Score Change: The score improved from 4 to 5 because the number of people with internet access increased, according to some sources.

Eight years after the government introduced reforms to reshape the telecommunications industry, Mexico has made notable improvements in internet connectivity, quality of service, and prices.1 Infrastructure policy decisions continue to reflect official interest in bringing internet access to marginalized communities; however, the real-world impact of these changes remains to be seen in some regions, as the country suffers from a wide digital divide between urban and rural communities (see A2). According to the latest data from the International Telecommunication Union (ITU), as of 2019, internet penetration in Mexico was just over 70 percent.2 The share of Mexicans with fixed-line internet subscriptions has increased over the past decade, growing from 8.6 percent in 2010 to 16.21 percent in 2020. However, Mexico still falls significantly below the rates of other countries in the Organisation for Economic Co-operation and Development (OECD), which average 32.52 percent.3

While Mexico’s mobile penetration rate lags behind other countries in the region, the number of users has increased, reaching more than 96 million in 2020.4 Two mobile service providers, Movistar and AT&T, announced plans to switch off their second-generation (2G) technology for mobile networks by 2021, enabling them to repurpose spectrum for fourth-generation (4G) technology.5 The provider Telcel continued to offer 2G coverage. Reports estimated that there were still 27 million 2G users in Mexico as of February 2019, the year that providers first announced the end of 2G coverage.6

In February 2021, users reported access to fifth-generation (5G) technology in various parts of the country. However, different stakeholders in the telecommunications industry have publicly commented on the obstacles to extensive 5G mobile network coverage: the high taxation rate for 5G providers proposed by Congress, the lack of infrastructure, and the insufficient release of the 5G frequencies in the 2021 industry tender.7 In October 2020, the Federal Telecommunications Institute (IFT) called on the Senate to consider lower taxation for 5G providers, which exceed IFT’s proposed rates by 186 percent.8 The final tax package approved by Congress includes tax rates that are lower than originally proposed, but still higher than the previous year’s by 7 percent.9

Telecommunications reforms introduced in 2013 were designed to substantially reshape the industry and increase internet access. The reform package, conceived under former president Enrique Peña Nieto, sought to develop a wholesale wireless network (Red Compartida) and a fiber-optic backbone network (Red Troncal) using more than 25,000 kilometers of fiber-optic strands that belonged to the Federal Electricity Commission (CFE), the state-owned electricity utility. Developments under the presidency of López Obrador reflect a change in strategy, with a new focus on regions yet to be connected and a discontinuation of the landmark initiatives introduced during Peña Nieto’s mandate: México Conectado public access points (see A2) and the development of Red Troncal.10

The development of Red Compartida has continued under López Obrador. In March 2018, the consortium in charge of the project, Altán Redes, launched operations with the ultimate goal of reaching more than 92 percent of the population by January 2024.11 In February 2021, López Obrador announced an agreement between the government and the three biggest telecommunications providers to use Red Compartida infrastructure to offer fourth-generation plus (4.5G) services to localities with under 5,000 inhabitants.12 During the coverage period, Altán Redes reached over 50 percent of its coverage goals, providing coverage for over 72,000 localities with under 5,000 inhabitants,13 having invested more than one billion in telecommunications infrastructure for Red Compartida as of May 2021.14 However, industry representatives have criticized the network for duplicating coverage in areas that are already served by mobile providers,15 while Altán Redes’s leadership has blamed Ministry of Communications and Transportation (SCT) bureaucracy for slowing the network’s deployment.16

A tender to develop the Red Troncal was delayed in 2018, and eventually the government announced it was suspending the scheduled tender in August 2019.17 This decision followed the formal announcement of a new nonprofit state company called CFE Telecomunicaciones e Internet para Todos, tasked with envisioning a new strategy to offer broadband in underserved areas.18 In August 2019, IFT granted CFE Telecomunicaciones a concession for public use to provide not-for-profit telecommunications services.19 In June 2020, Raymundo Artís Espriú, the head of CFE Telecomunicaciones, stated that it does not intend to provide home internet access and will instead focus on connecting hospitals, community centers, schools, and public spaces.20 In May 2020, CFE Telecomunicaciones signed a contract with Altán Redes to become a mobile virtual operator on Red Compartida, foreseeing the installation of 2,000 fixed-line connections at 1,000 sites in rural communities.21

In January 2020, the Ministry of Communications and Transport announced a future tender for satellite internet access providers to connect 1,200 public access points across the country, projecting an eventual total of 19,000, to be primarily connected through fiber-optic lines.22 Some of the locations would be connected through Red Compartida; in June 2020, Hispasat, a Spanish satellite company offering coverage in Latin America, entered an agreement with Altán Redes to provide satellite links to connect 65 new Red Compartida base stations in areas where the roll-out of land-based infrastructure is not viable.23

In April 2020, President López Obrador called for the cancellation of over 300 public trusts as an austerity measure in response to the COVID-19 crisis; one of these trusts was e-México, which was designated in 2001 to fund the country’s connectivity efforts,24 and which had close to 7 billion pesos ($360 million) still available in March 2019.25 In October 2020, the Senate voted to close e-México and 108 other trusts.26

Despite growing internet penetration, the digital divide between urban and rural regions has remained significant: in 2020, 78.3 percent of the urban population were internet users, while only 50.4 percent of the rural population accessed the internet.27 Ethnic and linguistic divides are also significant, and the high costs to secure access presents an obstacle for lower-income Mexicans.28 A 2020 national survey estimated that more than 10 million individuals in rural areas do not have mobile phones, nearly half of them because of financial reasons; potentially more than two million mobile phone users in rural regions do not have internet connection on their phones.29

Prohibitive costs have kept around 55 percent of lower-income Mexicans from accessing the internet, according to the freedom of expression watchdog Article 19’s March 2021 report.30 Though average prices for mobile data packages have dropped in recent years, they remain some of the highest in the region. According to UK-based company Cable, the average cost of 1 GB of mobile data was $3.62 in 2021, a steep decline from the average cost of $15.05 in 2019.31 On the other hand, Cable found the average monthly cost of fixed broadband in Mexico to be the cheapest in Central America in 2020, at $29.01.32

Indigenous communities, who represent more than 15 percent of the country’s population, also face a digital divide in mobile coverage. Of the over 65 different Indigenous peoples present in Mexico, according to Indigenous rights organization International Work Group for Indigenous Affairs (IWGIA),33 only two had full 2G, 3G, and 4G coverage and 45 percent of Indigenous people connected primarily through the 2G network as of December 2020.34 Major providers’ recent efforts to switch off 2G and repurpose spectrum for 4G technology may disproportionately impact these communities (see A1).

