The Catalan president has called on the Spanish government to launch an “official and independent investigation” into how and why he and more than 60 figures associated with the regional independence movement reportedly had their mobile phones targeted using NSO Group’s Pegasus spyware.
Pere Aragonès told the Guardian that the alleged targeting, revealed by Citizen Lab cybersecurity experts on Monday, constituted a violation of individual rights, an attack on democracy, and a threat to political dissent.
“My phone was targeted because of my political duties – first as regional vice-president, and then as regional president,” he said. “That goes beyond what was done to me as an individual and as a citizen. They were also attacking the democratically elected institution that is the Catalan government, which is an attack on all Catalan citizens and institutions, and, as such, an attack on democracy.”
According to Citizen Lab, Aragonès and his three pro-independence predecessors were among at least 65 individuals whose phones were targeted or infected with mercenary spyware using fake texts or WhatsApp messages. Almost all the incidents took place between 2017 – the year of the failed bid for Catalan regional independence – and 2020.
Although NSO Group claims that Pegasus is sold only to governments to track criminals and terrorists, a joint investigation two years ago by the Guardian and El País established that the speaker of the Catalan regional parliament and at least two other pro-independence supporters were warned the spyware had been used to target them.
Aragonès said the apparent spying had been on such a “massive scale” that it could not have escaped the attention of the Spanish authorities. Nor, he added, was it likely to have been the work of a single agent within Spain’s National Intelligence Centre (CNI).
“Big and significant resources would have been needed to set up this spying system,” he said. “There are also approval processes that intelligence services need to go through, and that obviously means that this couldn’t have gone unnoticed.”
The Catalan president said that while spying on any citizen was a serious matter, the apparent use of Pegasus against politicians, lawyers and civil society groups was particularly worrying.
“As far as we’re concerned, it’s absolutely essential that there’s an official and independent investigation into whether, in this case, the CNI, or the Policía Nacional or the Guardia Civil police forces of the Spanish state have used this program,” he said.
“We need to know exactly how many times it was used, against whom, and with what justification. That will determine who was responsible. A government can’t say that it didn’t know what was going on. If it didn’t know, it needs to find out who was responsible internally – because this is about persecuting political dissent.”
Aragonès said that while the targeting had “decimated” trust in the Spanish government, his administration was still open to finding a negotiated solution to the political conflict that plunged Spain into crisis almost five years ago.
He also warned the use of spyware such as Pegasus needed to be addressed around the world because “we’re dealing with behaviour here that hasn’t only happened in Catalonia”. Even if Pegasus were to disappear, Aragonès added, new software would soon take its place.
“We need limits on this technological intrusion into people’s privacy,” he said. “At the end of the day, a mobile phone is an extension of our own personal and private life. It’s essential that there are independent mechanisms to verify that governments are not using tools that were developed to tackle terrorists against political rivals or adversaries.”
Citizen Lab and Amnesty International have also called for an official inquiry into the matter.
The Spanish government has denied any wrongdoing, while the Policía Nacional and the Guardia Civil have said they have had no dealings whatsoever with NSO groups and have never used its services.
Speaking on Tuesday afternoon, the government’s spokesperson, Isabel Rodríguez, said the allegations of spying were not new and had already been addressed by the government. “But I’d like to reiterate our position, which is that the government has nothing to hide – absolutely nothing,” she said.
“And so the government will cooperate fully with the justice system and any investigations into these matters if that’s what is asked by the courts. I’d also like to stress that Spain is a democratic state with full rule of law. As such, any limitation on the fundamental rights of requires a judicial decision to be taken.”
Rodríguez said the Socialist-led coalition government would not put up with Spain’s “democratic quality” being called into question.
However, she said she could not comment on whether the CNI had access to Pegasus or whether it had ever deployed the programme.
“There are matters that relate to national security that are protected by law and are classified material – secret matters – and I can’t get into that,” said Rodríguez. “The law prohibits it.”
The CNI has previously told the Guardian and El País that its work is overseen by the supreme court and that it acts “in full accordance with the legal system, and with absolute respect for the applicable laws”.
A spokesperson for NSO said: “NSO continues to be targeted by a number of politically motivated advocacy organisations like Citizen Labs and Amnesty to produce inaccurate and unsubstantiated reports based on vague and incomplete information.
“We have repeatedly cooperated with governmental investigations, where credible allegations merit. However, information raised regarding these allegations are, yet again, false and could not be related to NSO products for technological and contractual reasons.”
