Mexico’s use of spyware made by NSO Group is facing new scrutiny following the arrest of a businessman on allegations that he used the surveillance tool to spy on a journalist. The arrest of the businessman – who has not formally been named by Mexican prosecutors – comes months after a consortium of media outlets, including the Guardian, published a series of reports detailing how the phone numbers of thousands of Mexicans, including 50 people linked to the country’s current president, Andrés Manuel López Obrador, appeared on a leaked list of numbers selected by government clients of the Israeli spyware company for possible surveillance. Journalists, as well as lawyers, activists and prosecutors also appeared on the list. In the wake of the stories by the Pegasus project, Obrador called his predecessors’ alleged use of spyware “shameful” and said his own government would bar use of the surveillance tool. Mexican press freedom group Article 19 hailed the arrest, and expressed hopes it would lead to the identification of those responsible for the abuse of spyware in Mexico and around the world. “We hope this will be the first step towards unraveling the framework of the illegal and abusive use of a [spying] tool which infringes the most elemental principles of privacy, intimacy and fundamental rights,” the group said in a statement. The arrest marks the first legal action in the country against an individual accused of being linked to the alleged cyber-spying campaign. Media reports said the man was linked to a company that served as an intermediary between NSO and Mexican authorities. Mexico is known to have been one of NSO’s first clients. About 30 contracts were reportedly signed by the governments of President Felipe Calderón and President Enrique Peña Nieto between 2006 and 2018, though officials say some of the contracts appear to have been disguised as equipment purchases. Mexican authorities have said that the country has spent about $300m in government contracts to buy spyware in the past. Santiago Nieto, who head’s Mexico’s Financial Intelligence Unit, has said purchases of spyware appear in at least some cases to have included excess payments that may have been used to pay kickbacks to government officials payments. A spokesperson for NSO said: “As stated in the past, NSO’s technologies are only sold to vetted and approved government entities, and cannot be operated by private companies or individuals. We regret to see that, over and over again, the company’s name is mentioned in the media in events that has nothing to do with NSO, directly or indirectly.” The Israeli company has faced a barrage of bad news is recent days, from a decision by the Biden administration to place the company on a US blacklist, and a US appeals court ruling which rejected NSO’s “sovereign immunity” defence in a case brought by WhatsApp. The company has said its spyware – which can hack into phones and remotely control them – is used by its government clients to target terrorists and other serious criminals. It has said it investigates serious allegations of abuse and that the leaked list at the heart of the Pegasus project is not a list of the company’s clients’ targets.