Network providers that serve Indigenous communities continue to operate with 2G technology, however. In May 2020, Telecomunicaciones Indígenas Comunitarias AC, a provider that offers mobile phone and data services to households in rural and Indigenous communities, asked IFT to grant a spectrum concession that would allow Indigenous providers to use licensed spectrum as a way to overcome saturation caused by social-distancing measures enacted in response to COVID-19.35 In November 2020, the provider was granted a permit to operate on the 10 gigahertz (GHz) band, which would enable them to provide 4G coverage.36

Civil society responses to internet access challenges have continued to flourish in Indigenous communities. A pilot project launched in November 2020 saw the nongovernmental organizations (NGOs) Equitable Origin and Consejo Regional Indigena y Popular de Xpujil (CRIPX) partner with HughesNet, a satellite internet service provider, to connect Indigenous communities to the internet using satellite technology.37 During the COVID-19 crisis, which further exposed inequalities in internet access for Indigenous people, the Tayolchikawalis Initiative launched an online platform and communications campaign in the Nahuatl language for information on the pandemic. The NGOs CEPOS Media Lab and Herramientas para el Buen Vivir worked with rural teachers in Oaxaca to create a platform for online learning for students.38

However, the government’s efforts to improve internet access among Indigenous and rural communities has not been successful, as Article 19 reiterated in a March 2021 report. Civil society groups have advocated for government efforts to improve reporting on data, support local content production, create a simple and agile licensing system, and improve governance of frequencies.39 Though President López Obrador’s administration initially promoted reducing the digital divide as one of its top priorities,40 its actions have at times been counterproductive. In August 2020, the Subsecretary of Communications and Technological Development, which oversaw the initiatives that would improve internet access for Indigenous and rural communities, was dissolved.41 By December 2020, the government had overseen the closure of all public access points implemented under the previous administration’s México Conectado (Connected Mexico) program, without announcing plans for their replacement.42

There were no reports of government-imposed restrictions on connectivity during the coverage period. Article 190 of the 2014 Telecommunications Law, however, authorizes the “appropriate authority” within the government to request the suspension of telephone service in order to “halt the commission of crimes.”43

Although most of the backbone infrastructure is privately owned, the state-owned company Telecomunicaciones de México (Telecomm) plays an important role, having taken over fiber-optic infrastructure from the CFE at the end of 2014.44 Mexico’s first internet exchange point (IXP) was set up by KIO Networks in April 2014. It increases efficiency and reduces costs for Mexican internet service providers (ISPs) by helping to manage traffic across networks.45 In 2018, the Ministry of Communications and Transport and the Yucatan state government signed an agreement to build the next IXP in Mexico;46 after a local government transition and an extensive community-building and training process,47 it began to operate in February 2021.48 Before this development, in 2020, Mexico ranked 20th out of 22 countries in the Americas for its rate of 0.0008 IXPs per million inhabitants.49

Reforms over the past decade have sought to improve the information and communication technology (ICT) market by reducing market dominance and barriers to investment. Under 2013 constitutional amendments, telecommunications companies that control more than 50 percent of the market are subject to antitrust measures by the regulator.50 IFT has made recent moves to curtail the country’s dominant players, including with a December 2020 resolution that imposed new financial restrictions for a leading company, América Móvil, that included curtailing user charges for unlocking devices and out-of-network roaming, as well as the end of promotional prices.51 New customers have started to be offered services through the wholesale wireless network Red Compartida, in order to spur competition. The Mexican company GuruComm was the first to launch its retail services through the Red Compartida in August 2018, followed by Internet ON from Dish.52

Despite some changes, however, the ICT market remains dominated by a few players. In the second quarter of 2020, the mobile internet provider with the largest market share was América Móvil with 70.8 percent, followed by AT&T with 16.1 percent, and Telefónica with 10.6 percent. In the fixed-line broadband market, América Móvil led with 48.4 percent, followed by Grupo Televisa with 24.8 percent, and Megacable MCM with 15.9 percent.53

In 2017, the Supreme Court cancelled the “zero rates” law imposed on América Móvil, which enabled competitors such as AT&T and Telefónica to use its network free of charge.54 By the end of that year, to comply with the Supreme Court’s decision, IFT established an interconnection fee that rival companies have had to pay to América Móvil since January 2018.55 Critics perceived the ruling as a win for the dominant player against telecommunications reforms, and competitors warned about its impact on prices,56 though as of July 2021 the effects remained unclear.

However, during the coverage period, the Supreme Court ruled against an IFT decision that could further the ICT market’s concentration. In 2018, IFT ordered Telecomunicaciones Indígenas Comunitarias AC to pay almost 1 million pesos ($49,742) for using radio spectrum resources to provide mobile services to Indigenous communities in Oaxaca from 2016 to 2018, which the company appealed.57 In January 2021, the Supreme Court granted the ISP’s appeal.58

The creation of a state-run service provider, CFE Telecomunicaciones e Internet para Todos, that has been allowed to operate as a public not-for-profit company (as opposed to the public-private partnerships that operate Red Compartida and would have operated Red Troncal), has sparked concern from civil society groups regarding the lack of checks and balances in allowing the state to be both a service provider and a regulator.59

As part of the 2013 constitutional reform, the government established IFT as a new autonomous regulatory agency to increase the transparency of media regulation.60 IFT has the legal mandate to act as an antitrust body, protecting the industry against monopolistic practices. However, during López Obrador’s term, IFT and other independent bodies became regular targets of government pressure that have included sizable budget reductions.61

In June 2020, Ricardo Monreal, the Senate leader of López Obrador’s party, proposed merging IFT with two other regulators: the Energy Regulatory Commission (CRE) and the antitrust regulator, the Federal Economic Competition Commission (COFECE). President López Obrador expressed his support for this initiative.62 Civil society organizations published a statement objecting to the proposal, arguing that it would reduce the independence of an important regulator that they had spent two decades lobbying the government to create.63 Monreal later announced the proposal was indefinitely postponed.64

In January 2021, President López Obrador announced a planned reform to incorporate IFT and the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI) into the federal government, removing their autonomy.65 Later that month, Economy Secretary Tatiana Clouthier announced that the president had decided not to dissolve IFT or COFECE. Notably, she did not mention any developments on his plans for the INAI (see C1 and C6). 66

