A report released this Monday by the Canadian research centre the Citizen Lab reveals a list of 65 people linked to the Catalan independence movement, including presidents of Catalonia, MPs, politicians, journalists, activists and lawyers, who were spied on through the state-of-the-art spyware program Pegasus, and a second system called Candiru. These are programs that only governments have access to, as they are designed to fight organized crime and terrorism, and the study states that there is "strong circumstantial evidence" that the Spanish authorities were responsible for this espionage. The report from this research centre at the University of Toronto, which is dedicated to studies on communication, information, human rights and global security, calls for an official investigation to find out the real scope of this operation, its objectives and what judicial oversight it had. The material in the Citizen Lab report was also the focus of "How Democracies Spy on Their Citizens", an extensive article published in The New Yorker magazine on Monday.
The analysis made by the Citizen Lab, in a report entitled "CatalanGate" and whose forensic methodology has been endorsed by Amnesty International, determined that in the last few years the Pegasus program "attacked or infected" 63 people in Catalonia, while the Candiru system targeted four. Among those affected are the present Catalan president Pere Aragonès and his three predecessors, Carles Puigdemont, Quim Torra and Artur Mas; different leaders of the pro-independence parties; members of parliament; all five of the Catalan pro-independence MEPs elected in 2019; members of the pro-independence groups ANC and Òmnium; as well as lawyers and journalists.
After stressing that the study revealed "extensive surveillance directed against Catalan civil society and government using mercenary spyware", the investigation concludes that the nature of the victims and targets, the timing of the monitoring and the fact that Spain is a client of the NSO Group, company responsible for the Pegasus program, indicates that "circumstantial evidence suggests a strong nexus with the Spanish government."
Official inquiry called for
In the opinion of this research centre, the seriousness of the case warrants an official inquiry to determine who was responsible, the legal framework under which the hacking took place and the judicial oversight that was applied, as well as the actual scope of the operation, the uses to which the hacked material was put and how the data obtained was managed.
The Citizen Lab also notes that there are many other people who could also be affected by this case whose devices have not been checked, pointing out that the methods available for investigating Android devices are much more limited, so they suspect that "the total number of victims and targets is much higher."
Among the findings, and despite acknowledging the limitations of the study, the report highlighted the wide scope of the espionage operation, its "unbridled" nature and the breadth of people affected; it also raises the issue of whether the principles of necessity and proportionality were complied with, recalling that many victims have never been charged with any serious crime, that they do not comply with any criminal or terrorist profile with which sale of this spyware to governmental clients has been justified. It also stressed that the surveillance took place while the Spanish government was negotiating with the Catalan authorities.
The investigation began following the 2020 publication by The Guardian of stories on cases of Pegasus use in hacking Catalan politicians' phones, which led the Citizen Lab to undertake a wider study of Pegasus hacking in Spain. Its report also reviews the context of the political situation in Spain and Catalonia recalling that Spain maintains an important security and intelligence apparatus, largely because of its experience with terrorism and organized crime, and that the Spanish intelligence service, the CNI, has been linked to several surveillance and espionage scandals.
First case: 2015
Almost all the cases recorded in the report occurred between 2017 - the year of Catalonia's referendum on independence from Spain - and 2020. However, a first case was detected in 2015, when an attempt was made to infect the mobile phone of activist Jordi Sànchez, at the time president of the key ANC pro-independence group. Between 2017 and 2020, Sànchez received 25 text messages from the Pegasus program, most of which were hidden behind news related to Spanish and Catalan politics, as well as messages allegedly related to the Spanish treasury or social security department, and whose arrival tended to coincide with major political events. Once a device is infected by Pegasus, those responsible for the infection can access all the user's data, monitor their communications, and obtain access to remote files and data held by the user. Afterwards, the software is able to erase most traces of its presence.
According to the report, some of the targets were not spied on directly but through friends or family. Among those who have suffered espionage are Carles Puigdemont's wife, Marcela Topor. Also, while Jordi Cuixart, as president of the Òmnium Cultural group, was on trial in the Spanish Supreme Court along with leaders of the independence process trial, his partner, Meritxell Bonet, was attacked by Pegasus. Marcel Mauri, vice president of Òmnium, also had his devices infected by the program, as did several of the lawyers defending the leaders of the independence process, such as Gonzalo Boye, Andreu Van den Eynde and Jaume Alonso Cuevillas.
