The United Nations High Commissioner for Human Rights has issued a statement calling on Spanish authorities to thoroughly investigate all the reports that Spain used the Pegasus and Candiru software to spy on Catalan independence leaders after the 2017 referendum and demanding an end to infringements of their fundamental rights. The statement, quoting two UN Human Rights Council experts, states bluntly that "Spanish authorities must conduct a full, fair and effective investigation into these allegations". It thus repeats a call made by three United Nations rapporteurs in January, in which they already recognized the violations of fundamental rights in the espionage with Pegasus against the members of the Catalan independence movement.
UN experts Fernand de Varennes and Irene Kahn, rapporteurs on freedom of assembly and freedom of expression respectively, express concern about the sophistication and widespread use of the Pegasus program. They state their concern that the use of this type of spyware could lead to an increase in self-censorship, which directly affects freedom of expression, "as well as other violations of the rights of minorities and their effective participation in public life".
Spyware "targeted a minority group"
The statement from the High Commissioner's office reminds Spain that minorities are protected by international and European human rights standards, and that spy software like Pegasus "targeting a minority group" may constitute a serious violation of these rules. The UN body notes that it sent a letter to the Spanish government on October 24th, 2022 about this issue, and on December 22nd received Spain's response, specifying that investigations were ongoing, and that, therefore, they could not yet pronounce on cases pending judicial investigation. For their part, the Human Rights Council experts simply state that Spain must carry out "a full, fair and effective investigation". In addition, they express their "deep concern" over "what appears to be a very troubling interference into the human rights of Catalan leaders" and other minority activists and asserts that any such interference must stop. "We look forward to the results of the ongoing judicial investigation," they state.
More broadly, the rapporteurs reiterate the call for a global moratorium on the sale and transfer of surveillance technology, "until robust regulations are in place that guarantee its use in compliance with international human rights standards". They therefore urge Spain to join this moratorium, which has also been joined by the High Commissioner for Human Rights, Michelle Bachelet, they noted. In the statement, Kahn and de Varennes also make a point of defending the rights of Catalan leaders and other activists spied on: "They are entitled to a private life, the privacy of correspondence and to be treated equally before the law".
Victims of SMS attacks
The experts give details of how the cyber attacks were allegedly carried out, in many cases via text messages, and that during these attacks, operators sent messages with malicious links perfectly designed to trick the targets, precisely, into clicking. "The sophistication and personalisation of the messages varied across attempts, but reflect a detailed understanding of the target’s habits, interests, activities, and concerns. In many cases, either the timing or the contents of the text were highly customised to the targets and indicated the likely use of other forms of surveillance on them," they added.
They also point out that the victims were attacked with highly personalized notifications "from Spanish government entities, including tax and social security authorities". In this regard, they detail that one victim received a message that included part of their official tax ID number, suggesting that the attackers had access to this information.