A second prominent member of Catalan’s pro-independence movement has revealed he was warned that his mobile phone was targeted using spyware.
The development is likely to bolster calls for an investigation into the possible use of hacking technology by Spanish authorities.
Ernest Maragall, an MP in the regional parliament and a former member of the European parliament who also served as Catalan foreign minister, told the Guardian and El País that he was alerted by researchers working with WhatsApp that his phone had been targeted last year.
A joint investigation by the newspapers revealed on Monday that Roger Torrent, the speaker of the Catalan parliament, was also targeted in 2019, according to researchers at Citizen Lab at the University of Toronto, who have collaborated with WhatsApp.
“It is terrible,” Maragall said. “This is not a surprise. It is just a part of the techniques, of the reality we are living in every day. We are in a situation where judicial actions, policies, security forces, prosecutors, everybody ... is against our movement, our peaceful and democratic movement as citizens here in Catalonia.”
Torrent and Maragall – as well as two other pro-independence activists – were alerted that they were targeted in April-May 2019, when spyware used by government clients around the world exploited a previous vulnerability in WhatsApp software. The spyware, made by Israel’s NSO Group, allows the operator of the hacking tool to access an individual’s phone, including emails, calls and text messages.
NSO Group has said it has no knowledge or control over how its clients use the spyware.
Current and former leaders of Catalonia’s pro-independence government have called for an inquiry into what one researcher at Citizen Lab called a “possible case of domestic political espionage” in Europe.
Torrent called the reports “extraordinarily serious”, adding: “We cannot normalise spying on political dissidence.” He said that if the Spanish government knew of the facts in the case “then it would have been complicit in a crime”.
If it did not, he said, “it would be a very worrying symptom of political negligence and unawareness of illegal practices”.
Gabriel Rufián, the spokesman in the national parliament for the Catalan Republican Left party, called on Spain’s interior minister, Fernando Grande-Marlaska, to “provide explanations over the alleged spying and invasion of privacy against Catalan political leaders by government organisations”.
The revelations also resonated in the European parliament, where one of the most senior allies of Pedro Sánchez, the Spanish prime minister, called for an investigation into the targeting of Torrent’s phone.
Juan Fernando López Aguilar, a Spanish Socialist MEP who chairs the European parliament’s civil liberties committee said: “Any indication that there might have been an intrusion in the confidentiality of data of European citizens – be it high officials, representatives, or private citizens for that matter – should be thoroughly investigated.” In Spain, he said, such investigations are a matter for the public prosecutor.
He added that there was “no ground whatsoever to point out the responsibility of any national agency or government [in connection] to that information we have just read of”.
The Spanish government said it was a legal, rather than political matter, and suggested that Torrent report his concerns to the judicial authorities.
“The government has no evidence that the speaker of the Catalan parliament has been the victim of a hack or theft involving his mobile,” the government’s spokeswoman, María Jesús Montero, told reporters on Tuesday afternoon.
“When questions of this nature arise, the procedure is well known: you inform the relevant judicial authorities about the hack or tapping, or the theft from a device, and they can then investigate whether it has happened and under what circumstances. Any mobile phone tapping always requires preliminary judicial authorisation. This isn’t something for the government.”
In a statement, Spain’s interior ministry said: “Neither the interior ministry, nor the national police, nor the Guardia Civil have ever had any relationship with the company that developed this program, and, as such, have never contracted its services.”
It added that the actions of state security forces were always conducted “with the utmost respect for the law”.
Spain’s National Intelligence Centre (CNI) said in a statement that it acted “in full accordance with the legal system, and with absolute respect for the applicable laws” and that its work was overseen by Spain’s supreme court.
It did not respond to specific questions about the alleged use of “Pegasus” spyware sold by NSO Group.
WhatsApp has said that a total of 1,400 users were targeted in the 2019 attack, which is now the subject of a lawsuit by the messaging app against NSO Group. The California company has claimed that 100 members of civil society – including journalists in India, human rights activists in Morocco, diplomats and senior government officials – are alleged to have been affected.
NSO Group has denied it has any role in operating its hacking software and has said it has no knowledge of who its government clients target.
The company said it operated under “industry-leading governance policies” and that it could not confirm or deny which authorities used its technology because of confidentiality constraints.
The company has been critical of Citizen Lab, which has closely researched the use of NSO Group’s spyware, and said researchers had failed to “competently address the challenges faced by law enforcement agencies” who need to intercept encrypted communications. NSO Group has said it sells its spyware solely for governments to track terrorists and criminals.
López Aguilar, who worked on the European parliament’s response to 2013 revelations that the US National Security Agency had hacked the telephone records of millions of people, said all EU member states were bound to follow European law on data privacy, including the General Data Protection Regulation.
“Any member states that might have some breach of that European law should be accountable for it, but those reports first of all have to be fully verified. Protection of rights and privacy are of the essence for the consistency of Europe.”
