R3D-led Mexican civil-society response to Pegasus mercenary-spyware targeting of journalists and human-rights defenders (2017–ongoing)

This campaign is the Red en Defensa de los Derechos Digitales (R3D)-led Mexican civil-society response to the documented use of Pegasus mercenary spyware — developed and sold by the Israeli surveillance vendor NSO Group — by Mexican state actors against journalists, human-rights defenders, anti-corruption activists, and opposition politicians, sustained from its 19 June 2017 #GobiernoEspía launch across the remainder of the Peña Nieto administration and the entirety of the López Obrador administration. Its substantive register is investigative — coordinated forensic research with the Citizen Lab and other international partners, translated into Spanish-language reporting, public advocacy, and demands for federal criminal accountability — and it sits as the corpus's clearest Latin American case of multi-year civil-society advocacy on the commercial-spyware industry. The campaign's structural placement is at the demand-side / affected-publics end of the AI-and-surveillance supply chain: where the corpus's Anglosphere algorithmic-accountability campaigns anchor on state biometric mass surveillance and welfare-algorithm deployments, and where the corpus's African and Kenyan AI-and-labour campaigns anchor on the AI training-data supply chain, the Mexican Pegasus campaign anchors on the commercial-spyware-supply-chain register that has not previously had a Latin American national-grassroots anchor in the corpus.

The #GobiernoEspía launch (June 2017)

On 19 June 2017 R3D, together with Article 19 Mexico and Central America Office, the Mexican civic-tech organisation SocialTIC, the Mexican investigative news outlet Aristegui Noticias, and the Citizen Lab at the University of Toronto's Munk School of Global Affairs, launched the #GobiernoEspía (Spying Government) investigation. The investigation documented seventy-six Pegasus infection attempts against twelve named Mexican targets between January 2015 and July 2016 during the Peña Nieto administration. Documented targets included Mario Patrón, Stephanie Brewer, and Santiago Aguirre of the Miguel Agustín Pro Juárez Center for Human Rights (Centro Prodh) — lawyers representing relatives of the disappeared Ayotzinapa students; the journalist Carlos Loret de Mola; the anti-corruption researchers Juan Pardinas and Alexandra Zapata of the Mexican Institute for Competitiveness (IMCO); Salvador Camarena and Daniel Lizárraga of Mexicans Against Corruption and Impunity; and the journalists Carmen Aristegui, Rafael Cabrera, and Sebastián Barragán of Aristegui Noticias, alongside Aristegui's then-teenage son Emilio. The investigation framed the targeting as a systemic pattern of state surveillance against critics — anti-corruption journalism, judicial proceedings against state forces, and human-rights documentation — and grounded its findings in Citizen Lab's forensic identification of Pegasus infection links and infrastructure.

The launch generated international press coverage the same day, naming the Mexican government as a likely operator of Pegasus and placing the documented targeting in the context of NSO Group's customer profile of states with documented human-rights-violation records. R3D's launch post and the coalition's coordinated demand was for an exhaustive, impartial, and transparent federal investigation and prosecution of the intellectual and material authors of the targeting — the campaign's founding accountability framework.

The Ejército Espía expansion (October 2022) and the López Obrador continuation

The campaign's longest-running thread is its documentation of the post-2018 continuation of Pegasus targeting under the López Obrador administration. In October 2022 R3D and the Citizen Lab published the Ejército Espía (Spying Army) investigation, documenting the use of Pegasus by the Mexican armed forces — and the Mexican military's Center for Military Intelligence in particular — against the human-rights defender Raymundo Ramos, who documents military human-rights violations in Tamaulipas; the journalist Ricardo Raphael; and an Animal Político journalist. The investigation contradicted President López Obrador's 2019 public undertaking that state surveillance had ended ("we don't do that, and we don't do it because it is a matter of principle"), and named the Mexican military as the operator most likely responsible for the documented post-2018 deployments — substantively shifting the Mexican Pegasus debate from a Peña-Nieto-era story to a continuing pattern of military intelligence surveillance against civil-society critics.

A subsequent October 2023 Citizen Lab and R3D update, under the title "Intermittent Spyware: Pegasus Spyware Deployment against Journalists and Civil Society in Mexico, 2019-2021", extended the documented victim record to include the opposition lawmaker Agustín Basave Alanís and characterised the post-2018 deployment pattern as intermittent rather than ended. Amnesty International's parallel 2022 statement corroborated the coalition's findings and supported the campaign's framing of the Mexican Pegasus record as a continuing pattern of state surveillance against civil society. The substantive evidentiary record across nine years of investigation places R3D inside the international Pegasus Project investigative consortium coordinated by Forbidden Stories and Amnesty International's Security Lab, and inside the global civil-society spyware-accountability field anchored by Access Now, Amnesty International, and the Citizen Lab.

