In October 1946, the International Military Tribunal at NurembergsentencedJulius Streicher to death for crimes against humanity. Streicher had commanded no troops, run no camps, and signed no deportation orders. His weapon was a newspaper. For 25 years, his publicationDer Stürmersaturated Germany with dehumanizing propaganda against the Jewish people, and the Tribunal found that this incitement, delivered week after week while the machinery of extermination did its work, constituted persecution. From its early jurisprudence, international criminal law has recognized that words, information, and instruments of communication can be weapons in a wider campaign against a civilian population, and those who wield those instruments can bear responsibility for the crime.
Eighty years later, the instruments have changed. The printing press has given way to digital technologies. Intrusive cyber tools can extract the entire contents of an individual’s phone; coordinated social media networks can direct harassment at chosen targets; and private information can be published online, exposing a person or group to heightened threats. The law has not changed, and it does not need to. However, it needs to be enforced.
Last October, Iwroteabout the Rome Statute in the Digital Age, arguing that the statute’s provisions are broad enough to capture cyber-enabled crimes if practitioners recognize the functional equivalence between digital and physical means of persecution. Two months later, on Dec. 3, 2025, the Office of the Prosecutor (OTP) of the International Criminal Court (ICC)issuedits firstPolicy on Cyber-Enabled Crimes under the Rome Statute, the first major policy response by an international prosecuting authority to the impact of new technologies on its mandate. The Policy confirms that crimes within the Court’s jurisdiction may be committed or facilitated wholly or partly through cyber means, and it names the relevant conduct with unusual directness: intrusive surveillance, including AI-powered surveillance, information operations intended to cause mental harm, and the targeting of those who work to expose wrongdoing. As the free expression NGOARTICLE 19 observedat the launch, the Policy recognizes that such acts may amount to international crimes, including the crime against humanity of persecution, and not merely serve as precursors to them.
The OTP’s policy, however, is aspirational. Its value will only be determined by the situations in which it is applied. The question practitioners should be asking is where the paradigmatic case of cyber-enabled persecution can be found: a situation in which digital tools were not incidental to an attack on a civilian population but constitutive of it, the evidentiary record is deep enough to justify the Office’s attention, and the gravity is beyond serious dispute. After a multi-year investigation, my team at the Human Rights Center at UC Berkeley School of Law (where I worked throughout the course of this investigation) has assembled a record that we believe presents that case and warrants a preliminary examination. That case is Mexico, which has drawn sustainedinternational attentionfor both thescale of violenceagainst journalists and human rights defenders and the state’sunlawful surveillanceof them.
Hundreds of Incidents, One Crime
The factual findings of our investigation are available on a newly launchedevidentiary platformfocused on the six-year presidency of Andrés Manuel López Obrador, from December 2018 to September 2024, during which Mexico was the most dangerous country in the world for journalists and the second most dangerous for human rights defenders.
Based on our methodology, which involved deconflicting existing counts and verifying recorded incidents, 78 journalists and 259 human rights defenders were killed during the relevant period, a total of337 victims. The numbers alone are staggering, but the central finding does not rest on the numbers. It rests on their systematicity and the context in which they occurred: the killings were the visible edge of a broader attack on the same group, one the state openly encouraged and rarely punished. In our investigation, we treated journalists and defenders as a single collective defined not by profession but by the function they play in a democracy as civic watchdogs reporting or advocating in the public interest. Where a figure applies only to one group or the other, this article specifies.
Our findings revealed five interlocking instruments attributable to the state could constitute a campaign of persecution. From the presidential podium, at his daily morning press conferences known as themañaneras, López Obradorstigmatizedand singled out journalists by name, branding them enemies of the state. ARTICLE 19recordedat least 176 stigmatizing statements by the executive in 2022, the deadliest year on record for the Mexican press. Our ownanalysisof López Obrador’s six-year term, assisted by AI tools, flagged2,827 segmentsacross1,437 of the president’s press conferencesthat defamed or discredited journalists using vocabulary such asprensa fifí,chayoteros,hampa del periodismo(elite press, bought press, underworld of journalism). State-affiliated bot networks, including one run through the state news agency Notimex, converted that rhetoric intoorchestrated harassment, combining death threats, sexualized abuse, and the publication of private information, or doxxing. A secret Military Intelligence Center within the Defense Ministry (SEDENA)deployedNSO Group’s Pegasus spyware and other surveillance tools such as Rayzone’s Geomatrix against journalists, human rights defenders, and even the government’s own oversight investigators, without judicial authorization and without any statute empowering the armed forces to intercept private communications. Government officialsfiledwaves of baseless criminal complaints and civil suits designed to exhaust critics financially. And over all of it stoodimpunitybetween roughly 93 and 99 percent for crimes against journalists, an absence of consequence so consistent that it functioned as a message: attacking the press carried no price. Impunity at that level is a strong indication that Mexico is either unwilling or unable to investigate and prosecute crimes against this specific civilian group.