Despite threats to IFT’s autonomy and some questionable decisions on antitrust measures and draft net neutrality guidelines in recent years, the body has continued to reaffirm its independence through decisions made during the coverage period. In May 2021, IFT challenged the creation of a biometric cell phone registry—one that Congress had directed the agency to create, operate, and maintain—as unconstitutional (see C4).67 Previously, IFT had named in 2014 América Móvil and Televisa as the dominant companies in the telecommunications and television sectors, respectively. However, the agency has received criticism for its role in reversing some antitrust measures and complying with the Supreme Court decision to revoke the designation of Televisa as a dominant company in subscription television.68 In November 2019, the Supreme Court revoked further IFT rulings on Televisa, specifically its obligation to carry other television companies’ content on its devices.69

From 2019 to 2021, IFT received criticism for its Traffic Management and Internet Administration Guidelines, which civil society actors have claimed is an attempt to undermine net neutrality in Mexico (see B6 and B8).70 In 2017, IFT was also criticized for authorizing América Móvil’s Telcel to exploit 60 MHz of the 2.5 GHz spectrum band.71 Associations including the Telecommunications Law Institute (IDET) and the Competitive Intelligence Unit (CIU) argued that this move in fact reinforced the dominant player, contradicting IFT’s mandate to guarantee competition and equal conditions for all agents in the sector.72

There has been no documented evidence that the government or other actors block or filter the internet or any other ICT content. Social networking sites and international blog-hosting services are available in Mexico.

Score Change: The score declined from 3 to 2 because of the increasing number of politically motivated content takedowns and removals, including against outlets and journalists for election-related content during the coverage period.

Politically motivated content removals have increasingly been documented in Mexico. These requests are issued by federal actors to social media platforms, individual users, and web hosting providers. Their requests, like those of nonstate actors, largely rely on alleged violations of copyright or terms of service as well as local and electoral laws. The full scope and nature of government requests to remove content remains unknown, as the government hugely underreports their numbers. Article 19 estimates that only 14 percent of government removal requests reported by social media platforms on their transparency reports have been declared by various government offices through freedom of information (FOIA) requests.73 With over 12,000 Facebook content removal requests between 2017 and 2020, the Mexican government ranks ninth on the platform’s global list of countries with the most content removal requests.74

Ahead of the June 2021 legislative elections, various actors sought to have political content removed from social media platforms by alleging certain content violated copyright rules.75 In March and April 2021, multiple news outlets in the state of San Luis Potosí reported that copyright infringement allegations had been used to remove their Facebook content related to elections and, later, their content denouncing the removals. For example, news outlet La Orquesta.mx livestreamed a session of the State Electoral and Citizen Participation Council that was taken down. After various outlets held a livestream to report the takedown of the council meeting, this content was also removed.76

Legal threats were also wielded to compel media outlets and journalists to take down content from their websites ahead of the legislative elections. In March 2021, journalist Dianeth Pérez Arreola received a letter from the office of the Special Prosecutor for Attention to Electoral Crimes of Baja California, requesting she remove all content regarding a local political candidate, Natalia Rivera, from her news outlet’s website. Pérez Arreola, who is the founder of Yo Rechazo la Corrupción y la Impunidad, also received notices from the office of the state prosecutor of Baja California and from the Special Prosecutor for Electoral Crimes of Sonora weeks later ordering her to avoid posting content about Rivera. The prosecutors claimed that reporting critically on Rivera as a candidate would violate a law meant to combat gender-based violence—the Sonoran General Law for Women’s Access to Life Free of Violence. Pérez Arreola took much of the content down.77

Political figures also allege violations of privacy regulations and copyright complaints in line with the problematic July 2020 reform to the Federal Copyright Law to request that platforms restrict content (see B3). Between October 2020 and April 2021, YouTube temporarily removed or restricted at least eight videos from the La Voz de Julio channel, most of which related to the financing of government officials or public figures. Article 19 denounced the removals as against public interest. In October 2019, Héctor Llorame published a Twitter thread about inconsistencies in the registered office addresses of local legislators, some of which led to vacant lots or nonexistent locations; he had shared photographs of his freedom of information requests to the state government of Puebla. His account was blocked and the content, including the government documents, was removed on the grounds that they were privacy violations.78

Takedowns requests are also issued directly to web hosting providers. In March 2020, Pedro Canché, Mayan journalist and director of online outlet Pedro Canché Noticia (see C7), found that GoDaddy had taken down his news site, NOTICIASCANCUN.MX. When Canché inquired with the server about the removal, they told him that an unidentified third party had alleged copyright infringement.79 Two months earlier, another hosting provider, Digital Ocean, removed the website of another news outlet for similar reasons. In 2018, online news outlet Página 66 received threats of legal action for trademark infringement from representatives of Grupo Altavista, regarding a report that mentioned information about alleged financial fraud. The outlet received a request from its hosting provider Digital Ocean to remove the relevant article in December 2019, on the grounds that it violated Grupo Altavista’s and its chief executive’s right to “honor.” Digital Ocean followed up with a takedown request in January 2020, took down the entire Página 66 website, and restored it in February 2020 without the article in question.80 The complaint sent to Digital Ocean, which hosts Página 66 on a US-based server, was grounded in the US Digital Millennium Copyright Act (DMCA).81

Facebook content restrictions between January and December 2020 included 130 items related to violations of electoral law; 83 pieces of content related to a video of a shooting at a school in Monterrey; 13,158 items in response to reports from the Federal Commission for Protection against Sanitary Risks; 6 items that allegedly violated article 134 of the Mexican constitution regarding government spending and propaganda; and 6 items based on private defamation reports.82 Twitter registered 199 removal requests in 2020, up from 43 the previous year; only 4 of the requests came with a court order. The platform complied with just under 65 percent of requests.83 Google reported removal requests for 91 items during the same period, ostensibly due to copyright infringement, defamation, fraud, and privacy and security, among other alleged reasons.84

Despite some ambiguity in the legal and regulatory framework, it and the independent courts offer significant safeguards against arbitrary or opaque restrictions on content, and past attempts to impose new restrictions have faced strong opposition. In 2017, the Supreme Court declared that blocking an entire website because of alleged copyright violations was unconstitutional, finding it to be a disproportionate measure that infringed on freedom of expression.85

