BARCELONA, Spain — A leading Catalan separatist politician said Thursday that Spain’s top intelligence official acknowledged that her agency had hacked into the cellphones of “some” of the dozens of politicians reported to be targeted by spyware but she said it had proper judicial authorization.
A recent report by the Canadian-based digital rights group Citizen Lab on the use of the controversial Pegasus spyware in Spain said dozens of pro-independence supporters in Spain’s northeastern Catalonia region were spied upon using the software.
When asked by The Associated Press, Spain’s Defense Ministry, which is in charge of the CNI, refused to comment on the meeting with CNI director Paz Esteban because its contents are considered classified. Leading Spanish media, however, also reported that the director had shown committee members court authorizations for hacking the cellphones of some Catalan separatists.
“They (the CNI) admit to the spying, but say that it was carried out against far fewer people than those cited by Citizen Lab,” Rufián said.
As for the rest of the over 60 politicians, lawyers and activists cited as hacking targets by Citizen Lab, Rufián said the CNI director “point(ed) to two possibilities: One, that it was a foreign country; or two, state agencies that are spying beyond their legal limits.”
The highly anticipated meeting took place at Spain’s Parliament building in Madrid.
The Catalan separatists, who want to carve out a new state in northeastern Spain around Barcelona, had directly accused the CNI of being behind the hacks that came to light two weeks ago when the Citizen Lab report was released.
Spain’s government has repeatedly said the CNI cannot tap phones without prior judicial authorization. At the same time, the government said the secrecy law shielding all CNI activities prevents the agency from confirming whether it possesses Pegasus, the spyware sold by Israeli company NSO Group.
While representatives from Prime Minister Pedro Sánchez’s Socialist party and the opposition Popular Party emerged from Thursday’s meeting saying they were satisfied by Esteban’s explanations, Rufián was not alone in demanding further action.
“We insist that the information that we received today be declassified for the public to know, since it affects fundamental rights,” said Albert Botran, who is among the politicians that Citizen Lab said was spied upon.
The Spanish government has promised that both CNI and the nation’s ombudsman will investigate the Citizen Lab report.
Amnesty International, which has denounced the use of the Pegasus spyware in several countries, on Thursday demanded more transparency from Spain.
“This committee, characterized for its secrecy and obscurantism, cannot be considered the appropriate venue to investigate the alleged violence of human rights,” said Esteban Beltrán, Amnesty’s director in Spain.
In addition to the Catalan hacking case, Spain’s intelligence agency is facing an uncomfortable spotlight due to another case of Pegasus hacking. Earlier this week, Spain announced that the cellphones of both Sánchez, the prime minister, and Defense Minister Margarita Robles were infected last year with Pegasus spyware.
Although Spain has refused to point a finger at Morocco, the dates the phones of Sánchez and Robles were hacked last year match up with a diplomatic crisis between the two countries.
Amid the back-to-back scandals, plans for a public ceremony to observe CNI’s 20th anniversary were postponed.
Robles has encouraged the Catalans to take their hacking case to court, just like the Spanish government has, to determine who is responsible.
“Only the judiciary can determine who is responsible,” Robles said Thursday. “We can only take our cases to court, and in the meantime refrain from accusations.”
Robles has appeared to justify the crackdown on the Catalan separatists for their role in Catalonia’s illegal secession bid in 2017 and the mostly peaceful pro-secession street protests organized via a secretive social media platform. The events sometimes spiraled out of control and led to clashes with police, the blocking of roads and train lines, and the closure of Barcelona’s airport in 2019.
The CNI, which oversees Spain’s cybersecurity, only discovered that Sánchez’s and Robles’ phones had been hacked after the devices underwent deep scans following the revelations of the breaches into the phones of the Catalans. Previous checks found no evidence of the hacks in May and June 2021, the government has been forced to admit.
The hacking scandals, coming in quick succession, have left many Spaniards wondering how widespread the spying is, and which actor, or actors, are behind it. Some Catalan separatists accuse Spain of using the revelation of the hacking of top officials to detract attention from their cases.
“Being a victim does not preclude you from being a perpetrator when it comes to Pegasus,” John-Scott Railton, senior researcher at Citizen Lab, told The AP on Thursday. “NSO’s objective is to proliferate this spyware, not to protect the security of countries.”
“This will not be solved quietly. This will not be solved with partial truths,” Railton said. “There has been some partial confirmation here, and the only road forward here is more transparency.”
The European Parliament opened an investigation into Pegasus’ use in the European Union, initially intended to focus on Hungary and Poland. The list of Catalans allegedly hacked also includes European Parliament members.
Digital break-ins of phones with Pegasus have been reported and denounced in several countries. French President Emmanuel Macron was included on a list of heads of state that Amnesty International suspected were targeted last year.