Federal investigation, criminal complaints, and the accountability arc

R3D, Article 19 Mexico, and SocialTIC have pressed multi-year federal criminal complaints with the Office of the Attorney General of Mexico (Fiscalía General de la República) seeking criminal accountability for the documented Pegasus targeting. The campaign's accountability arc has produced limited criminal-prosecution outcomes against intellectual and material authors of the surveillance: the Federal Prosecutor's Office made one named criminal arrest in 2021 — a former Mexican prosecutor charged with illegally selling Pegasus access to a private operator — but no senior official of the Peña Nieto or López Obrador administrations has been criminally convicted for ordering or carrying out the documented Pegasus deployments at the time of writing. R3D's own Vigilancia (Surveillance) archive tracks the year-by-year procedural state of the federal-investigation file, the named victims' civil-society follow-up, and the periodic legislative and political-debate moments at which the Mexican federal authorities have re-engaged the Pegasus record.

The campaign's broader strategic-litigation register operates in parallel to the federal-criminal track: civil-society advocacy through the Mexican Senate; engagement with the Mexican National Human Rights Commission (CNDH); and the routing of the Mexican Pegasus record into the Inter-American human-rights system, including R3D's contribution of the Mexican facial-recognition case-study evidence and the broader Mexican surveillance-deployment record to the Inter-American Commission on Human Rights' 192nd Period of Sessions hearing on artificial intelligence and human rights in March 2025, where R3D attorney Francia Pietrasanta delivered the organisation's intervention demanding the prohibition of AI in video surveillance with facial recognition for identifying persons in public spaces. The Pegasus documentary base supplied much of the substantive credibility on which R3D's wider Inter-American AI-and-human-rights advocacy now rests.

Coalition placement and regional register

The Mexican Pegasus campaign sits in a load-bearing relationship to two pieces of regional and international civil-society infrastructure. Within Latin America, R3D's membership in the Al Sur consortium places the Mexican Pegasus record alongside the regional digital-rights coalition's working AI-and-surveillance file — supplying the consortium's Mexican national-anchor evidence on commercial-spyware targeting, complementary to Derechos Digitales's Chilean / regional-advocacy anchor on state-AI deployments across the region. Internationally, the campaign sits inside the Pegasus Project investigative coalition and the wider civil-society spyware-accountability field, exchanging substantive evidence and advocacy register with SMEX and other digital-rights anchors across the WANA / MENA region where parallel Pegasus deployments against journalists and human-rights defenders have been documented in Jordan, Bahrain, Saudi Arabia, and across the Gulf — the campaign's structural counterpart in the Arabic-language register.

Significance for the broader AI-good movement

The Mexican Pegasus campaign is the corpus's first Latin American national-grassroots civil-society campaign on the commercial-spyware supply chain, the corpus's clearest documented Spanish-language register on AI-and-surveillance accountability, and the corpus's longest-running cross-administration spyware-accountability file. Its substantive distinctness from the corpus's existing surveillance campaigns sits on three axes. First, on the surveillance technology challenged: where the corpus's biometric-mass-surveillance campaigns at the Big Brother Watch UK live facial-recognition coalition, the Internet Freedom Foundation's Project Panoptic on Indian facial-recognition, and the broader Reclaim Your Face European Citizens' Initiative anchor on state biometric video surveillance in public space, the Mexican Pegasus campaign anchors on the structurally distinct commercial-spyware / mercenary-surveillance industry. Second, on the affected publics named: where the biometric-mass-surveillance campaigns anchor on the general population subject to public-space surveillance, the Pegasus campaign anchors on the specific affected populations of journalists, human-rights defenders, anti-corruption activists, and opposition politicians — a smaller set of named individuals whose surveillance is targeted rather than mass. Third, on the AI-supply-chain register engaged: the campaign engages the commercial AI-and-surveillance supply chain — NSO Group, the broader mercenary-spyware industry, the state-customer base — in a way that connects Mexican civil society to the international Pegasus Project investigation and the Citizen Lab's forensic research, structurally distinct from the corpus's existing AI-supply-chain engagement through Kenyan content-moderator and data-labeller cases on the AI-training-data labour side. Together these axes make the campaign the corpus's clearest case of cross-administration civil-society spyware-accountability advocacy and its anchor on the demand-side / affected-publics end of the commercial AI-and-surveillance supply chain.