{
	"id": "8ba1e968-612f-4eb1-ab69-b671086cdc95",
	"created_at": "2026-04-06T00:11:40.587748Z",
	"updated_at": "2026-04-10T13:11:38.322209Z",
	"deleted_at": null,
	"sha1_hash": "a610e32a3302489fff5c5ea0d5af3331cc77cc2f",
	"title": "Revealed: murdered journalist’s number selected by Mexican NSO client",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1695071,
	"plain_text": "Revealed: murdered journalist’s number selected by Mexican NSO\r\nclient\r\nBy Nina Lakhani\r\nPublished: 2021-07-18 · Archived: 2026-04-02 10:44:54 UTC\r\nThe hitmen came for Cecilio Pineda Birto as he swung in a hammock at a carwash, waiting for his pickup to be\r\ncleaned.\r\nThe 38-year-old freelance reporter was shot dead on 2 March 2017 in Ciudad Altamirano, a town in the southern\r\nMexican region of Tierra Caliente – a battleground for rival organised crime factions.\r\nA few hours earlier, Pineda had in a broadcast on Facebook Live accused state police and local politicians of\r\ncolluding with a violent local capo known as El Tequilero.\r\nIn previous weeks, Pineda had received a string of anonymous death threats. At about the same time, his mobile\r\nphone number was selected as a possible target for surveillance by a Mexican client of the spyware company NSO\r\nGroup.\r\nQuick Guide\r\nWhat is in the Pegasus project data?\r\nShow\r\nA successful infection enables an NSO client to access everything on the device, including contacts, chat\r\nmessages – and precise location. Pineda’s phone disappeared from the scene of his murder, so a forensic\r\nexamination to determine if it was targeted or infected with spyware was not possible.\r\nThe gunmen who murdered him could have learned of his location at a public carwash through means not related\r\nto NSO’s technologies, or its clients. But his attackers knew exactly where to find him, even though the hammock\r\nwhere he lay was not visible from the street.\r\n“People with power can do whatever they want to anyone,” said his widow, Marisol Toledo, when told Pineda had\r\nbeen selected for potential targeting. “If they succeeded [in infecting his phone], they would have known where he\r\nwas at all times.”\r\nOne of the alleged hitmen was found dead a few months later, but no one has been prosecuted over the murder.\r\nNSO says its products are only licensed for use by its clients to fight serious crime and terrorism. Yet at least 26\r\nMexican journalists’ phone numbers appear on the leaked data suggesting persons of interest to NSO customers\r\nbetween 2016 and 2017.\r\nhttps://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nPage 1 of 5\n\nThose whose phone numbers appear on the list include freelance investigative reporters, senior editors from the\r\ncountry’s major news organisations and the former New York Times bureau chief Azam Ahmed. The data,\r\naccessed by Forbidden Stories and Amnesty International, was shared with the Guardian and its 15 media\r\npartners.\r\nThe carwash where Pineda was shot dead on 2 March 2017.\r\nWhile the leak reveals phones that were selected as possible targets by NSO’s government clients, it is not\r\npossible to say whether phones were successfully infected with spyware without forensic analysis of a device.\r\nLawyers for NSO Group did not comment on whether Pineda’s phone had been targeted using its software.\r\nHowever, they said “even if” that were correct, “that does not mean that the NSO Group client or data collected by\r\nNSO Group software were in any way connected to the journalist’s murder the following month. Correlation does\r\nnot equal causation, and the gunmen who murdered the journalist could have learned of his location at a public\r\ncarwash through any number of means not related to NSO Group, its technologies, or its clients.”\r\nPegasus: the spyware technology that threatens democracy – video\r\nMexico is the world’s most dangerous country for reporters outside of warzones. Last month, two journalists were\r\nkilled within a week, bringing the death toll to at least 86 since 2010, according to the Committee to Protect\r\nJournalists. Those most at risk are reporters who investigate the webs of influence and interest woven by\r\norganised crime, the security forces and corrupt officials.\r\nIn Tierra Caliente, where Pineda lived and died, such pacts have long enabled cartels and politicians to cement\r\ntheir power and control this strategically important corridor used to transport drugs, arms and people.\r\nThis hot, dry region is heavily militarised, with federal and state security forces and intelligence agencies all\r\noperating in the region.\r\nLocal journalists must navigate opaque rules and direct threats dictating what must and cannot be covered.\r\nReporters’ salaries are extremely low, and many – as Pineda did – rely on so-called gratitude payments for\r\ncovering events.\r\nhttps://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nPage 2 of 5\n\n“This is the precarious reality in which Cecilio had to support his family, and while there’s no justification for\r\naccepting payments or gifts, you have to understand the context in which journalists live, work and die in\r\nGuerrero,” said Vania Pigeonutt, a journalist specialising in organised crime. “It’s impossible to keep everyone\r\nhappy. And it’s not the narcos who have absolute power – it’s the narco-politicians.”\r\nPineda was afraid of blood, but when he went freelance in 2012 he quickly developed a reputation for exclusive\r\nreports from crime scenes. Toledo and former colleagues described him as hard-working, outgoing and socially\r\nminded – but also as a womaniser who liked to show off with fake designer clothes and cars bought on credit.\r\nHe did not smoke, drink alcohol or take drugs, but loved to eat tacos and watch movies with his two daughters.\r\nThe family lived in one room, a sweltering converted garage at his mother’s house.\r\n“My son told me not to be scared, that he’d be fine,” said his mother, Crizanta Birto Melecio, 71, wiping away\r\ntears. “But he said: ‘If something happens to me, it will be the politicians.’”