An investigation details how Mexico became Pegasus' first client, grew to be its most prolific user, and continues to use the spyware despite promising to stop
A Times investigation reveals the story behind how Mexico became the first and most prolific user of Pegasus. Tweets: @el_reportero , @llchristyll , @lkatzenberg , @diazbriseno , @justinhendrix , and @ronenbergman Tweets: David Agren / @el_reportero : “Mexico's military is not only Pegasus' longest-running client ...but it has also targeted more cellphones with the spyware than any other government agency in the world. And the spy tool continues to be deployed in the country, not just to combat crime.” https://www.nytimes.com/... Christy Thornton / @llchristyll : The Mexican military continues to spy on activists with impunity: “Previously undisclosed tests show that, as recently as the second half of 2022, Pegasus infiltrated the cellphones of two of the country's leading human rights defenders.” https://www.nytimes.com/... Lauren Katzenberg / @lkatzenberg : New from @Nataliekitro and @ronenbergman: a new investigation into the origin of Pegasus, the most powerful spyware in the world for which the first contract was signed in a Mexican strip club. https://www.nytimes.com/... @diazbriseno : “[Mexican] President AMLO...promised to stop what he called the ‘illegal” spying of the past’ " “He did not” “As recently as the second half of 2022, Pegasus infiltrated the cellphones of two of the country's leading human rights defenders” via NYT https://twitter.com/... Justin Hendrix / @justinhendrix : “A New York Times investigation based on interviews, documents and forensic tests of hacked phones shows the secret dealings that led Mexico to become Pegasus' first client, and reveals that the country grew into the most prolific user...” of the spyware. https://www.nytimes.com/... Ronen Bergman / @ronenbergman : NEW: It was in the dark Mexico City cabaret in 2011, among women dancing onstage and tequila shots, that the most powerful cyberweapon in existence got its start. Pegasus- The Prequel (and sequel), @nytimes investigative report with the great @Nataliekitro https://www.nytimes.com/...
Context & Ripple Effects
Mexico signed the first Pegasus contract in 2011 and its military has since targeted more phones than any other government agency in the world — a history laid out in the earlier global Pegasus investigation that also exposed use by the CIA, UAE, and Saudi Arabia. What makes this new Times piece different is the continuity it documents across political change: President AMLO promised to end illegal spying on taking office, yet forensics later confirmed attacks on activists and reporters through 2021 using 0-click exploits.
First-order effects
- The investigation puts Mexico's military directly under scrutiny as the spyware's longest-running and most prolific client, with deployments extending beyond countercrime uses into political targeting.
- It compounds pressure on the attorney general's office, which is already probing whether the prior administration's ~$23M Pegasus purchase was legal and how NSO sold it.
Second-order effects
- The targeting of Alejandro Encinas while he investigated military abuses shows surveillance turned against the state's own oversight mechanism — undercutting the credibility of any internal Mexican inquiry into the program.
- Continued documented use despite US sanctions on NSO reinforces the finding of the December investigation that government spyware markets keep functioning regardless of American export controls, including the DEA's own secret Graphite deployment.
Third-order effects
- If pledges to stop spying fail even under a president who campaigned on ending them, enforcement shifts from domestic political promises to external checks — procurement audits like Mexico's attorney general investigation and sanctions regimes whose limits are now themselves documented.
- The pattern points toward spyware proliferation becoming a structural feature of state security apparatuses rather than an aberration, with democratic oversight institutions among the targets rather than the controllers.
The trend: Government spyware use is outlasting both vendor sanctions and reformist administrations, making independent forensic researchers and foreign regulators the only durable check on domestic surveillance programs.