It is not for a lack of evidence. TheEjército Espíainvestigations by R3D, the Citizen Lab, and Mexican media documented the military’s Pegasus infections. The Guacamaya leak, a 2022 hack that placed roughly six terabytes of internal SEDENA records in the public domain, exposed the procurement trail and the circulation of intercept briefings to the top of the institution. A federal tribunal ruled in April 2025 that themañanerasegment devoted to branding journalists as liars, “Quién es quién en las mentiras de la semana” (Who’s who in the week’s lies), was unconstitutional. Viewed separately, they are scandals. Viewed together, they display a pattern that could be described as a widespread or systematic attack against a civilian population under the Rome Statute. Whether the pattern amounts to crimes against humanity is a question a preliminary examination and official investigation could answer.
Why Persecution Is the Right Charge
Article 7(1)(h) of theRome Statutedefines persecution as the intentional and severe deprivation of fundamental rights contrary to international law, by reason of the identity of a group or collectivity, committed in connection with other acts or crimes within the Court’s jurisdiction and as part of a widespread or systematic attack against a civilian population. Three features of this definition make it the appropriate organizing charge for the Mexican record, and for the broader category of state repression it exemplifies.
First, persecution is the crime international law built for cumulative harm. Since Nuremberg, courts have recognized that acts which might not individually rise to the level of a crime against humanity can, in combination and in context, constitute persecution. As the International Criminal Tribunal for the former Yugoslavia held inKupreškić,persecutory acts “must not be considered in isolation” but “weighed for their cumulative effect.” This doctrine matters enormously for state repression that arrives as a thousand cuts rather than a single massacre. No single Pegasus infection, defamatory press conference, or vexatious lawsuit is an atrocity. A six-year course of conduct combining all of them, directed at an identifiable group, with lethal violence, can constitute one.
Second, persecution names the group and the grounds. The victims in Mexico were not attacked at random. They were reporters covering organized crime, corruption, and the security forces, and defenders documenting the state’s abuses, targeted precisely because that work challenged those in power. Whether that is targeting on political grounds within the meaning of Article 7(1)(h) is yet to be determined, but existing jurisprudence on how such a group is identified makes a strong case for it. The targeted group may be defined by the perpetrator’s perception, not the victims’ self-description, and by who the perpetrator excludes rather than by any shared characteristic of the excluded. The ICC has authorized an investigation into persecution on political grounds inKenyaand convictedDominic Ongwenof the same crime, in each case for attacks on civilians perceived as political adversaries. López Obrador did not attack journalists and defenders as such. Rather, he attacked them as everything that opposed him: adversaries of his leftist Morena party and opponents of the Fourth Transformation movement.
Third, the connected-crimes requirement can be met. Persecution under the Rome Statute must be committed in connection with other prohibited acts, and in Mexico the record includes connected acts of murder, enforced disappearance, and other inhumane acts causing serious mental and physical harm. In at least one documented case, the connection is a straight line. In August 2022, a journalist in Guerrero,Fredid Roman, who had just published a column criticizing the president over the Ayotzinapa investigation, was targeted with an exploit used to geolocate his phone; he was shot dead outside his home the following day. In other cases, the instruments converged on the same person.Raymundo Ramos, a human rights defender documenting army killings in Nuevo Laredo, was hacked with Pegasus by SEDENA’s Military Intelligence Center, his private conversations with reporters summarized in briefings that circulated to the top of SEDENA. The day after, the president singled out news anchorCiro Gómez Leyvain hismañanera,telling the audience that listening to him would cause brain tumors, gunmen opened fire on the anchor’s car near his home; only his vehicle’s armor saved him. The point is not that any single official ordered each act. It is that the same critics who were denounced from the podium were the ones surveilled, harassed, sued, and, at the campaign’s lethal edge, killed.
What the Cyber Policy Adds
The OTP’s new Policy contributes two things, one doctrinal and one evidentiary.
Doctrinally, it removes the argument that digital conduct is categorically different from kinetic conduct, and thus a matter for human rights bodies rather than criminal prosecutors. The Policy states plainly that the material elements of Rome Statute crimes can be met by conduct in cyberspace, it identifies intrusive surveillance and coordinated information operations as conduct that may form part of persecution, and it recognizes that persecutory deprivations need not be physical. The theory of liability is old, but the instruments of the crime are new. Pegasus strips away the confidentiality on which journalism depends and exposes every source and family member reachable through a compromised device; operators who failed to breach the phone of journalistCarmen Aristeguiturned to targeting that of her teenage son. And, as the clinical documentation in our record shows, it inflicts psychological harm that victims describe as living permanently inside an interrogation. A tool with those effects, deployed systematically against a protected group, is not surveillance in any ordinary regulatory sense. It is an instrument of persecution.
