Spanish intelligence agency acquired Pegasus spyware in first half of 2010s

The National Intelligence Center (CNI), Spain’s intelligence agency, acquired the Pegasus espionage system in the first half of the 2010s for an initial cost of €6 million according to El País. The Spanish news outlet cites sources close to the Spanish intelligence services.

The CNI is thought to have purchased the software from Israeli company NSO with the intention of using it abroad. Ultimately, it was used to spy on more than 60 pro-independence Catalan politicians and members of civil society. The revelations were published by Citizen Lab and The New Yorker on Monday.

Catalonia’s independence movement became stronger in the first half of the last decade, as the government of Artur Mas held a non-binding citizen participation process on the political future of Catalonia, where citizens were asked whether they wanted Catalonia to become an independent state.

Neither confirm nor deny

The former director of the Spanish intelligence services, Félix Sanz Roldán, said on Wednesday that he “could not confirm nor deny” the use of Pegasus technology to spy on pro-independence leaders. Roldán told Spanish national broadcasters TVE that he could not even talk about the matter. “There is a clear law that says that the CNI cannot talk about its means, its procedures or its relations with third parties,” he explained, adding that it would be a “violation of the law” to speak about it.

Sanz Roldán was director of the CNI between 2009 and 2019, and therefore part of the wiretaps that The New Yorker and Citizen Lab revealed this week would have occurred during his tenure.

Spain’s Minister of Defense, Margarita Robles, denied that the National Intelligence Center, which falls under her ministry, carried out any illegal operation of listening to and spying on pro-independence politicians. In an interview with TVE, Robles questioned the report of Citizen Labs, whom she referred to as “an NGO”.

She also rebuked Catalan president Pere Aragonès for his comments on the Spanish intelligence services without providing proof. “We are in a state of law and these accusations cannot be made” against an organization that by law “cannot be defended,” Robles said.  “The CNI complies with the law and the allegations must be made with a minimum of foundation and evidence.”

Mass surveillance

In a statement at the Catalan government headquarters in Barcelona, Aragonès said that “the Catalan pro-independence movement as a whole has been a victim of a mass surveillance program that has taken place in five different European countries and has also directly affected the European parliament,” referring to the several MEPs spied on. Therefore he said that Spain has to be “transparent” in order to handle the issue, finding out who ordered the espionage and who was monitoring these actions.

Aragonès emphasized that Catalangate is not an internal affair. “We urge the European Parliament and other European institutions to reinforce the calls for a thorough investigation into the mass surveillance that has been certified,” he expressed.

The Catalan government will redifine its relationship with its Spanish counterpart in the wake of the news that over 60 pro-independence politicians, activists and their close associates had been the target of Pegasus spyware in what is the world’s largest known cyberattack of its kind. Both the independence camp, as well as the researchers in Citizen Lab organization responsible for the findings, believe the perpetrators of espionage are within the Spanish government.

Along all of his ministers, the Catalan president, Pere Aragonès, said on Tuesday evening that “normal political relations” with Madrid cannot resume until Catalangate is clarified, that is, until an internal investigation within the Spanish government is launched and the accountability of those responsible is ensured. Yet, the Socialist-led cabinet has already denied the possibility of such an inquiry.