Spain’s intelligence service has spyware program that targeted Catalan politicians

The Spanish intelligence services have the spy program Pegasus at their disposal, according to sources close to the community. It was a version of this software, which is supplied by the Israeli company NSO, that was used to target the cellphones of Catalan parliamentary speaker Roger Torrent, and regional deputy and former minister Ernest Maragall, both from the pro-independence Catalan Republican Left (ERC) party. Spain’s CNI intelligence service has the system, the same sources confirmed. The Interior Ministry, meanwhile, which has publicly denied having acquired Pegasus after EL PAÍS and The Guardian broke the news of the alleged hacking earlier this week, possesses at least one similar program.

After the allegations surfaced this week, based on a report from Citizen Lab, a cybersecurity group from the Munk School of Global Affairs and Public Policy at the University of Toronto, Torrent directly accused the CNI of having hacked his cellphone, although the identity of who exactly installed the spy system on the phones of the parliamentary speaker and veteran politician Maragall will be difficult to determine. What is known is that the Spanish intelligence services do have the Pegasus program, which can take control of handsets, listen to conversations, read messages, access files, take screenshots and activate the camera and microphone via remote control.

The Spanish Interior Ministry, the National Police and the Civil Guard claim that they have never had a contract with NSO

The date that the program was acquired is currently unconfirmed. What is known is that until 2015, the CNI and the National Police were clients of Hacking Team, an Italian company that competes with NSO. The sources that have confirmed that the Spanish intelligence services have Pegasus, however, doubt whether NSO only sells the program to governments and security forces, as the Israeli company claims.

The Spanish Interior Ministry, the National Police and the Civil Guard claim that they have never had a contract with NSO, while the CNI, whose resources and capabilities are classified by law, would only say that they “always act under full compliance with the legal system.” Their actions are covered by legislation that dates back to 2002, and which was approved after scandals involving illegal wiretaps that stained their reputation in the previous decade. The law allows for Spanish spies to enter homes and intercept communications when necessary in order to “comply with the tasks assigned” to the CNI.

In order to tap a phone, the secretary of state and head of the CNI, Paz Esteban, must seek prior authorization from a judge at the Supreme Court, one who has been named for this role by the CGPJ legal watchdog. The magistrate then has 72 hours to approve or reject the request, which must be specific and justified, and identify the target of the telephonic intervention. Permission is given for a three-month period, which can be extended if necessary.

Experts in the intelligence services say that the CNI would not risk tapping a phone in Spain without strictly complying with the law. As for what happens abroad, they add, that is a different matter, given that all operations outside a country’s shores are, by definition, clandestine. As well as the cellphones of Torrent and Maragall, there are claims that the handset of the former pro-independence deputy for the far-left CUP party, Anna Gabriel, was also monitored. She fled Spain to Switzerland in 2018 in the wake of the secessionist drive of the previous year in order to avoid arrest.

Could a Supreme Court magistrate have authorized a wiretap on Torrent? The sources consulted for this story point out that, at least since 2015, the Catalan pro-independence movement has been considered a threat to the unity of the Spanish state and constitutional order, and has formed a part of the information-gathering objectives of the intelligence service.

The CNI was very active in 2017, at a critical moment for the independence movement, which culminated in an illegal referendum on secession from Spain held in October of that year, and a subsequent declaration of independence that was passed by the Catalan parliament. The intelligence services were supplying the government of then-Prime Minister Mariano Rajoy with drafts of the so-called “laws of disconnection,” which were setting out the route map for independence for the northeastern Spanish region.

They also played a key role in the 2018 capture in Germany of Carles Puigdemont, the regional premier at the time of the events in 2017 and who fled Spain to avoid arrest. They were also criticized for not having been able to intercept the ballot boxes that were used to hold the October 1 referendum. But it is one thing to tap the phone of a pro-independence leader, and another thing to monitor the communications of someone in an institutional role, such as the speaker of the regional parliament, the second-highest authority in Catalonia after the premier. The sources consulted explain that often the registered users of a cellphone do not coincide with their real users and that sometimes a number is reached via a different one and without knowing who is the owner of the line.

The Pegasus program can take control of handsets, listen to conversations, read messages, access files, take screenshots and activate the camera and microphone via remote control

Despite its role as the junior partner in the Socialist Party-led coalition government, leftist party Unidas Podemos has lent its voice to a joint statement by 10 political groups denouncing the “severity” of the spying on Torrent and calling for the creation of a parliamentary investigation committee into what is commonly referred to in Spain as the “cesspit of the state.” Such a commission, however, would not be able to access information about CNI wiretaps, which are classified. The Congressional Official Secrets Commission, which meets behind closed doors, would indeed be able to investigate the claims.

The leader of Unidas Podemos and one of Spain’s deputy prime ministers, Pablo Iglesias, has since March formed part of the Government’s Executive Committee for Intelligence Affairs, which, among other tasks, proposes the CNI’s annual objectives to the prime minister.

The secret service cannot investigate the pro-independence movement unless the prime minister gives the order to do so in the Intelligence Directive, which develops the objectives that are proposed by the aforementioned commission.

English version by Simon Hunter.