Catalan leaders targeted using NSO spyware, say cybersecurity experts

Victims said to include Pere Aragonès and Carles Puigdemont, but Israeli firm suggests claims are false

Dozens of pro-independence Catalan figures, including the president of the north-eastern Spanish region and three of his predecessors, have been targeted using NSO Group’s Pegasus spyware, according to a report from cybersecurity experts.

The research published on Monday by Citizen Lab, considered among the world’s leading experts in detecting digital attacks, said victims of the mobile phone targeting included Pere Aragonès, who has led Catalonia since last year, as well as the former regional presidents Quim Torra, Carles Puigdemont and Artur Mas.

It also found that MEPs, legislators, lawyers, civil society activists and journalists were targeted, as were some members of their families.

Although NSO Group claims that Pegasus is sold only to governments to track criminals and terrorists, a joint investigation two years ago by the Guardian and El País established that the speaker of the Catalan regional parliament and at least two other pro-independence supporters were warned the spyware had been used to target them.

The Citizen Lab report said at least 65 individuals had been targeted or infected with mercenary spyware, of whom at least 63 were targeted or infected with Pegasus. Almost all the incidents took place between 2017 – the year of the failed bid for Catalan regional independence – and 2020. Victims’ phones were said to have been targeted using fake texts or WhatsApp messages.

It said Aragonès wastargeted while serving as vice-president of Catalonia, while Torra – who served as regional president between 2018 and 2020 – was targeted while in office. Puigdemont, who led the failed, unilateral push for independence almost five years ago, was also targeted – as was Mas, who was targeted after leaving office.

Thirty-one regional MPs – 27 of them from the three pro-independence Catalan parties – were reportedly targeted, as were nine members of the two powerful grassroots groups, the Catalan National Assembly and Òmnium Cultural.

The Citizen Lab investigation also concluded that multiple lawyers representing prominent Catalan separatists Catalans were targeted and infected with Pegasus. According to the report, they include Gonzalo Boye, who represents Puigdemont, and Andreu Van den Eynde, a lawyer for several high-profile pro-independence politicians including the former regional vice-president Oriol Junqueras.

The report said the number of confirmed mercenary spyware victims was “extraordinarily high … [and] gives a window into what is likely a larger effort to place a significant slice of Catalan civil society under targeted surveillance for several years”.

Citizen Lab pointed out that NSO Group claims that Pegasus is sold only to governments, adding: “While we do not currently attribute this operation to specific governmental entities, circumstantial evidence suggests a strong nexus with the government of Spain, including the nature of the victims and targets, the timing, and the fact that Spain is reported to be a government client of NSO Group.”

It called for an official inquiry to determine who had ordered the targeting, what judicial oversight had applied, and how the hacked material was used.

Aragonès said Citizen Lab’s findings, which were first reported in the New Yorker, had revealed “a case of espionage against a democratic European movement, which puts fundamental rights at risk everywhere”.

He called on the Spanish government to provide immediate explanations, saying: “Spying on public representatives, lawyers or civil right activists is a red line.”

Amnesty International, which peer-reviewed Citizen Lab’s investigation and said it had found evidence of Pegasus targeting and infection in all cases, said the Spanish government needed to clarify whether it was an NSO Group customer.

It also urged the government to conduct “a thorough, independent investigation” into the reported use of Pegasus against those identified by Citizen Lab.

“Governments around the globe have not done enough to investigate or stop human rights violations caused by invasive spyware like Pegasus,” said Likhita Banerji, Amnesty International’s technology and human rights researcher.

“The use, sale and transfer of this surveillance technology must be temporarily halted to prevent further abuses of human rights.”

A spokesperson for NSO said: “NSO continues to be targeted by a number of politically motivated advocacy organisations like Citizen Labs and Amnesty to produce inaccurate and unsubstantiated reports based on vague and incomplete information.

“We have repeatedly cooperated with governmental investigations, where credible allegations merit. However, information raised regarding these allegations are, yet again, false and could not be related to NSO products for technological and contractual reasons.”

A spokesperson for Spain’s interior ministry said neither the ministry, the Policía Nacional, nor the Guardia Civil had ever had any dealings with NSO Group and had consequently never contracted any of its services. He added: “All communications intercepts are carried out under judicial authority and with full respect for the law.”

Spain’s National Intelligence Centre (CNI) has previously told the Guardian and El País that its work is overseen by the supreme court and that it acts “in full accordance with the legal system, and with absolute respect for the applicable laws”.

In US court filings in response to claims by WhatsApp, NSO Group has denied allegations that it bore any responsibility in the targeting of individuals and said it did not operate the technology itself.


Sam Jones in Madrid

The GuardianTramp

Related Content

Article image
Second Catalan politician says phone was targeted by spyware
Ernest Maragall revelation set to boost calls for inquiry into possible domestic espionage

Stephanie Kirchgaessner, Sam Jones in Madrid and Jennifer Rankin in Brussels

14, Jul, 2020 @6:02 PM

Article image
Who has been using spyware on Catalan independence campaigners?
At least two victims have blamed the mobile phone infiltration on a ‘dirty war’ by the Spanish state

Sam Jones in Madrid and Stephanie Kirchgaessner in Washington

17, Jul, 2020 @4:14 PM

Article image
Phone of top Catalan politician 'targeted by government-grade spyware'
Exclusive: Guardian and El País find regional speaker was targeted in ‘possible domestic political espionage’

Stephanie Kirchgaessner and Sam Jones

13, Jul, 2020 @10:15 PM

Article image
Catalan leaders facing rebellion charges flee to Belgium
Carles Puigdemont to give press conference in Brussels at lunchtime on Tuesday, Belgian lawyer says

Sam Jones in Barcelona

31, Oct, 2017 @9:37 AM

Article image
Two Catalan politicians to take legal action over targeting by spyware
Pair say they will file complaint against former head of Spain’s national intelligence centre

Sam Jones and Stephanie Kirchgaessner

16, Jul, 2020 @9:48 AM

Article image
Catalan government suspends declaration of independence
President Carles Puigdemont says he will pursue negotiations with Spanish government in hope of resolving conflict

Sam Jones in Barcelona

10, Oct, 2017 @6:10 PM

Article image
Pegasus spyware inquiry targeted by disinformation campaign, say experts
European parliament is investigating powerful surveillance tool used by governments around the world

Stephanie Kirchgaessner in Washington and Sam Jones in Madrid

28, Nov, 2022 @12:14 PM

Article image
Spain dissolves Catalan parliament and calls fresh elections
Madrid dissolves Catalan parliament after secessionist MPs vote to create ‘Catalan republic as an independent and sovereign state’

Sam Jones, Stephen Burgen and Emma Graham-Harrison in Barcelona

28, Oct, 2017 @9:56 AM

Article image
Catalan president accuses Spanish king of being government mouthpiece
Carles Puigdemont calls for dialogue with Madrid but says he will press on with plans for declaration of independence

Sam Jones and Stephen Burgen in Barcelona and Daniel Boffey in Brussels

05, Oct, 2017 @9:15 AM

Article image
Spanish court blocks Catalan parliament from declaring independence
Constitutional court suspends Monday session, ruling that allowing possible declaration would violate MPs’ rights

Sam Jones in Barcelona

06, Oct, 2017 @6:27 AM