\r\nPineda frequently changed numbers because he feared his could be compromised, according to his colleagues and\r\nfamily. At one point, the transcript of a conversation between Pineda, a colleague and a source was published in a\r\nnational newspaper.\r\nPineda with his friend Agustín Hernández, right.\r\nLike most local crime reporters, Pineda frequently received death threats. But while other journalists often tried to\r\navoid trouble through self-censorship, Pineda played down the risks, said Agustín Hernández, a close friend and\r\nformer colleague. “Cecilio would get into problems because he was so direct. We would tell him to take it easy but\r\nhe always said everything would be fine,” he said.\r\nStill, Pineda had panic attacks and insomnia, and in 2015 he contacted the federal protection mechanism for\r\nhuman rights workers and journalists, a quasi-independent agency within the home affairs ministry.\r\nThe Guardian obtained a recording of Pineda’s final meeting with the mechanism in October 2016, when he\r\nvoiced fears about a threat from the town of San Miguel Totolapan. The officials acknowledged the gravity of the\r\nsituation but closed Pineda’s case because he refused to relocate to another state.\r\nhttps://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nPage 3 of 5\n\nIn the recording, he says he is managing the risks: “The people who could do me harm could hire killers, but they\r\nwouldn’t know my whereabouts.”\r\nA few weeks later he was selected as a possible target for surveillance by an NSO client.\r\nA picture of Pineda is displayed on his coffin.\r\nSan Miguel Totolapan is a mountainous municipality about 30 miles (50km) south-east of Ciudad Altamirano, and\r\none of Guerrero’s main heroin poppy-growing areas.\r\nAt the time, the area was controlled by Los Tequileros, a local gang faction that split from the Familia Michoacana\r\ncartel in about 2012 and launched a wave of mass kidnappings that left dozens dead.\r\nAccording to multiple sources, the political godfather of Los Tequileros was Saúl Beltrán Orozco, a local\r\npolitician from the then ruling Institutional Revolutionary party (PRI). He has denied the allegations. Beltrán was\r\nalso the local campaign coordinator for Héctor Astudillo, who was elected as state governor after pledging to\r\nbring “order and peace”.\r\nIn December 2016, armed locals captured the mother and friends of Los Tequileros’ chief in retaliation for the\r\nlatest kidnappings. This new faction presented itself as a group of ordinary citizens fed up with crime, and Pineda\r\nsympathised with their cause, said Israel Flores, a local journalist. “He started naming the politicians who he\r\nbelieved to be responsible for what was happening. This was a mistake.”\r\nBut the group was actually aligned with the Familia Michoacana cartel, which was trying to recover lost territory.\r\nIt is unclear if Pineda knew this, though he reported extensively on the crisis, accusing the state governor and\r\nhttps://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nPage 4 of 5\n\nsecurity forces of protecting Los Tequileros.\r\nAs the violence intensified, one of NSO’s Mexican clients again highlighted Pineda’s phone number. Around the\r\nsame time, the phone numbers of Beltrán and Astudillo also appeared in the data – as did the state’s chief\r\nprosecutor, Xavier Olea, who would later investigate the journalist’s death. Forensic analysis to determine whether\r\nthe telephones of Beltrán, Astudillo or Olea were targeted was not possible.\r\nNeither Astudillo nor Beltrán responded to a request for comment.\r\nOlea, who was Guerrero’s attorney general between December 2015 and April 2018, had himself been given a\r\ndemonstration of Israeli spyware. In an interview, he described how in early 2016 he was visited by two\r\nbusinessmen – an Israeli and a Mexican – who had been recommended by the federal anti-kidnapping\r\ncommission.\r\nThe men said their software was capable of listening to calls and downloading WhatsApp messages. As part of\r\ntheir demonstration, they hacked the phone of Olea’s wife.\r\nOlea said he was impressed by the technology, but the budget for a deal was never approved. Two years later, the\r\nstate governor agreed to buy the software, Olea said.\r\nOur investigation suggests Pineda was selected as a possible target by Mexico’s ministry of defence, NSO’s first\r\nclient. Several state security forces are also believed to have access to spyware and close links between organised\r\ncrime and politicians has prompted concerns it could end up in the wrong hands.\r\n“The line between the good guys and bad guys isn’t clear,” said Jorge Rebolledo, a security and intelligence\r\nconsultant based in Mexico City.\r\nNSO said it did not operate the systems that it sells to vetted government customers to fight crime and terrorism,\r\nand did not have access to the data of its customers’ targets.\r\nBy February 2017, Pineda may have sensed that time was running out. He started reverse-parking his car and\r\nrepeatedly asked his wife to check if the doors were locked. “That last week he seemed worried and scared,” said\r\nToledo. “[But] he never told us any details – the less we know the better.”\r\nPineda broadcast his final report on 2 March, claiming that the state governor and elements of the state police\r\nknew exactly where Los Tequileros were hiding.\r\nWithin hours, he was dead.\r\nAdditional reporting by Paloma Dupont de Dinechin from Forbidden Stories\r\nSource: https://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nhttps://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto"
	],
	"report_names": [
		"revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto"
	],
	"threat_actors": [],
	"ts_created_at": 1775434300,
	"ts_updated_at": 1775826698,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a610e32a3302489fff5c5ea0d5af3331cc77cc2f.pdf",
		"text": "https://archive.orkl.eu/a610e32a3302489fff5c5ea0d5af3331cc77cc2f.txt",
		"img": "https://archive.orkl.eu/a610e32a3302489fff5c5ea0d5af3331cc77cc2f.jpg"
	}
}