However, the 2020 reform of the Federal Copyright Law regarding intermediary liability largely negates the protection that the courts have previously provided, mandating the arbitrary removal of any content alleged to violate copyright law, without evidence or judicial authorization. The reform establishes “notice and takedown” provisions that require online platforms and hosting services to remove any content requested by a copyright holder alleging infringement, without need of judicial authorization or evidence. The intermediary can face fines ranging from 1,000 ($50) to 2,000 ($100) pesos should they fail to comply. The law also empowers those alleging copyright infringement to obtain personal information on the individual accused of posting the offending content, without proof or protective provisions for the alleged offender. Moreover, the reform places the burden on users to prove that content was removed illegitimately, and on platforms to inform takedown requestors about appeals. Additional provisions require internet services to take measures to prevent prior removed content from being uploaded to their respective service a second time, essentially mandating filters; noncompliance can result in fines. Civil society organizations have criticized the changes for their potential to promote censorship online and endanger users accused of infringement.86

This reform is part of a series of legislative attempts to further introduce intermediary liability provisions in Mexican legislation, which have been largely unsuccessful. A separate Federal Copyright Law reform bill was introduced in April 2020 to add a special tax on digital devices; the revenue would then be redistributed to copyright holders as a form of compensation. The bill also proposed the elimination of the fair-use exemption from the law.87 Congress voted down the proposed law in April 2021.88

A problematic February 2021 legislative proposal would limit the transparency and proportionality of removals, but had not been passed by June 2021. The bill would empower IFT to oversee social media companies’ content moderation practices, with the final say on content moderation disputes, and to overrule their decisions on content removal. The body would be allowed to change platforms’ terms of service and establish other rules on general operations and allowable content. They would also be able to dole out fines up to $4.4 million to platforms, should they fail to comply. The proposed regulations would apply to platforms with over one million users, which would need to request and receive permission from IFT to operate. Platforms would also be required to censor speech upon IFT demand, including vaguely defined “hate speech,” “fake news,” and speech that goes against “order and public interest.” Conversely, platforms would be prohibited from censoring content not outlined in the bill, and the appeals system against content removal would begin with the platforms, move to the telecommunications regulators, and then to the courts.89

A group of digital and human rights organizations published a letter opposing the bill for its risk to free expression, regulatory burdens, and indiscriminate censorship, and called for multistakeholder debate on digital platform regulation through open parliament sessions.90 If passed, the bill could also increase media concentration, as the threat of fines might keep smaller platforms from operating. Further, the bill’s provisions that grant IFT power to arbitrarily decide which platforms can operate and what content they can host could be used politically.91

There are currently no laws dealing with the so-called right to be forgotten (RTBF), but organizations have raised concerns about the murky use of RTBF-type requests to censor sensitive information.92 According to an interview with the founder of Eliminalia, a company dedicated to eliminating negative content from the web, the firm’s clients in Mexico doubled between 2015 and 2017.93 Plans for a bill that would support and strengthen RTBF claims were announced in December 2019, but President López Obrador declared at a February 2020 press conference that he was opposed to the measure.94 It was yet to be introduced to the legislature as of August 2021.

Independent digital outlets provide information about key political and social issues (see B7), though a climate of violence and harassment against the media contributes to some self-censorship, especially in states that are heavily afflicted by violent crime (see C7).95 Local media tend to refrain from reporting on drug trafficking and organized crime. A January 2020 study by the media freedom NGO SembraMedia noted that 21 percent of the digital outlets assessed admitted to avoiding covering certain topics, people, or institutions due to threats or intimidation.96

Freedom of the press organizations have documented cases of harassment against journalists intended to induce self-censorship, perpetrated by both public officials and private individuals who have been encouraged by President López Obrador’s regular attempts to discredit journalists. For example, in August 2020, Pablo Morrugares Parraguirre, the founder and editor of news website PM Noticias, was murdered by unidentified gunmen in his café minutes after ending a Facebook live broadcast alleging that a local gang was responsible for the murder of a taxi driver (see C7). The Committee to Protect Journalists says the murder had a profound effect on local press, who claimed to interpret the killing as a deadly threat toward others who report on gang activity.97

Mexico has a history of online trolls and automated “bot” accounts targeting discussions and reports that are critical of the government, political parties, or politicians.98 During the 2018 and 2021 election campaigns, journalists and researchers observed how bots and hired trolls were used to spread propaganda and disinformation, promoting progovernment candidates and attacking opposition candidates on social media.99 Further studies have documented coordinated social media campaigns and the manipulation of hashtags to discredit large protests (see B8).

Commonly dubbed “Peñabots” under the presidency of Peña Nieto, automated accounts were used prolifically by his Institutional Revolutionary Party (PRI) during the 2012 election campaign, and the party’s candidates further benefited from such networks ahead of the 2018 elections.100 However, partisan bots and fake accounts were active in promoting a number of political parties in 2018.101 Women candidates also reported smear campaigns against them that included manipulated videos and images, and in some cases discriminatory or sexualized content.102 Shortly before the 2021 election, a representative from SignaLab noted the rise of online manipulation and attacks, as well as the proliferation of fake news. The continued prominence of inauthentic accounts manipulating the online sphere was further illuminated by TwitterAudit, which estimated that over a quarter of President López Obrador’s Twitter followers were fake accounts; it also identified that just under a fifth of the accounts following one of his major opponents, former president Calderon, were fake.103

Throughout López Obrador’s term in office, his supporters have launched social media campaigns against journalists and users who questioned or criticized the president. A February 2019 report by Signa Lab detailed how a seemingly coordinated network of Twitter accounts formed by “semibots,” trolls, and fans spread attacks against government critics, using hashtags such as #chayoteros (referring to journalists who take bribes) or #PrensaFifi (snobbish press).104 The operation was known as #RedAMLOve, and in May 2019 Twitter suspended a network of accounts using that hashtag as part of the company’s international effort to combat coordinated inauthentic behavior on its platform.105 Signa Lab research published in October and December 2020 confirmed that supporters of the president had continued to use seemingly coordinated hashtag campaigns, including such behavior around feminist protests in September 2020 linked to the hashtag #fakeministas (see B8).106

In May 2020, Signa Lab, Aristegui Noticias, and Article 19 published a joint investigation on coordinated attacks perpetrated by Twitter accounts associated with Notimex, the government-run news agency, aimed at the outlet’s former journalists and a strike organized by Notimex workers.107 After revealing how the company coordinated the attacks, Article 19 and Aristegui Noticias were tipped off to other instances in which Sanjuana Martínez, the head of Notimex, called for the harassment of journalists who were critical of the agency.108 Proceedings initiated against Sanjuana Martínez and Notimex’s misuse of public funding and documented harassment campaigns against journalists have not ultimately led to investigations.109

