smoking guns all over the place. But fingerprints can only take you so far. And the prime suspect denies everything.
The case involves illegal surveillance, penetrations of privacy on an astonishing level. The victims are journalists, lawyers, political activists, human rights monitors, proud to be seen as enemies of the government of Mexican President Enrique Pena Nieto. They are also proud that their long-held suspicions – that they have been targets for government spying have been proven true. Forensic experts have found on their smart phones an unmistakable signature of spyware called Pegasus and made by an Israeli manufacturer called The NSO Group. And NSO confirms what documents had shown, that over the past 3 years they have sold $80 million worth of Pegasus spyware to branches of the Mexican government.
But NSO says that’s all it knows. Who, from what branch of the Mexican government (or someone else) actually placed the Peg-a-bug on smartphones used by revered human rights crusader Mario Patron, or Juan Pardinas, the anti-corruption activist, or Carmen Arestegui, one of Mexico’s top investigative reporters cannot, the manufacturer says, be traced.
President Pena Nieto has promised to get to the bottom of this mystery. He’s handed the job to the Office of the Federal Attorney General. Well, that makes sense, you might say, the AG is the top Government Prosecutor. Many Mexicans say it makes another, all too familiar kind of sense. The Prosecutor here would be on any other prosecutor elsewhere’s short list of suspects: the Attorney General’s Office is one of the branches of the Mexican Government which bought Pegasus surveillance devices.
To do so, they had to promise Pegasus would only be used against terrorists, drug cartels and organized crime syndicates. But The NSO Group hardly seems annoyed that the promise seems to have been broken and claims it has no idea whom it should be mad at.
Meanwhile, the Mexican Attorney General already has investigative competition from journalists and activists and possibly, an independent commission. This story is just beginning to show its legs.
Nicole Perlroth covers cybersecurity for The New York Times. She is the recipient of several journalism awards including best technology reporting by the Society of Business Editors and Writers. Her 2014 Times profile of security blogger Brian Krebs was optioned by Sony Pictures and a 2016 story of Chinese hackers in a welding shop server was optioned for a television series by The Weinstein Company. Prior to joining the Times in 2011, Ms. Perlroth covered venture capital and start-ups for Forbes Magazine. She is currently at work on a cybersecurity book, “This Is How They Tell Me The World Ends” for Penguin/Portfolio (2017).