The NSO Group and its now-infamous Pegasus spyware has a “monopoly” in Europe, according to a massive exposé published by The New Yorker last week. However, while most reports of the software’s misuse are linked to illiberal or authoritarian regimes, Ronan Farrow’s investigation focused on how Pegasus – which was developed to fight terrorism – was used by European states for other ends.
The University of Toronto-based Citizen Lab digital rights group found more than 60 people linked to the Catalan separatist movement in northeastern Spain had been targeted with Pegasus after a failed bid to break away from Madrid in 2017. The targets included several members of the European Parliament, Catalan politicians, lawyers and activists.
Among those targeted were the current president of the Catalan regional government, Pere Aragonès, and his two predecessors. This shows how even the most democratic of regimes can apparently use the software for internal political goals – in this case against a legitimately elected democratic movement.
The Spanish government has denied illegally spying on the Catalans. According to Reuters, though, it has been silent on whether it undertook any court-approved electronic surveillance.
NSO said last week’s reports and all previous ones about any illegal targeting of Catalans were “false.”
In an interview via video conference, Aragonès said that as president of the semi-autonomous region, he is “committed to a peaceful political solution to the conflict between Catalonia and Spain. We’re a democratic movement that is struggling for independence – but because we’re a pro-independence movement, they consider and treat us like a terrorist group.”
Publishing its findings in tandem with The New Yorker’s reporting, Citizen Lab said that almost all of the infections took place between 2017 and 2020, following the unsuccessful independence bid by Catalonia that plunged Spain into its worst political crisis in years.
- 'Great Alarm': First Detected Use of Mysterious Israeli Spyware on EU National
- Not Just NSO: Was Another Israeli Spyware Used in the Caribbean?
- U.K.’s PM Johnson’s Office Among Dozens of EU Targets of NSO Spyware, Report Says
Citizen Lab began its investigation in 2020 after researchers working with Facebook’s WhatsApp warned several Catalan lawmakers that their phones had been hacked. Later that year, the El Pais and Guardian newspapers revealed that Catalan leaders had been targeted.
Last week, Citizen Lab said it could not conclusively attribute the spying operations to a specific entity but noted that “strong circumstantial evidence suggests a nexus with Spanish authorities.”
Speaking to Haaretz after the report was published, Aragonès said that “a democratic state does not spy on its citizens ... a democratic state does not listen in on the private conversations of its political opponents.”
Since taking office, Aragonès has been working to get talks with Madrid back on track. However, he said the Pegasus infections, which his movement has long suspected, he added, created a big problem. “We need minimum confidence between both parties to advance in negotiations. It’s very difficult to be engaged in political negotiations if you think the other party is spying on you,” he said.
The 2017 referendum, which was conducted unilaterally, caused a political crisis with the Spanish government. The region’s autonomy was suspended for almost seven months, while Spain’s Supreme Court subsequently sentenced nine Catalan politicians and activists to lengthy jail terms for their roles in the independence bid.
Aragonès said Catalans want to hold another “referendum about independence, as part of an agreement with the Spanish government. For that purpose, we are starting a conversation with the Spanish government – but now you have this problem of confidence.”
He said that although no one knows for certain that Madrid is behind the snooping, “we suspect the Spanish intelligence agency. Who can be the other government that could be interested in my activities? This software can only be bought by states. The Spanish intelligence agency declared [in the past] that they bought this software. So yes, everybody is looking at Madrid,” he said.
“We don’t know if it was illegal surveillance or if it was authorized by the court,” Aragonès continued. “If it was legal, that means they’re using a software that has been developed for counterterrorism to surveil legal political activity.”
The Catalan president said being under surveillance has affected his movement’s ability to function. “When I received the first messages that tried to infect my phone, it was when I was conducting negotiations about the elections with the incoming Spanish prime minister, Pedro Sánchez.” In retrospect, he added, there was an “asymmetry” of power in the negotiations, since the other side “knows everything about you and your political activity.”
Since they first started suspecting that their devices were infected, Aragonès said Catalans’ political behavior has changed. “We have a lot of difficulties organizing, planning and developing our political responsibilities, because we cannot be sure our phones are a safe way to communicate. For example, Marta Rovira, the general secretary of our [Republican Left of Catalonia] party, is living in exile in Geneva. Whenever I need to talk to her, I travel there,” he explained. He added that the Catalan leadership conducts all sensitive talks in face-to-face meetings held in closed rooms, with all devices left outside.
Unlike the Ukrainains, who have expressed an interest in receiving the NSO Group’s spyware, Aragonès said Catalonia “does not want Pegasus. We think this kind of software can only be used on criminals and terrorists.”
Still, the Catalan leader did not blame Israel for selling the spyware to Madrid. He said Jerusalem and even NSO are not responsible for what was done with the spyware.
Furthermore, he said the spyware is not just a local Spanish problem but instead a European one.
“Our leadership is all over Europe and the spyware crosses borders; it’s not only the case of the Catalonian political opposition, or this case in Poland or in Hungary where there has also been surveillance, or even 10 Downing Street” in London, where the British prime minister resides.
Reuters contributed background to this report.