While public awareness about online manipulation and the spread of disinformation has increased, efforts to tackle the problem have become more challenging given the widespread use of closed messaging platforms such as WhatsApp and Facebook Messenger.110 Fact-checking initiatives have sought to counter false information presented through official channels and other media. SPIN Taller de Comunicación Política, which fact-checked López Obrador’s daily press conferences, claimed that the president made 50,324 false claims in the first 867 days of his term.111 The outlet Verificovid has focused on combating false information during the COVID-19 pandemic; independent journalists and medical doctors teamed up to summarize official communications and debunk false news and materials circulated online.112

Scarce funding creates challenges for individuals and nonprofits seeking to establish sustainable online outlets. Reliance on advertising purchases by public institutions renders independent media vulnerable to content manipulation or closure due to withdrawal of funding,113 although the former appears to be the more pernicious of the two trends.114 The government has used lengthy tax audits as a “preferred tactic” to pressure media outlets, according to SembraMedia.115

In April 2018, Congress approved a Social Communication Law to regulate government spending on advertising.116 Critics of the law contend that it does little to change the status quo, as it lacks clear rules and facilitates discretionary public advertising.117 Media and press freedom groups have since continued to urge Congress to repeal the law in favor of clearer criteria for the distribution of official advertisements.118 Article 19 noted that 10 media and communication companies received 54 percent of the total official advertising budget in 2020, the rest of which was distributed to 387 other groups.119

Some media outlets have found alternative sources of funding. The news site Pie de Página, for example, successfully raised over half a million pesos ($26,000) through a crowdfunding campaign to continue their operations without relying on government advertisements.120 As independent media increasingly draw revenue from crowdfunding and online subscriptions, attacks against these outlets have targeted their subscription processes (see C8).121

Articles 145 and 146 of the 2014 Telecommunications Law establish protections for net neutrality. However, commercial agreements in practice allow differentiated prices depending on the destination of internet traffic. Service providers such as Telcel, Movistar, and AT&T offer zero-rating plans in which certain digital services like HBO, Netflix, WhatsApp, and social networking sites do not count toward a customer’s data allowance.122 For years, IFT failed to issue guidelines to protect net neutrality, despite its mandate to do so under the Federal Telecommunications and Broadcasting Law (LTFR). In 2019, R3D and OBSERVACOM appealed to the courts for IFT to act, and a judge ruled that the agency must issue traffic management and internet administration guidelines.123 In June 2021, IFT presented the Traffic Management and Internet Administration Guidelines,124 a policy which was criticized by a coalition of civil society organizations that argued that it lacked transparency and would allow for the paid prioritization of traffic, as well as threats to user privacy.125

Violence and economic constraints affect independent digital outlets in Mexico.126 Despite these challenges, independent outlets continue to emerge and operate, enriching the media ecosystem with alternative agendas that support human rights and the right to information.127 Examples include Lado B, an outlet created by freelancers and local journalists in Puebla, and Amapola, an outlet from Guerrero that questions the state’s narrative regarding criminal violence.128 The digital news outlet Animal Político has more than two million followers on Facebook and Twitter and is successfully experimenting with alternative forms of financing (see B6).129

Sustained efforts to create outlets that represent diverse experiences have also found success in Mexico. Homosensual is one of the most widely read LGBT+ websites in Latin America and was nominated for outstanding Spanish-language online journalism in the Gay & Lesbian Alliance Against Defamation (GLAAD) 2021 Media Awards.130

Mexico’s social media landscape is very dynamic. Even in the face of cyberattacks, harassment, and physical assaults, citizens make regular use of digital tools to raise awareness about human rights abuses related to violence in the country and to mobilize protests.

During the coverage period, a sustained movement against gender-based violence was organized on different online channels,131 leading to historic participation in street demonstrations and strikes on International Women’s Day in 2020 and 2021.132 Building on hashtags such as #YoTambién (Me Too), #MiPrimerAcoso (My First Harassment), and #SiMeMatan (If I Am Murdered)—as well as case-specific hashtags such as #JusticiaParaAlexis (Justice for Alexis)—feminist activists and collectives in Mexico and Latin America have used digital platforms to promote discussions about gender-based violence for the last several years. Increasingly, however, women who denounce abuses via online platforms face backlash in the form of threats or even physical violence.133 In its 2019 and 2020 annual reports, Article 19 alleged that the Mexican government continually used official channels to falsely portray feminist protesters as criminals, an official framing that permeated mainstream media coverage of the activists’ campaigns and coincided with extreme police brutality during demonstrations (see C7).134

In June 2020, as Black Lives Matter protests against racism took place in the United States and around the world, Mexican activists organized online to denounce institutional racism, police brutality, and the repression of protests in the wake of the murder of Giovanni López in Jalisco. López, a construction worker, was detained in early May, allegedly for not wearing a face mask in public during the COVID-19 crisis; he died in a hospital hours after his arrest from injuries he sustained while being detained. Outrage over López’s case was voiced via the hashtag #JusticiaParaGiovanni (Justice for Giovanni), which appeared in over half a million posts on June 3 and 4, 2020.135

Activism for internet freedom issues also occurs in Mexico. In May 2021, a coalition of organizations launched noalpadron.mx, a platform where users could find the documents needed to file an appeal against the biometric cell phone registry approved by Congress in April 2021 (see C4).136 In December 2019, after IFT presented its draft policy on net neutrality, a civil society coalition responded with the campaign, “Salvemos Internet” (Let’s Save the Internet), criticizing the draft for its lack of transparency and privacy protections as well as provisions that could enable censorship and paid prioritization of traffic (see A5 and B6).137 Online mobilization also addresses other social issues, like Indigenous people’s internet access. By July 2021, an online petition that began in April for Red Compartida to provide coverage to Indigenous communities in the Mixtec highlands of Oaxaca had gathered over 36,000 signatures.138

The constitution and its regulatory laws guarantee freedom of speech, freedom of the press, privacy of personal communications, and freedom of access to information. A constitutional reform in 2013 established internet access as a human right and guaranteed net neutrality (see B6). During the coverage period, however, President López Obrador’s policies and proposals from his government have undermined existing safeguards for these rights.

