International experts sent to Mexico to investigate the disappearance of 43 students in 2014 were targeted with spyware sold to the government, researchers said Monday.
Adding to a snowballing scandal over spying on journalists, activists and other public figures in Mexico, computer security experts confirmed that the independent investigation into the disappearance and alleged massacre -- an atrocity that drew world condemnation -- was targeted with a highly invasive spyware known as Pegasus.
"The infection attempts took place in early March of 2016, shortly after the (independent experts) had criticized the Mexican government for interference in their investigation, and as they were preparing their final report," said researchers at the University of Toronto's Citizen Lab.
The research lab was among the groups that previously found the same spyware targeted the phones of leading journalists, anti-corruption activists and human rights campaigners.
The government denies the alleged spying and has ordered the attorney general's office to investigate.
The spyware, known as Pegasus, effectively turns a target's cell phone into a pocket spy, enabling remote access to the user's data, camera and microphone.
It is made by a secretive Israeli firm called NSO Group, owned by US private equity firm Francisco Partners Management.
According to the New York Times, which first broke the story, at least three Mexican federal agencies have purchased some $80 million of spyware from NSO Group since 2011.
Citizen Lab says it has now documented 19 cases of spying or attempted spying on investigative journalists, anti-corruption activists, human rights campaigners, opposition politicians and public health advocates.
The targets all report receiving text messages with eye-catching news headlines, social media posts or personal communications.
In the case of the independent experts sent to investigate the mass disappearance by the Inter-American Commission on Human Rights, the main cell phone they were using in Mexico received messages relating the death of someone's father and purportedly linking to details on the funeral.
In reality, the link pointed to a site set up to install Pegasus on targets' phones.
Mexico is still haunted by the mystery of the 43 missing students, who were abducted by corrupt police in September 2014 in the southern city of Iguala.
Prosecutors initially said the officers delivered the students to drug cartel hitmen who killed them and burned their bodies.
But the independent experts rejected that version of events. They demanded further investigation, but the government did not renew their mandate.