The first of NSO’s known clients, the Mexican government, already uses Pegasus in 2011. At least three Mexican federal agencies have purchased NSO’s spyware. The Mexican government said that it spent more than $160 million on Pegasus over a decade.
In 2016, Canadian research laboratory Citizen Lab reported that Mexican journalist Rafael Cabrera was targeted by Pegasus, the first known journalist victim of the spyware.
In June 2017, The New York Times and Citizen Lab revealed that Mexican journalists, anti-corruption activists and human rights lawyers were targeted with Pegasus, which had been acquired by the Mexican government. A couple of days later, Mexican president Enrique Peña Nieto acknowledged the government had purchased NSO Group’s spyware and promised an investigation into the misuse of the spyware.
Between 2017 and 2019, Citizen Lab found additional evidence of targeting with Pegasus against Mexican journalists, activists, researchers and lawyers, with a total of 25 individuals in Mexico known to have been abusively targeted with Pegasus.
In 2020, The Cartel Project led by Forbidden Stories disclosed that Mexican journalist Jorge Carrasco was targeted with NSO’s spyware in 2016.
In July 2021, the Pegasus Project revealed that three people close to Mexican journalist Carmen Aristegui were targeted with Pegasus and that three others had been selected for potential surveillance (the consortium was unable to analyze the phones they were using at the time). The investigation also found that former president Felipe Calderón, at least 25 Mexican journalists and at least 50 people close to Mexican president Andrés Manuel López Obrador (AMLO), among others, were selected for potential surveillance. Overall, the Pegasus Project identified more than 15,000 Mexican numbers selected by Mexico for potential surveillance using Pegasus.
In the aftermath of the Pegasus Project investigation, President López Obrador committed to making all information on Pegasus public, including contracts signed with NSO Group and the results of espionage against public figures. In November however, the government cited “national security” as the reason for not releasing information on Pegasus. One year later, no official document from Mexico on Pegasus had been made public.
In August 2021, the Inter-American Commission on Human Rights and the Mexico office of the United Nations High Commissioner for Human Rights called on the Mexican government to “effectively sanction” the misuse of Pegasus.
In November 2021, Mexico arrested a technician working for a private firm accused of spying on journalist Carmen Aristegui using Pegasus. It was the first arrest in Mexico related to the Pegasus scandal.
In October 2022, Mexican news outlets reported that contrary to what Mexican president Andrés Manuel López Obrador had stated, his administration had kept using the spyware as late as 2021. R3D and Citizen Lab identified Pegasus infections of the phones of two Mexican journalists, a human rights defender and an opposition politician between 2019 and 2021. The news outlets also revealed that the secretariat of national defense (Sedena) signed a secret contract with a reseller of NSO Group’s technology during AMLO’s presidency, in 2019.
In March and April 2023, the New York Times traced back the story of how Mexico had become the first and most prolific user of Pegasus and how the country’s military spied on citizens who were trying to expose its misdeeds. Citizen Lab revealed that the devices of Mexican human rights defenders Jorge Santiago Aguirre Espinosa and María Luisa Aguilar Rodríguez had been infected as late as 2022.
The Mexican federal attorney general’s office charged four former officials in its Pegasus spyware probe, including the former head of the now defunct criminal investigation agency (AIC) Tomás Zerón and the former federal ministerial police chief Vidal Díazleal, media outlets reported in May 2023.