The 2012 Law for the Protection of Human Rights Defenders and Journalists established an institutional body of government officials and civil society members tasked with protecting threatened journalists and activists.139 However, activists have denounced a lack of coordination between federal and state authorities, failure to address gender-based violence and gender-specific problems, poor capacity for reacting to various forms of violence, and continued impunity in practice.140 In October 2018, the Senate voted to close 108 financial trusts as part of austerity measures during the COVID-19 pandemic; this included the trust that funds the Mechanism for Protection of Human Rights Defenders and Journalists.141 The country ranked sixth in the 2020 Global Impunity Index created by the Committee to Protect Journalists (CPJ);142 more than 98 percent of crimes against journalists reportedly went unpunished in 2020—which was also the most violent year for attacks against journalists on record.143

Although defamation was decriminalized at the federal level in 2007, there are still criminal defamation statutes in state laws.144 Provisions from both the criminal and civil codes continue to be used to intimidate journalists, including those who publish online. For example, Article 333 of the state penal code in Chihuahua criminalizes those who, “for a profit or to cause injury, improperly produce or edit, by any technical means, images, texts or audio, which are totally or partially false or true.”145

During the coverage period, there were discussions about possible criminal law reforms to address hate speech, discrimination, terrorism, and misinformation at the federal and state levels, all of which were opposed by freedom of expression and digital rights organizations. In June 2020, lawmaker Lorenia Valles Sampedro introduced a bill to reform the federal criminal code to cover hate speech and the incitement of hostility, discrimination, and violence; civil society organizations came out against the initiative, citing its vague language and arguing that only certain types of speech should be addressed through criminal law, due to its potential harm to freedom of expression.146 This law was approved by the first Chamber of Congress in December 2020, and was pending discussion in the Senate at the end of the coverage period.147

Similarly, days after the introduction of Valles Sampedro’s bill, President López Obrador proposed legislation that, if approved, would reform the same article of the federal criminal code, lengthening the sentences for discrimination and introducing new types of offenses.148 As of May 2021, the proposal had not been discussed by the Senate.149 In January 2020, Article 19 denounced the leaked draft of a federal bill that criminalized crimes to honor, crimes against public order and peace, and “terrorism”—defined as the use of digital tools to exercise pressure on authorities; it had not yet been formally introduced by June 2021.150

The movement to criminalize the sharing of intimate images without consent saw major developments during the coverage period. In April 2021, Congress approved reforms to the General Law on Women's Access to a Life Free of Violence (LGAMVLV) and the Federal Criminal Code, legislation known as the national Ley Olimpia, which criminalizes the sharing of intimate images without consent and punishes “digital violence.”151 It includes provisions for prison sentences between three and six years and fines of up to 90,000 pesos ($4,477) for those found guilty of digital violence as defined by the law.152 As of July 2020, 29 of the country’s 32 states had passed laws in line with Ley Olimpia,153 a number of which gender and digital rights organizations criticized for their disproportionate punishments, potential to induce censorship, and lack of reparations for victims.154 The Senate approved the law in November 2020, without adjusting the law to incorporate criticisms raised by civil society groups, including the ambiguity of concepts like “digital violence” and the vagueness of what constitutes “intimate sexual content.”155

Threats of legal action are frequently issued in response to critical reports published online. In 2020, there were 16 lawsuits against outlets and journalists in the state of Puebla; online newspaper E-Consulta alone received seven lawsuits from public servants for moral damages.156

Online journalists also continue to risk arbitrary arrest while covering protests or political events. In November and December 2020, multiple journalists for the online outlet Descontento Ciudadano QR were detained by police in Cancún, Quintana Roo, in relation to their coverage. Article 19 documented 10 aggressions against the outlet over the course of 2020. One of their journalists, Jorge Ugalde, livestreamed on Facebook a police operation on December 27, 2020, during which police abused their authority and pulled over cars without cause.157 The officers involved arrested him, threw him to the ground, took his phone, erased its memory—which included the recording of the livestream—and detained him for two hours, during which time he reported being beaten and threatened.158 Weeks earlier, in November, outlet director Raúl Fernández León was also arbitrarily detained for five hours after he and a coworker had noticed that officers had stopped and investigated a car without apparent cause. He was arrested after he began recording the police, who threatened to kill both him and his coworker.159

Score Change: The score declined from 3 to 2 because a reform of the Federal Telecommunications and Broadcasting Law established a problematic biometric cell phone registry, limiting people’s ability to communicate anonymously online.

A 2008 requirement that mobile phone users register with the government was revoked in 2012. In April 2021, however, Congress passed a reform to the Federal Telecommunications and Broadcasting Law establishing a biometric cell phone registry (PANAUT) that users are required to join when purchasing a SIM card or activating a new prepaid mobile line. Telecommunications companies must collect the data, which would include fingerprints or iris recognition as well as the user’s name, address, phone number, nationality, and national Population Registration Key (CURP) number. They would then enter the data into the registry, which would be installed, operated, regulated and maintained by IFT and made available to “authorities overseeing issues of security and justice” without needing a court order or meeting other oversight requirements.160 Telecommunications companies have two years to collect this data from existing customers. Customers who fail to hand over their data and documentation could be fined almost $4,500 and have their mobile line permanently cancelled.161

Public agencies affected by the reform have intensely pushed back against it, to varying degrees success. The INAI and IFT both challenged the biometric register in court shortly after the passage of the reform, around the same time that a judge partially blocked the register, a decision expected to delay its implementation.162 President López Obrador quickly contested the ruling.163 Though the Supreme Court rejected a suspension request made by the INAI in May 2021 as the registry had yet to become operational, the court suspended the register in June 2021 on request of IFT, which claimed that the register’s mandate required the agency to take on a financial burden that could compromise its ability to carry out its regulatory duties.164 No final decision on the reform law was expected until the end of 2021, or later.165

Digital rights organizations also appealed the reform.166 They have criticized the reform’s general unconstitutionality; its impact on user privacy; its likelihood of removing the presumption of innocence and increasing false accusations; and its probable ineffectiveness in achieving its alleged purpose: reducing crimes facilitated by unregistered cell phones.167

In May 2020, a group of researchers and Tor node administrators in Mexico revealed that Telmex, the country’s largest telecommunications provider, had blocked access to seven of Tor’s 10 directory authorities since 2019, potentially earlier. Tor is widely used by journalists and human rights defenders in Mexico to communicate securely with their contacts.168 Telmex argued that it had no intention of blocking access to the Tor application itself, stating that the targeted directories had been flagged for their role in the distribution of the WannaCry ransomware attack, which was active in 2017; the researchers countered that the block stretched back to 2015 and was still in place at the time of their report. In June 2020, the researchers and administrators confirmed that Telmex had lifted the block.169