State information
Some attacks also took place outside Spain. ERC politician in exile, Marta Rovira, was hacked in Switzerland, through SMS messages purporting to be from the NGO Swisspeace and a foundation in Geneva. The report also notes actions in Belgium and Germany, which may have caused breaches in cross-border investigations or violations of local law.
Citizen Lab, while not conclusively attributing the espionage to the Spanish government, states that there is considerable circumstantial evidence that indicates this nexus. In this regard, it notes the Spanish state's interest in the targets investigated, the timing of the monitoring, the access to official information that was the basis for many of the messages used to hack the devices, the fact that the CNI is a known client of the NSO group and that the Spanish ministry of the interior is thought to also possess this capacity. The report recalls that these espionage systems can only be obtained by governments and that it is unlikely that any other country would conduct such a comprehensive investigation in Spain, also using SMS communications that often supplanted the Spanish authorities, a modus operandi which could have diplomatic and legal repercussions if used by a foreign power.
The 65 known Catalan targets
There are 61 people, Catalans or individuals connected with the Catalan independence movement, who are named in the report as having been spied on using Pegasus - based on forensic evidence found on their devices - and in addition, there are four others who were hacked but chose to remain anonymous:
- Alba Bosch (political activist).
- Albano Dante Fachin (former MP).
- Albert Batet (chairman of the parliamentary group of Junts).
- Albert Botran (CUP deputy in the Congress of Deputies).
- Andreu Van den Eynde (lawyer).
- Anna Gabriel (former CUP MP).
- Antoni Comín (MEP for Junts).
- Arià Bayé (member of the Catalan National Assembly).
- Arnaldo Otegi (secretary general of Basque party EH Bildu).
- Artur Mas (former Catalan president).
- Carles Riera (CUP MP).
- David Bonvehí (president of PDeCAT party).
- David Fernandez (former CUP MP).
- David Madí (former CDC leader).
- Diana Riba (MEP for ERC).
- Dolors Mas (businessperson).
- Elías Campo (doctor).
- Elena Jiménez (member of Òmnium Cultural).
- Elies Campo (former director of Telegram).
- Elisenda Paluzie (president of the Catalan National Assembly).
- Elsa Artadi (Junts candidate for Barcelona city council).
- Ernest Maragall (leader of ERC in Barcelona city council).
- Ferran Bel (PDeCAT member of the Congress of Deputies).
- Gonzalo Boye (lawyer).
- Jaume Alonso Cuevillas (lawyer and MP).
- Joan Matamala (businessman).
- Joan Ramon Casals (former MP for Junts).
- Joaquim Jubert (MP for Junts).
- Joaquim Torra (former Catalan president).
- Jon Iñarritu (member of the Congress of Deputies for EH Bildu).
- Jordi Baylina (software developer).
- Jordi Bosch (former director of Òmnium Cultural).
- Jordi Domingo (member of the Catalan National Assembly).
- Jordi Sànchez (general secretary of Junts).
- Jordi Solé (MEP for ERC).
- Josep Costa (former deputy speaker of the Catalan Parliament).
- Josep Lluís Alay (director of Carles Puigdemont's office).
- Josep M. Ganyet (businessperson).
- Josep Maria Jové (ERC MP).
- Josep Rius (vice-president and spokesperson for Junts).
- Laura Borràs (speaker of the Catalan Parliament).
- Marc Solsona (former PDeCAT MP).
- Marcel Mauri (former director of Òmnium Cultural).
- Marcela Topor (journalist, wife of Carles Puigdemont).
- Maria Cinta Cid (teacher).
- Marta Pascal (secretary general of the PNC).
- Marta Rovira (ERC secretary general).
- Meritxell Bonet (journalist).
- Meritxell Budó (former Catalan minister).
- Meritxell Serret (ERC MP).
- Míriam Nogueras (MP for Junts).
- Oriol Sagrera (secretary general for Business and Employment, ERC).
- Pau Escrich (software developer).
- Pere Aragonès (Catalan president, ERC).
- Pol Cruz (assistant at European Parliament).
- Roger Torrent (Catalan Minister for Business and Employment, ERC).
- Sergi Sabrià (former ERC MP, director of Catalan government’s strategy and communication).
- Sònia Urpí (member of the Catalan National Assembly).
- Xavier Vendrell (former ERC Member of Parliament).
- Xavier Vives (software developer).