Supporters of Mexico’s Soda Tax Targeted With NSO Exploit Links
- A prominent scientist at the Mexican National Institute for Public Health (INSP) and two directors of Mexican NGOs working on obesity and soda consumption were targeted with government-exclusive spyware.
- All of the targets have been active supporters of Mexico’s soda tax, a public health measure to reduce the consumption of sugary drinks.
- The targets received messages with malicious links that would have installed NSO Group’s Pegasus spyware on their phones. NSO Group is an Israeli “cyber warfare” company.
- NSO’s government surveillance tool may have been misused on behalf of special commercial interests, not for fighting crime or terrorism.
This report describes an espionage operation using government-exclusive spyware to target a Mexican government food scientists and two public health advocates. The operation used spyware made by the NSO Group, an Israeli company that sells intrusion tools to remotely compromise mobile phones. On August 25, 2016, the Citizen Lab published a report showing that NSO’s technology was used to target Ahmed Mansoor, a UAE-based human rights defender, as well as identifying targeting in Mexico. Mexico has previously confirmed that it is a purchaser of NSO Group’s spyware.
Mansoor was targeted with links sent via SMS. Had he clicked on the links, his iPhone would have been silently exploited with the Trident, a series of three zero-day exploits designed to install NSO’s Pegasus spyware on his phone.
This research presents evidence that NSO’s exploit infrastructure and spyware were used to target additional individuals in Mexico in July and August 2016, including Dr. Simon Barquera, a well-respected Mexican government health scientist, Alejandro Calvillo, the director of a consumer and health advocacy organization, and Luis Encarnación, the director of a coalition working on obesity prevention.
These individuals are neither criminals nor terrorists, but a prominent government scientist and two health campaigners who support a public health measure: Mexico’s soda tax on sugary drinks. They received the malicious links via SMS while campaigning to increase the soda tax rate, improve drink labelling, and raise awareness of health risks associated with sugary drinks.
This case suggests that NSO’s government-exclusive espionage tools may be being used by a government entity on behalf of commercial interests, and not for national security reasons or fighting crime.