El Estado de la Vigilancia

El Estado de la Vigilancia (The State of Surveillance) is a Spanish-language consolidated diagnostic report on Mexican state communications surveillance, published in February 2025 by R3D — Red en Defensa de los Derechos Digitales with financial support from the European Union, under a Creative Commons Attribution 4.0 International licence carried on the report's microsite. The roughly 150-page Spanish-language full-text PDF is the consolidated successor to R3D's 2016 Estado de la Vigilancia Fuera de Control and the organisation's 2018 preliminary update of the same line, and it functions as R3D's load-bearing decade-of-evidence artefact on a single substantive question: how, under what authority, against whom, and with what oversight do Mexican state institutions surveil people's communications? It is the corpus's Mexican-national mass-surveillance publication anchor, complementing the corpus's existing Spanish-language Latin American regional anchor — Decisiones automatizadas en la función pública en América Latina, Derechos Digitales's 2021 comparative four-country mapping under Jamila Venturini's co-stewardship — and the corpus's existing Spanish-language Latin American feminist-AI anchor, Oppressive A.I., the Coding Rights framework by Joana Varon and Paz Peña. The launch was presented in early February 2025 by then–Executive Director Luis Fernando García and R3D attorney Ana Gaitán; subsequent rounds of presentation through 2025 included R3D Communications Director Pepe Flores Sosa at IBERO Puebla in April.

Central argument

The report's central argument, as R3D framed it on launch, is that the Mexican state's use of communications-surveillance technologies has developed "en un entorno de opacidad, abuso e impunidad" (in an environment of opacity, abuse, and impunity) — that the most consequential measures (interception of private communications, real-time geolocation, access to metadata stored by telecommunications providers, deployment of mercenary spyware) are conducted in practice without effective judicial or institutional oversight, regardless of what the formal legal frameworks nominally require, and that the asymmetry between the speed of state-surveillance deployment and the speed of rights-protection scaffolding has compounded over a decade rather than narrowed. R3D's substantive move — repeated at the IBERO Puebla presentation by Pepe Flores Sosa — is that "surveillance is a power the state can exercise, but must exercise from a human-rights perspective", and that the empirical record over the decade documented by the report shows the human-rights perspective absent at scale.

Findings: the documented decade

The report consolidates a decade of R3D-led investigations, strategic-litigation case files, and access-to-information request returns into a single quantitative diagnostic. The headline statistics the report names on launch include:

• A 540 % increase in approved interceptions of private communications over six years — from 656 judicially-approved interventions in 2017 to 10,626 in 2023.
• More than 13,890 documented instances of geolocation access without judicial authorization in the same window.
• A 52,000 % increase in judicial-authorization requests for personal-data delivery from telecommunications providers — from 35 in 2016 to 18,167 in 2023 — paired with a 75 % approval rate on the requests.
• Significant systemic discrepancies between telecommunications-provider records and official government reports on the same surveillance measures, undermining the existing transparency-reporting infrastructure.

Alongside the documented growth of communications interception, the report carries the systematic documentation of mercenary-spyware deployment that R3D and the Citizen Lab have built into the corpus's clearest multi-year empirical record on the field: Pegasus, the NSO Group product whose Mexican deployment R3D has documented through #GobiernoEspía and Ejército Espía; Galileo, the Hacking Team product whose Mexican acquisition was exposed in the 2015 Hacking Team leak (Mexico paid Hacking Team €5.8 million through a network of intermediary contracts); false cell towers and other commercial-grade interception infrastructure including Geomatrix. The report names a recurring procurement pattern across the documented technologies: acquisition through intermediary commercial entities without cybersecurity expertise, direct-award contracting without competitive procurement, no public registry of deployed systems, and no enforceable accountability for the operating institutions.

Structure and methodology

The report is structured across four operating sections — human-rights standards applicable to state surveillance, the documented surveillance practices the standards should be measured against, the systemic-control failures the comparison surfaces, and the reform proposals the report installs as the political pivot from diagnostic to advocacy. The methodology is the consolidated assembly of R3D's decade-long investigative output: parallel reading of formal legal frameworks (article 303 of the Código Nacional de Procedimientos Penales and adjacent provisions; SCJN — Supreme Court of Justice of the Nation — precedents on communications-surveillance and privacy) against the on-the-ground deployment record R3D has built through strategic-litigation casework, access-to-information requests, and joint investigative collaborations with the Citizen Lab and the Forbidden Stories–coordinated Pegasus Project. The recommendation that anchors the report's policy register is the call for a moratorium on the acquisition and deployment of communications-surveillance tools until the public-accountability infrastructure (named provider registries, named equipment inventories, named transparency obligations on procurement) is built and operational.

