Spanish court opens investigation into Guardia Civil's use of Pegasus spyware
A Barcelona court opened an investigation into allegations that Spain's Guardia Civil and CNI intelligence agency used Pegasus and Candiru spyware to surveil Catalan independence leaders without their knowledge, following a complaint from five technology entrepreneurs and analysis by Citizen Lab.
What happened
Judge Miriam de Rosa Palacio of Barcelona's Juzgado de Instrucción número 2 admitted to investigation a criminal complaint filed by five technology entrepreneurs grouped under the international association Sentinel Alliance against the Guardia Civil, the CNI, and software companies NSO Group and Saito Tech Ltd.
The complaint alleges use of Pegasus and Candiru spyware to conduct surveillance of Catalan independence leaders. The complaint names former Guardia Civil directors Félix Vicente Azón (2018–2020) and María Gámez (until 2023), former CNI director Paz Esteban, and executives of NSO Group including Shalev Hulio and Yuval Somekh, and Isaac Zack of Saito Tech Ltd.
The judge found the allegations could constitute crimes of discovering and revealing computer secrets and illegal access to computer systems. Analysis by Canadian laboratory Citizen Lab and Amnesty International documented the surveillance, referred to as 'Catalangate', in relation to the Tsunami Democràtic platform that organized protests against the 'procés' verdict.
Reported impact
The affected individuals, including businessman and former Junts senator Joan Matamala and former president Pere Aragonès, had their mobile devices infected with spyware without notification, according to the complaint.
The complainants allege they were monitored without knowledge while under secret judicial investigation in cases related to Tsunami Democràtic and CDR.
Index analysis
This is the first investigation by Spanish courts into the Guardia Civil's role in surveillance using Pegasus and the first involving Candiru spyware.
Governance controls
The Audiencia Nacional initially rejected the complaint for lack of jurisdiction, finding competence lay with courts in the location where the alleged infections occurred, leading the complainants to file in Barcelona.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.