Evidentially, the Policy recognizes that activity in cyberspace can supply proof of the attack’s policy element and of individual responsibility. Here the Mexican situation is not merely a viable test case but an extraordinary one, because the state documented its own campaign. TheGuacamayaleak preserved the military’s own records: a 2019 acceptance letter for the spyware contract addressed to Secretary of National Defense,Luis Crescencio Sandoval González; classified intercept briefings circulated to the highest levels of SEDENA; and the intelligence unit’s own threat assessments identifying public exposure as a primary institutional risk. Sandoval González met with López Obrador at 6 a.m. nearly every weekday of the six-year term, immediately before themañanera, so the president was likely read in on what the military knew. Digital persecution generates archives. Those archives are linkage evidence of a kind atrocity prosecutors rarely possess, speaking directly to individual responsibility under Articles 25 and 28 of the Rome Statute. It is the digital record, more than any witness, that carries the case up the chain of command to the most senior officials in the country.
The Line Between Surveillance and Persecution
If unlawful surveillance of journalists can constitute a crime against humanity, one objection may run, does the theory sweep in every government that has misused spyware? It does not. The contextual elements demand a widespread or systematic attack pursuant to a state or organizational policy; the connected-crimes requirement demands linkage to other prohibited acts; and the Court’s gravity threshold reserves its docket for the most serious situations. An isolated infection, or even a pattern of abusive monitoring, will rarely meet that bar. The situation in Mexico warrants examination because the surveillance did not stand alone. There is substantial evidence that it was one working part of a machine whose other parts included stigmatization, harassment, and grave physical violence against members of the same group, at a scale, duration, and breadth no counting methodology can reduce to coincidence. The state’s own data logs public servants as the probable aggressor in roughly43 percentof the killings it documented. The line that exists between a surveillance scandal and cyber-enabled persecution is real, and there is evidence to support an argument that, in Mexico, the targeting of journalists and human rights defenders has crossed it.
The harder question is whether the connection between these instruments exists beyond mere inference, given that Mexico’s journalists and defenders are frequent victims of organized crime violence. The Rome Statute does not require that all 337 murders were directed from a central figure, but the policy element demands that a state “actively promote or encourage” an attack on a civilian population or, in certain circumstances, deliberately fail to act to prevent it. ICC judges have held that the policy element need not be formalized and may be inferred from the repetition of acts and the mobilization of state resources. Which killings fall inside that attack and which fall outside is a question for prosecutors. Our platform offers75 case filesdetailing incidents of killings, enforced disappearances, and grave physical violence that could provide an answer.
A candid word must also be said about the Court itself. The ICC is under the most sustained political attack of its existence: its former Prosecutor has been removed, its judges and deputy prosecutors have been sanctioned, and member states are heading for the exits. Some will ask whether this is the moment to press the Court to take on new challenges. The answer is that it is precisely the moment. The Policy on Cyber-Enabled Crimes was written by this Office and launched by its current leadership as proof that the Court can meet repression in its current forms. A policy never put into practice is little more than a press release. A policy applied to a record as documented as Mexico’s would demonstrate that the Rome Statute reaches repression as it is actually practiced. A successful outcome does not depend on a trial in The Hague. Colombia sat under preliminary examination for 17 years, and the examination itself helped catalyze and protect domestic accountability. An examination into Mexico would place a justice system with near-total impunity under scrutiny it has never faced, and hand every Mexican prosecutor, judge, and reformer a reason to act.
The Oldest Charge, the Newest Tools
The tools deployed against Mexico’s journalists are in global circulation, and Mexico was ground zero: the Mexican military wasNSO Group’s first Pegasus client, in 2011, and it has been aprolific userof spyware ever since. Commercial surveillance technology sold for national security purposes isroutinely repurposedagainst reporters, activists, lawyers, and political opponents. Governments that hold elections and sign human rights treaties increasingly treat a critical press as a security threat. The same methods are advancing within established democracies. What Mexico offers, grimly, is the complete picture of what it looks like when the full digital arsenal is integrated into a campaign of persecution and no institution pushes back.
The Tribunal that judged Streicher understood that the crime of persecution is defined by its purpose and its effect, not by the instruments that aided its perpetration. A newspaper sufficed as such a tool in Germany in the 20th century. Spyware, botnets, and a public podium should suffice in Mexico in the 21st century. The Office of the Prosecutor has now told the world, through its policy, that it understands this. The record that would help it prove the potential impact of that policy has been assembled. What remains is the will to examine whether one of the oldest charges in the modern canon reaches the newest tools of repression, and there is no better place to begin than the country where Pegasus was first launched against its civilian population.
FEATURED IMAGE: President of Mexico Andres Manuel Lopez Obrador speaks during his last daily morning briefing at Palacio Nacional on September 30, 2024 in Mexico City, Mexico. President-elect Claudia Sheinbaum will take office tomorrow. (Photo by Manuel Velasquez/