The government has used the poor security situation in the country to justify expanding the state’s surveillance powers, with little accountability and oversight. Abuses of digital spying technologies meant for law enforcement purposes emerged during the coverage period, but they have not been thoroughly investigated. Moreover, legal research has shown lack of compliance with federal transparency requirements for government surveillance: not all state laws have been adjusted to match the federal transparency law; executive agencies have not met their obligations under the law; surveillance-related freedom of information requests have been improperly denied; and oversight bodies have been inconsistent in their interpretations of the law.170

Mexico was highly implicated in research published through the Pegasus Project in July 2021, after the coverage period. Pegasus, developed by the Israeli company NSO Group, is sold exclusively to governments, and its use in Mexico has specifically targeted those investigating government corruption and human rights abuses.171 Leaked data from NSO group, originally accessed by Forbidden Stories and Amnesty International and shared with 15 media organizations, confirmed and expanded upon prior reporting on the Mexican government’s use of Pegasus spying software to target voices critical of the government.172 Of the countries implicated in a leaked list of 50,000 phone numbers presumed to belong to people of interest for NSO groups’ clients, Mexico was the worst offender; more than 15,000 of these numbers were for people located in Mexico, including journalists and politicians.173

By March 2019, Citizen Lab and Mexican partner organizations had documented at least 25 cases in which journalists, human rights lawyers, activists, and political figures were targeted by the Pegasus software. In November 2018, it was reported that colleagues of the assassinated journalist Javier Valdez Cárdenas had received infection attempts just days after his killing in 2017.174 In March 2019, Citizen Lab also reported that the journalist’s widow had been targeted in 2017.175 Citizen Lab concluded that NSO’s government-exclusive espionage tools may have been used by a government entity to serve interests other than national security and law enforcement.176 Between 2011 and 2017, at least three Mexican government agencies spent some $80 million on such spyware.177

Mexican civil society groups, international human rights organizations, and experts from the Inter-American Commission on Human Rights and the United Nations supported an independent investigation into allegations of government agencies conducting illegal electronic spying.178 However, many questioned the judicial order for the Attorney General’s Office (PGR) to investigate and accept evidence submitted by victims of Pegasus, given that it was allegedly involved in the purchase of spyware.179 The investigation had not advanced by the end of Peña Nieto's term in November 2018 and there were no updates as of the end of the coverage period.180 In December 2018, a court ordered INAI to invalidate a resolution that allowed the PGR to conceal the information of the individuals who participated in the acquisition of Pegasus.181 In February 2019, the INAI received evidence showing that the PGR itself had renewed the Pegasus software’s licensing contracts in 2016 and 2017.182 The same month, the PGR announced that Pegasus had been uninstalled from its devices, which digital rights group R3D claimed could obstruct the criminal investigation.183

Officials have access to other surveillance tools with interception capabilities. In May 2020, three nongovernmental organizations (NGOs)—the Fake Antenna Detection Project, the Project on Organizing, Development, Education, and Research (PODER), and SeguDigital—found 21 active international mobile subscriber identity–catchers (IMSI catchers) in central Mexico, which can be used to intercept mobile data from all devices in the immediate area.184 Three of the IMSI catchers were acquired during López Obrador’s administration, which had also contracted the surveillance company L3Harris Technologies for over $1 million in March, April, and June 2019.

In December 2020, Citizen Lab published a report detailing cyberespionage firm Circles’ deployment in countries around the world; they had identified what looked like 10 Circles systems, and found that the Mexican Navy and the government of Durango had IP addresses connected to Circles operations, some of them active well into 2020.185 In April 2021, El País reported that the PGR had paid a total of $5.6 million in intelligence services to Neolinx de México, across at least four contracts, in order to geolocate cell phones and analyze mass surveillance data. Forbes Mexico found that the prosecutor general’s office paid $2.5 million in 2019 and 2020 for a Neolinx license that included over 135,000 phone geolocations. The Attorney General’s office was granted only 124 court orders to deploy this technology in 2019, though it purchased 13,800 geolocations that year.186

Previous reports from 2015 revealed that Mexico was the biggest client of Hacking Team, which had signed more than 14 contracts with various state and federal agencies. Civil society organizations argued that these contracts were illegal because many of the agencies involved lacked constitutional or legal authority to conduct surveillance or espionage.187 Also in 2015, media outlet Animal Político accused the state government of Puebla of using Hacking Team products to target the political opposition and journalists.188

Article 189 of the 2014 Telecommunications Law forces companies to provide users’ geolocation information and other communications metadata to police, military, or intelligence agencies in real time. Article 190 requires providers to maintain records of their users’ metadata for a period of two years, and grants security agencies access to these records at any time.189 Digital activists have argued that such provisions contradict international human rights standards, particularly those pertaining to the right to privacy.190 In 2016, the Supreme Court upheld the constitutionality of the law’s requirements for data retention and real-time geolocation. However, the ruling established the need for a judicial warrant to access historical metadata.191

Reforms to the criminal procedural code in 2016 required a judicial warrant for government entities to access geolocation data, with some exceptions such as kidnapping cases in which a person’s life or physical integrity is in danger.192 The 2016 Supreme Court ruling also provided some clarification as to which authorities can access user data; they included federal prosecutors, federal police, and the agency directly in charge of applying and coordinating the National Security Law.