Programme position and authorship

The report sits inside R3D's Estado de la Vigilancia programme line, which the organisation has run since its 2016 launch with Fuera de Control and the companion online evidence platform Archivo de la vigilancia the microsite continues to anchor. The 2025 report carries an explicit decade-of-evidence framing the 2016 Fuera de Control predecessor opened. Adjacent R3D publication-line outputs the corpus's wider mapping touches include Vigilancia en el espacio público con tecnologías de reconocimiento facial, the dedicated facial-recognition / biometric-public-space report whose subject the 2025 consolidated diagnostic situates inside its broader mass-surveillance frame.

Authorship is institutional: the credited author is R3D's multidisciplinary team, with Luis Fernando García (then–Executive Director through 1 May 2025) and R3D attorney Ana Gaitán the named presenters at launch and the named on-record voices for the launch register inside the Mexican investigative press. García's eleven-year public-spokesperson register on R3D's Pegasus investigations is the substantive lineage the report's consolidated documentation draws on; Gaitán's named launch role on the procedural and judicial-oversight findings is the first Voice-adjacent register the corpus picks up for her. R3D Communications Director Pepe Flores Sosa anchors the subsequent presentation-and-press-circulation register the report carried through 2025 across Mexican universities and academic-press surfaces.

Posture within the corpus

Within the corpus, El Estado de la Vigilancia is the first Mexican-national publication anchor and the first publication-side anchor on the mass-surveillance / communications-interception / mercenary-spyware register at consolidated-decade-of-evidence scale. It is also the corpus's third Spanish-language Latin American publication — completing a publications-side regional triangle whose existing pair was Decisiones automatizadas en la función pública en América Latina (the Derechos Digitales comparative ADM mapping under the five-dimension human-rights audit methodology) and Oppressive A.I. (the Coding Rights feminist-decolonial seven-category framework). The triangle's regional centre of gravity moves with the third anchor: where the Derechos Digitales report addresses Brazil, Chile, Colombia, and Uruguay and the Coding Rights essay addresses Argentina, Brazil, and Chile, El Estado de la Vigilancia installs the Mexican / Mesoamerican axis the corpus's Latin American publications side had previously reached only through cross-references in org-r3d and voice-luis-fernando-garcia.

The report's structural counterpart on the corpus's publications slate is Decisiones automatizadas en la función pública en América Latina: both report-anchors apply documentary methodology to the operating record of state automated-and-surveillance systems in a Latin American jurisdiction; both pair empirical documentation with explicit policy framings addressed to formal rights-protection scaffolding (the Inter-American Commission on Human Rights and UNESCO on the Derechos Digitales side; the SCJN and the article-303 CNPP framework on the R3D side); and both anchor a recurring civil-society research programme rather than a one-off intervention. Where the Derechos Digitales report addresses public-administration automated-decision-making across multiple countries with a comparative methodology, the R3D report addresses mass-surveillance-and-communications-interception inside a single jurisdiction with a decade-of-evidence methodology — complementary registers covering different layers of the same Latin American state-AI-and-data infrastructure.

The 2025 publication has continued to anchor R3D's downstream advocacy through the year: R3D's 7 March 2025 Inter-American Commission on Human Rights intervention on artificial intelligence and human rights drew on the report's biometric-and-facial-recognition findings; the Electronic Frontier Foundation deeplink of 17 September 2025 cites R3D's continuing advocacy against the Sheinbaum administration's 2025 mass-surveillance legislative package, on which R3D's framing — that the new laws establish "an uncontrolled system of surveillance and social control that goes against privacy and free expression rights and the presumption of innocence" — extends the Estado de la Vigilancia diagnostic into the next phase of the campaign. Inside the corpus's working frame, the report is the empirical evidence base on which the Mexican civil-society response to AI-and-surveillance practices continues to draw, and the publication-side anchor of R3D's register inside the make-AI-good movement.