{"id":4524,"date":"2025-12-19T16:48:53","date_gmt":"2025-12-19T13:48:53","guid":{"rendered":"https:\/\/factcheck.lt\/?p=4524"},"modified":"2025-12-23T01:20:52","modified_gmt":"2025-12-22T22:20:52","slug":"day19_mexico","status":"publish","type":"post","link":"https:\/\/factcheck.lt\/eng\/news\/day19_mexico\/","title":{"rendered":"Day 19: Mexico \u2014 The Guacamaya Leaks and Military Information Operations","raw":"Day 19: Mexico \u2014 The Guacamaya Leaks and Military Information Operations"},"content":{"rendered":"

When the Army Spies on Its Own Citizens (2022-2024)<\/strong><\/p>\n

In September 2022, a hacktivist collective called “Guacamaya” breached<\/a> the Mexican Ministry of National Defense (SEDENA), exfiltrating six terabytes \u2014 over four million documents \u2014 in the largest hack in Mexico’s history. What emerged was a portrait of a military establishment that had turned its surveillance apparatus against journalists, activists, and political opponents rather than criminal organizations.<\/p>\n

The Guacamaya Revelations<\/strong><\/p>\n

The leaked documents, distributed to journalists and human rights organizations<\/a>, revealed multiple layers of military surveillance and information operations:<\/p>\n

Pegasus Spyware Deployment:<\/strong> Despite President Andr\u00e9s Manuel L\u00f3pez Obrador’s (AMLO) repeated public assurances that his government does not spy on journalists or political opponents, the documents showed continued use of Pegasus<\/a> spyware during his administration. Investigation by R3D (Digital Rights Defense Network), Article 19, and Citizen Lab found infections on phones of human rights defenders and journalists in 2019, 2020, and 2021.<\/p>\n

The documents revealed that SEDENA had contracts with Comercializadora Antsua \u2014 NSO Group’s authorized Mexican distributor \u2014 paying approximately 140 million pesos (~$7.7 million USD)<\/a> for “remote monitoring service licenses.” When confronted with information requests, SEDENA denied such contracts existed<\/a>, then later classified the information as “national security” matters for five years.<\/p>\n

Secret Military Intelligence Center (CMI):<\/strong> The leaks exposed a previously unknown intelligence unit called CMI (Centro Militar de Inteligencia). According to R3D’s investigation<\/a>, the documents reveal that one of CMI’s identified “threats” was that “the activities of this center are made public.” The CMI has no formal legal establishment and operates outside normal oversight mechanisms.<\/p>\n

Surveillance Targets:<\/strong> The documents showed SEDENA monitored<\/a> feminist collectives, the Zapatista movement (EZLN), social leaders attending presidential events, and human rights advocate Raymundo Ramos \u2014 who was investigating a suspected extrajudicial killing by the Army in the border town of Nuevo Laredo.<\/p>\n

The National Security Archive<\/a> found that years before the 2014 disappearance of 43 students from Ayotzinapa, the military had the school under surveillance and “considered its students to be subversives.”<\/p>\n

The Cyberspace Operations Center (COC)<\/strong><\/p>\n

A February 2024 investigation by R3D<\/a> detailed the functions of another secret SEDENA division: the Cyberspace Operations Center (COC), established in 2016 to conduct “military operations in cyberspace.”<\/p>\n

According to Freedom House<\/a>, the COC uses commercial software to monitor social media users who are critical of the state. But it goes beyond surveillance \u2014 the COC’s “Influence Operations Group” actively manipulates online conversations.<\/p>\n

In one documented instance from 2020, the Influence Operations Group created at least six social media accounts<\/a> that shared more than 5,000 items favorable to the military, including posts attempting to manipulate conversations about the army’s human rights violations.<\/p>\n

The investigation found that COC uses commercial software to deploy “inauthentic bots that exert soft influence on public opinion.” The leaked documents also revealed that SEDENA was using TikTok to spread propaganda<\/a>, assigning military personnel to “fight in social networks.”<\/p>\n

The 2024 Election: A Disinformation Battleground<\/strong><\/p>\n

Mexico’s June 2024 presidential election \u2014 the largest in the country’s history, with nearly 20,000 positions on the ballot \u2014 became a testing ground for AI-generated disinformation<\/a>.<\/p>\n

