On a sunny morning dozens of protesters reeling from the coronavirus pandemic gathered in Mexico City’s central square to demand financial support, while workers rushed by with their heads buried in their phones.
What could not be seen were the signals containing reems of personal data that researchers say may have been captured by a nearby “fake antenna” to monitor passersby without their knowledge.
More than 20 such surveillance devices were mapped in the capital’s public spaces by Fake Antena Detection Project (FADe), a research initiative from Chilean digital rights group South Lighthouse.
“There are public offices, civil society organizations, public demonstrations going on there,” said Carlos Guerra, the technical lead for FADe. “It’s hard to grasp the possible scope of the surveillance.”
The fake antennas suggest the presence of IMSI catchers, also known as “stingrays”, which mimic cell phone towers to force cell phones in the area to transmit “pings” back to the devices, enabling law enforcement to track a suspect’s phone and pinpoint its location.
Critics of the technology call it invasive and say it has been regularly used in secret to catch U.S. criminal suspects and monitor protesters, for example by intercepting the contents of text messages.
The Mexico City area appears to have the second highest concentration of IMSI catchers of any place analyzed by South Lighthouse in the Americas, after Caracas in Venezuela, according to the report published last week.
“You put up the tower … and it starts invading the privacy of tens hundreds or even thousands of people nearby,” said Luis Fernando Garcia, founder of Mexican digital rights group R3D.
There is no legislation in Mexico on how the technology should be used – making it ripe for abuse, Garcia told the Thomson Reuters Foundation.
“These technologies aren’t regulated … we don’t think they could be legal.”
Stingrays can reveal personal information about innocent passersby, even if they have not been accused of committing a crime, warns digital rights group the Electronic Frontier Foundation (EFF).
Homicides in Mexico hit record levels in the first four months of 2020, climbing by 2.4% from the same period last year, official data showed in May, in a blow to the government’s efforts to restore order.
Mexico’s President Andres Manuel Lopez Obrador pledged in a 2018 press conference that there would be “no more birds on the wire” and that Mexicans could talk on their phones without fear of people listening in – although he did not mention stingrays specifically.
The use of surveillance devices like stingrays is underpinned by a global murky trade, digital rights activists say.
Technology companies based in the United States, Europe, and Israel manufacture and sell such devices to law enforcement agencies around the world, said Ilia Siatitsa, legal officer at digital rights group Privacy International.
“They’ve just become a commodity that is out there and anyone can just go buy,” Siatitsa said.
It is unclear who operates these cell phone towers in Mexico, but researchers recently unearthed contracts suggesting the Mexican military may have purchased them.
Mexican transparency group PODER has identified 21 contracts for 2011-19 between the Mexican government and U.S. tech firm L3Harris Technologies, which exports stingrays – although the contracts did not specify the exact technology purchased.
A spokesman for Mexico’s Secretariat of National Defense (SEDENA) said that it does not intercept communications and that the contracts identified by PODER had nothing to do with IMSI catchers.
The ministry is working on releasing public versions of the contracts, the spokesman said on the phone. The office of the president referred questions to the military.
A spokesman for L3 Harris did not reply to a request for comment about its contracts with the Mexican government.
Stingrays are being used by security forces globally under the guise of tracking criminals, say Privacy International and others.
In 2016 internet watchdog Citizen Lab and Mexican civil society groups found that advanced Israeli surveillance technology had been deployed by federal and state law enforcement against women’s and indigenous rights activists, among other targets.
Privacy International has called on British authorities to disclose whether police purchased and used IMSI catchers, following a 2016 investigation by media company The Bristol Cable.
In 2019 the Massachusetts Supreme Judicial Court in the United States ruled that law enforcement must obtain a warrant before using a cell site simulator.
Use of surveillance technology can have a “chilling effect” on protesters and public gatherings, Siatitsa said.
Vladimir Cortes Roshdestvensky, a Mexico-based digital rights officer at freedom of expression group Article 19, said
“I am now thinking about how many meetings I’ve had near there (the central plaza), how many protests I may have attended”.
“Now I am asking: how much of my data did they take?”
Maria Virginia, a woman who was sitting just off the main square and awaiting her shift at a silver shop, said she would feel robbed if someone were collecting data from her phone without her knowing.
“It’s an invisible robbery,” she said. “It’s a hidden risk for all regular citizens.”
After the South Lighthouse report was released, a coalition of Mexican digital rights organizations, including R3D and Article 19, demanded the government impose a moratorium on the use of IMSI catchers and launch an independent investigation into arbitrary surveillance.
“The government says there are no birds on the wire,” said Cortes Roshdestvensky. “Well, now we have evidence that that might not be true – we need some answers.”
Reporting by Avi Asher-Schapiro @AASchapiro and Christine Murray @chrissiemurray; Editing by Zoe Tabary. Please credit the Thomson Reuters Foundation, the charitable arm of Thomson Reuters, that covers the lives of people around the world who struggle to live freely or fairly. Visit http://news.trust.org