An April 2021 reform of the Federal Telecommunications and Broadcasting Law established a biometric cell phone registry that tasks telecommunications companies with collecting biometric data. The database is accessible to authorities overseeing public security and justice (see C4).193 In another development that could jeopardize user privacy, President López Obrador disclosed his intention to merge the INAI into the federal government, removing its autonomy (see A5 and C1).194 The INAI is an independent agency with the power to take legal action against entities that violate data protection laws.195

In October 2018, R3D released a report showing that companies received more than 140,000 requests for users’ personal information during 2016 and 2017. The researchers were unable to identify the authorities that made more than a third of these requests. Telcel and Telmex complied in 100 percent of the cases, while Movistar fulfilled 83.4 percent of requests, and AT&T cooperated on 61.5 percent of them.196

During the COVID-19 crisis in 2020, the Mexico City government announced they would receive telecommunications companies’ data from mobile service towers to allow the Digital Agency for Public Innovation to monitor the population’s general adherence to stay-at-home orders.197 The agency said it had begun collecting the aggregate and anonymized data on March 25, 2020. As of July 2021, there had been no further announcements regarding when this monitoring would cease.198 Civil society organizations called on the government to ensure that any technological measures it deployed to combat COVID-19 also respected human rights; the groups questioned the authorities’ ability to analyze such data in nondiscriminatory ways while preserving privacy and yielding useful information.199

Threats and violence from organized criminal groups, members of local governments, and other actors have continued to put journalists’ lives at risk and curtail the safe practice of independent journalism. Conditions in the states of Mexico City, Puebla, Quintana Roo, Veracruz, Oaxaca, and Guerrero are especially severe. Mexico remains the most dangerous country in Latin America for journalists and one of the most dangerous in the world.200

Media freedom watchdog Article 19 documented 692 aggressions against journalists in 2020, an unprecedented number that constituted a 13.62 percent increase compared to 2019. Nearly half of these aggressions were perpetrated by state agents, an increase of nearly 30 percent from the year prior. Article 19 attributed this rise in violence to the president’s implicit enabling of attacks against journalists through his public comments (see B5). The illegitimate use of power against members of the media, including through judicial harassment and public stigmatization, constituted 28.72 percent of these attacks, and intimidation and harassment made up another 23.84 percent. Out of the total 692 aggressions, 191 were perpetrated online. Article 19 also noted that 16.3 percent of attacks against journalists in 2020 were related to their COVID-19 coverage and commentary. 201

The CPJ documented a total of 36 murders of journalists in the country in connection with their work between 2010 and 2020. In 2020, five journalists, including digital reporters, were killed, four of whom were potentially murdered in reprisal for their work.202 In August 2020, Pablo Morrugares Parraguirre, the founder and editor of news website PM Noticias, was killed by unidentified gunmen in his café minutes after ending a Facebook live broadcast in which he alleged that a local gang had murdered a taxi driver. Both he and a police officer assigned to him through a federal journalist protection program died from their wounds. Parraguirre had allegedly received a threat two months before his murder in a Facebook video believed to be posted by a gang.203

In September 2020, the body of Julio Valdivia, a journalist for the local newspaper El Mundo, was found beheaded in Veracruz; a couple days before, the paper had posted images of a shootout in a neighboring state on its Facebook page, crediting the photos to Valdivia.204 In November 2020, Israel Vázquez Rangel, a reporter for the news website El Salamantino, was shot five times before beginning a Facebook livestream from a crime scene; he died shortly after from his injuries.205 That same month, Jesús Alfonso Piñuelas, founder of online outlets Zarathustra Press and El Shock de la Noticia, was shot and killed when he was driving his motorcycle in Sonora; he had recently covered crime and security in the municipality in which he was killed.206 In December 2020, Jaime Castaño Zacarías, founder of news website Prensa Libre MX, was murdered while driving his motorcycle by unidentified gunmen, shortly after photographing the bodies of two shooting victims on the side of the highway. A stranger had approached him and demanded he erase the images, which he had refused to do. His camera’s memory card was taken from the scene before authorities arrived.207

Other forms of physical attacks against online journalists from security forces, politicians, and civilians were reported frequently during the coverage period, as were online death threats.208 In November 2020, Adriana Varillas, a correspondent at digital outlet Diario Quintana Roo, and Alejandra Galicia, a correspondent at digital outlet La Silla Rota, were beaten by police while broadcasting live. That same month, police attacked multiple journalists covering feminist demonstrations around the activist movement #JusticiaParaAlexis, including two for online platform PopLab (see B8).209 In March 2021, city of Tetla de la Solidaridad mayor Eleazar Molina Pérez attempted to drive journalist Albert Amaro Jordán off the road. Amaro is cofounder and editor of news website La Prensa de Tlaxcala, which had reported on corruption allegation’s linked to the mayor and criticized his potential run for congress.210 In July 2020, Pedro Canché, director of online outlet Pedro Canché Noticia, received death threats on WhatsApp from an organized crime group after publishing about a drug-related emergency plane-landing (see B2).211 In October 2020, Jesús Humberto González, reporter at online platform La Tarde, was followed by a truck whose passengers yelled death threats at him and demanded he stop his reporting.212

Online gender-based violence has become a critical problem in the country, affecting women journalists, politicians, activists, and organizations. A survey by the National Institute of Statistics and Geography found that, of female users over 12, nearly 36 percent had faced online sexual harassment in 2020.213 Activist groups have documented significant abuse directed at women, including online hate speech against those who use social media to denounce any type of violence; coordinated efforts to take down websites and social media profiles and to delete the posts of women activists, organizations, and collectives; and smear campaigns, extortion attempts, and nonconsensual dissemination of intimate content that similarly target women.214

Technical attacks have become a central tactic in attempts to suppress freedom of expression in Mexico, and perpetrators are generally able to act with impunity.215 The assaults take many forms, ranging from DDoS attacks to hijacking and malware infections.216

Journalists and activists have frequently reported cases of digital surveillance and cyberattacks, often in retaliation for their scrutiny of corruption or human rights issues. During 2020, Article 19 documented 191 aggressions against the press perpetrated through digital means.217 The website of the critical local outlet Noroeste, for example, was targeted multiple times throughout the coverage period with DDoS attacks. Two separate attacks registered on March 14, 2021, saw almost 48 million and 94 million near-simultaneous access requests to the site, respectively. Noroeste experienced similar attacks from September to December 2020, amounting to 12 in six months; it temporarily closed its site following the March attacks.218 The outlet was one of five in the state of Sinaloa targeted with DDoS attacks by unknown actors that September; the others were Revista Espejo, Reacción Informativa, Riodoce, and Línea Directa.219

The illegal sale of private user data stolen through hacks of websites belonging to major forums and platforms is a growing issue in Mexico. In January 2021, a user on an online forum offered to sell information from three databases, including data from Banco Bilbao Vizcaya Argentaria (BBVA) and Santander banks, as well as from 42 million users of Mexico’s Social Benefits Institute; in December he had offered a database of 60 million users of telecommunications company Telcel, and other users have offered similar databases from different public and private services in the country.220 Researchers believe the data was stolen by compromising the servers of either the companies themselves, or their providers.221 In February 2021, Mexico’s National System for Family Development also failed to protect personal identifiable data; a national database of its elderly beneficiaries was published on its website.222