Spanish judge indicts two ex-Guardia Civil directors for Pegasus and Candiru spyware use
A Spanish judge has indicted two former Guardia Civil directors and summoned the former CNI director for investigation, reportedly for deploying Pegasus and Candiru spyware to surveil independence activists and cybersecurity professionals between 2019 and 2021. The complaint alleges 78 surveillance attacks including against family members, involving unauthorized device access and data extraction.
What happened
A Barcelona court judge has indicted two former directors of Spain's Guardia Civil, Félix Vicente Azón (2018–2020) and María Gámez (2020–2023), for allegedly using the Pegasus and Candiru spyware to surveil independence activists. The indictment also cites former CNI director Paz Esteban as an investigative target and executives from spyware makers NSO Group and Saito Tech Ltd.
The indictment stems from a complaint by five people including businessman Joan Matamala, filed through the Sentinel Alliance, who allege they were targeted between 2019 and 2021 with a total of 78 attacks including against family members. The querellants assert the surveillance was justified on grounds of potential national security threats from their work on open-source governance and digital voting protocols.
Reported impact
The alleged spyware infections enabled extraction of chats, emails, passwords, files and photographs, and remote activation of device microphones and cameras. The alleged surveillance targeted the complainants and their immediate family members including advisor Elies Campo and extended networks.
Index analysis
This is the first time Spanish courts have indicted former Guardia Civil leadership for alleged involvement in the Pegasus-Candiru surveillance scheme against independence supporters. Paz Esteban now faces five separate imputations related to the spyware incidents; she was dismissed as CNI director in May 2022 following the initial Pegasus scandal disclosure.
Governance controls
The Canadian laboratory Citizen Lab conducted technical analysis that the complainants assert confirms Candiru infections on their devices. The allegations involve potential violations of computer privacy and unauthorized access to computer systems laws.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.