Bot Armies from Multiple Directions:<\/strong> According to Freedom House<\/a>, disinformation analyst Alberto Escorcia reported that 92% of posts using the #NarcoPresidenteAMLO hashtag were created by bots. Meanwhile, Juli\u00e1n Mac\u00edas Tovar of Spain’s Pandemia Digital found that over 50,000 posts using the misspelled hashtag #NarcoGobiermoAMLO originated from more than 4,000 accounts \u2014 with more than half coming from Argentina, Spain, and Colombia, suggesting inauthentic coordination.<\/p>\n

Pro-government accounts also manipulated conversations. Animal Pol\u00edtico reported<\/a> in October 2023 that a network of at least 160 X accounts called “Liga de Guerreros” (League of Warriors) shared false and manipulated content supporting opposition candidate X\u00f3chitl G\u00e1lvez.<\/p>\n

Deepfakes Targeting Both Sides:<\/strong> In February 2024, a deepfake video of Claudia Sheinbaum<\/a> surfaced, showing the presidential candidate promoting a fraudulent investment scheme. Sheinbaum quickly denounced it: “It’s a video that they’re doing with artificial intelligence because you’ll see that it’s my voice, but it’s a fraud.”<\/p>\n

Another disinformation campaign falsely claimed Sheinbaum was born in Hungary or Bulgaria<\/a> \u2014 not Mexico \u2014 stemming from her Jewish heritage and grandparents’ emigration from Eastern Europe. She was forced to publicly display her birth certificate.<\/p>\n

YouTube Disinformation Networks:<\/strong> Animal Pol\u00edtico reported<\/a> in February 2024 that at least four YouTube channels \u2014 one with 351,000 subscribers \u2014 were “systematically” sharing inaccurate claims about L\u00f3pez Obrador and Sheinbaum while promoting opposition candidate G\u00e1lvez.<\/p>\n

Attacks on Electoral Independence<\/strong><\/p>\n

Beyond disinformation, President L\u00f3pez Obrador spent years attacking Mexico’s independent electoral authority<\/a> (INE \u2014 Instituto Nacional Electoral), the institution that had enabled his own 2018 election victory.<\/p>\n

AMLO proposed cutting INE’s budget, reducing staff, and closing local offices. According to the Wilson Center<\/a>, AMLO used his daily morning press conferences to systematically attack “political opponents, the media, journalists, and any other person or entity who inconveniences him.”<\/p>\n

When the Supreme Court blocked his attempts to amend the Constitution and subjugate INE, the harassment continued. Critics compared the pattern to Donald Trump’s attacks on U.S. electoral institutions.<\/p>\n

U.S. lawmakers from both parties raised alarms<\/a>, with former Mexican Ambassador Arturo Sarukhan warning: “By 2024, policymakers in Washington may well be asking themselves, ‘How\u2014and when\u2014did we lose Mexico?’ This is how, this is when.”<\/p>\n

The Outcome<\/strong><\/p>\n

Despite the disinformation campaigns and institutional attacks, Mexico’s election proceeded. Claudia Sheinbaum won with approximately 60% of the vote<\/a>, becoming Mexico’s first female and first Jewish president.<\/p>\n

However, narratives attacking her appearance and alleging election fraud continued to circulate<\/a> even after her victory \u2014 demonstrating that the information environment remains contested.<\/p>\n

The Lesson<\/strong><\/p>\n

Mexico illustrates how domestic actors \u2014 particularly military and security services \u2014 can pose as significant a threat to information integrity as foreign adversaries. The Guacamaya leaks revealed a military establishment that had turned surveillance tools inward, monitoring citizens rather than protecting them, and actively manipulating online discourse to protect its own reputation.<\/p>\n

As researchers noted, the documents show the government is “more concerned about the opposition parties than it is of the narco”<\/a> \u2014 a damning indictment of misplaced priorities in a country plagued by cartel violence.<\/p>\n

The 2024 election showed both sides deploying bot networks and disinformation, with cross-border coordination from Spain and South America adding an international dimension. Mexico’s experience demonstrates that in the age of AI-generated deepfakes and coordinated inauthentic behavior, threats to electoral integrit.<\/p>\n

 <\/p>\n

Sources:<\/strong><\/p>\n