The Spanish government is the latest country in the European Union to find itself having to answer for allegedly spying on other politicians and civilians with Pegasus, a private Israeli surveillance software.
A report released on April 18th by The Citizen Lab, a privately funded research group at the University of Toronto in Canada, showed that at least 65 individuals—from activists and academics, to politicians and their lawyers and family members—had been targets of the sophisticated spyware Pegasus between 2017 and 2020. The ‘CatalanGate’ report couldn’t confirm who authored the attacks but found “circumstantial evidence” pointing to the Spanish government. All the targets in the report were Spaniards from the Cataluña region, an area with a strong regional identity and separatist movement.
Pegasus was developed by the Israeli company Niv, Shalev and Omri (the NSO Group), to be used by governments against organized crime and terrorists. Once it infects a mobile phone or other device, it can extract the contents and even turn on the microphone or camera for real-time surveillance of private meetings, for example.
The technology is legal to use in Europe. However, as with other policing and surveillance, national laws require intelligence agencies to get permission for each use from a judge or other oversight agency.
According to The Citizen Lab, initial suspicions that the Spanish government was spying on Catalans stemmed from the 2019 WhatsApp Pegasus breach, when the messaging app company owned by Meta (formerly Facebook) discovered Pegasus software was taking advantage of a weakness in the app to infect users. WhatsApp notified those affected by the breach. Among them were five Catalan separatists, including high profile politicians but also a less prominent activist, Elies Campo.
According to the Spanish newspaper El Mundo, Campo had been under investigation for his role in the 2017 Catalan independence referendum and in subsequent violent protests. He is also associated with the Catalan separatists’ groups, Omnium Cultural and Tsunami Democratic. But before becoming deeply involved in the Catalonia separatist movement, he plunged into a career in Silicon Valley, rising to head of WhatsApp for Spain and Latin America. He left WhatsApp in 2014, but remained in California as an angel investor and an advocate against big tech.
Suspecting that the five cases of spying on Catalans revealed by WhatsApp only scratched the surface, Campo turned to The Citizen Lab, where he led the investigation that discovered approximately sixty more cases of spying with Pegasus.
Spain finds itself in a tricky position regarding internal nationalist-separatist politics. Though Spanish law is intended to protect the unity of the country—and separatism is considered a national security threat—political parties with clear separatist platforms have been legalised and they often govern locally in Catalonia and the Basque Country. In Cataluña, the issue of independence came to a head most recently in 2017 when activists and the local government organised a referendum on the question of Catalan nationality, an illegal move under Spanish law. Carles Puigdemont, president of the region at the time, was targeted by Pegasus and fled to Brussels to avoid arrest—which he did with great success. He is now a deputy in the European Parliament, while other leaders in the referendum were convicted in 2019.
It is worth noting that Catalan separatism finds its greatest sympathisers outside of Spain and Europe.
The April 18th release of both the full Citizen Lab report and the investigation by The New Yorker on the use of Pegasus that included ‘Catalangate,’ conveniently coincided with two other political landmarks in the EU—the launch of the EU Parliament’s own investigations into governmental use of Pegasus and an examination of Catalan collaboration with Russia. Spanish media has published several reports showing that Catalan separatists enlisted the help of Russia in their 2017 campaign for independence.
The use of Pegasus in and by EU member states became an issue in July 2021 following an investigation by Forbidden Stories that alleged the targeting of European governments by other nations, and European governments targeting their own political opposition and civil society. The governments of Hungary and Poland in particular have come under fire for allegedly spying on their political opponents, but other countries, such as Greece, are also included in the EU Parliament’s investigation.
For Puigdemont and the Catalan separatist movement, being able to throw Spain into the same sack as the oft-maligned Hungarian and Polish governments is politically expedient. At home in Spain, the Catalan politicians who the current socialist-communist government relies on for support have called for the resignation of Minister of Defence Margarita Robles.
But victimisation cuts both ways.
The Spanish government has denied all wrongdoing, and on Monday, May 2nd, it was revealed that it, too, had been spied on. Spain’s government announced that the institutional phones of President Pedro Sanchez and Minister of Defence Margarita Robles had both been hit by Pegasus in 2021. From Sanchez’s phone the spyware got 2.6 gigas of information on one occasion and an additional 130 megabytes on another. From Robles’ phone, 9 megabytes were stolen. The government said it didn’t know what had been stolen or how sensitive the data was, but from the size of the data alone, it could amount to thousands of documents.
The government played the hacking discovery off as a recent find made during a routine security check of the phones. But El Debate reported on May 4th that the government had in fact hired additional cybersecurity services just two weeks after the Pegasus hacks, an indication that it has long been aware of the security breach.
The Spanish government has promised an audit of the intelligence services and has opened a special commission to investigate the matter and be privy to state intelligence secrets.
To the horror of many Spaniards, the commission includes separatist politicians.
