Spyware attack on Catalan leaders’ cellphones triggers political storm in Spain

Revelations that came to light on Tuesday that the cellphone of the Catalan parliamentary speaker, Roger Torrent, had been targeted by a spyware program that is only available to governments and state security forces have caused a political storm. It also emerged yesterday that another politician from the region, Ernest Maragall, was subject to the same alleged espionage, according to a joint investigation by EL PAÍS and The Guardian. Torrent yesterday claimed that in Spain, “spying is carried out on political adversaries.” The Interior Ministry, the National Police and the Civil Guard stated that they have never hired the services of NSO, the Israeli company that makes the Pegasus program used on the politicians’ handsets, while the Spanish intelligence agency, the CNI, stated that it “always acts in clear accordance with the law.”

The handsets of the two pro-Catalan independence politicians, who belong to the Catalan Republican Left (ERC) party, were targeted by the Pegasus spyware via a flaw in the WhatsApp messaging service. Between April and May 2019 around 1,400 terminals were targeted around the world using the program. The method used to activate the attack was a missed video call via the popular application, according to WhatsApp.

Pegasus took advantage of this weakness to target the Catalan politicians’ cellphones, according to Citizen Lab, a cybersecurity group from the Munk School of Global Affairs and Public Policy at the University of Toronto, which exclusively investigated the security flaw. WhatsApp provided Citizen Lab with the numbers targeted by Pegasus, which was created by NSO. Among them were those of Torrent, who is the second-highest authority in Catalonia after the premier, Quim Torra, and of Ernest Maragall, a deputy in the regional parliament who held a number of different ministerial positions.

EL PAÍS and The Guardian have had access to a certificate from Citizen Lab that shows that the phones of both ERC politicians were targeted by NSO’s spy program. There is, the document states, “multiple evidence” that could show that both Torrent and Maragall “were monitored.”

“Given the nature of this attack and the limited information collected by WhatsApp on its users, we can confirm that the telephone was targeted,” said John Scott-Railton, a senior researcher at Citizen Lab who has investigated the spyware, about Torrent. “However, additional investigation would be necessary to confirm that the phone was hacked. At this time we have no reason to believe that it wasn’t.”

This is the first time that what we already knew has been proven

Speaker Roger Torrent

The news caused political storms on Tuesday both in Barcelona and Madrid. Speaking in the Catalan parliament, Torrent accused the Spanish state of “carrying out espionage against political adversaries,” given that NSO only supplies the program to governments and security forces. “This is the first time that what we already knew has been proven,” he said. “There were accusations about this from Amnesty International and from other organizations that some states were using this to pursue political dissidence, as has happened in Morocco, Saudi Arabia and Mexico. Now we know that it happens in Spain,” he continued.

The Interior Ministry did not respond to questions from EL PAÍS ahead of the publication of the story. It did, however, offer this statement on Tuesday: “The Interior Ministry, the National Police and the Civil Guard have never had any relationship with the company NSO, and as such have never hired any of their services,” the brief message from a spokesperson read. “The actions of the state security forces are always carried out with a scrupulous respect for the law,” it added.

The CNI, meanwhile, pointed out that its activity is always supervised by a judge from the Spanish Supreme Court.

“The government is not aware that the speaker of the [Catalan] parliament, Roger Torrent, has been the target of a hack,” said a spokesperson from the Spanish government on Tuesday, adding that any wiretaps are always carried out with a court order.

Despite these claims from the authorities, the ERC – along with nine parties, including Unidas Podemos, the junior partner in the Socialist Party-led coalition government – made a statement denouncing the “severity” of the incident and calling for an investigatory commission into what it called the “cesspit of the state.”

Former Catalan premier Carles Puigdemont, who fled Spain to avoid arrest in the wake of the 2017 independence drive in the region, also commented on Tuesday on the revelations. Writing from Belgium via Twitter, the politician said: “For some time now the Spanish state has not respected the rule of law. The problem is that even with such irrefutable evidence they are unable to carry out a full investigation and determine who is responsible. It’s a scandal that cannot go unpunished. All my solidarity with Roger Torrent.”

130 victims

The cellphones figure on a list of a hundred or so cases across the world that were compiled by Citizen Lab of “representatives of civil society” who were indiscriminately attacked via the WhatsApp vulnerability, according to the Canadian institution. Citizen Lab states that 130 activists have been unjustified victims of the NSO program since 2016.

Pegasus permits conversations to be listened to, messages read, access to the phone’s memory, screenshots to be taken, browsing history to be tracked and for remote access of the device’s microphone and camera. This opens the door for the program to listen to the ambient sound in a room if a phone has been infected. The system even allows for encrypted messages and voice calls to be recorded, according to the Canadian experts.

While Torrent’s cellphone was targeted by Pegasus, in 2019, the parliamentary speaker took part in dozens of political meetings and also appeared as a witness in Spain’s Supreme Court during the trial of the politicians and civil leaders who were involved in the 2017 independence drive in the Catalonia region, which saw an illegal referendum on secession from Spain held in October of that year. Among the sentences handed down by the court, Carme Forcadell, Torrent’s predecessor as speaker in the regional parliament, was given 11-and-a-half years in jail for the offense of sedition.

In May 2019, when he was being targeted with Pegasus, Torrent took part in a meeting in Strasbourg with the Council of Europe Commissioner for Human Rights, Dunja Mijatvic.

English version by Simon Hunter.