Last Monday, May 2nd, it became known that the telephones of the President of Spain, Pedro Sanchez, and his Minister of Defense, Margarita Robles, were infected with the controversial Pegasus software in June 2021, as well as pro-independence politicians such as the President of the Generalitat.
To put it in context, Pegasus is a spyware software, created more than a decade ago by the Israeli security company, NSO Group Technologies. It was supposedly created to fight cybercrime, prevent terrorist attacks, or combat human trafficking and drug trafficking, and is only sold to governments and security forces.
Industry experts estimate that at least 60 militaries, intelligence, or security agencies in 40 countries around the world had this software, many of them in the Middle East and the Persian Gulf. Although the full list is not public, it has been widely used in Saudi Arabia, India, the United Arab Emirates, Mexico, and Hungary.
However, in July 2021, a data leak received by Amnesty International and Forbidden Stories (a Paris-based non-profit media organization), was shared with 17 international media outlets, including The Washington Post, The Guardian, and Le Monde. It revealed that more than 50,000 activists, journalists, political dissidents, human rights defenders, or company directors around the world have been spied on through Pegasus.
How does it work? Pegasus penetrates iPhone and Android devices, through a link sent via SMS or Whatsapp, which is clicked by the user because he thinks it is safe or does not realize it, secretly accessing phone or text messages, photos, emails, calls, or contacts, knowing the location of the person, and even being able to activate microphones without the knowledge of the affected person and record conversations. It also manages to penetrate devices without the user acting, such as opening an attachment or providing account data, although this is less common. In this way, it takes almost unlimited control, without the user’s knowledge.
Among those spied on were the French president, Emmanuel Macron, his prime minister, and 14 other members of his government; the president of Iraq, Barhan Salih, and the king of Morocco, Mohammed VI. It even spied on politicians, authorities, and citizens were spied on.
Latest background of Pegasus in Spain: Two technical reports of the National Cryptologic Center revealed that the devices of the Spanish authorities were tapped last year. In the case of President Sanchez, this occurred in May while that of Minister Robles was in June.
In a press conference called urgently in Madrid, the Minister of the Presidency, Félix Bolaños, reported the situation, which is of “enormous gravity”, and that “we are sure that it is an external attack (…) because in Spain, in a democracy like ours, all interventions are carried out by official bodies and with judicial authorization”, he said. The minister gave several details, but the biggest unknown has not yet been revealed: what the attackers stole. What is known is the volume of data stolen: 2.7 gigabytes stolen from Sanchez, and 9 gigabytes of data extracted from Robles.
The government filed a complaint before the Audiencia Nacional, the high jurisdiction in charge of cases of national or international relevance, such as terrorism.
It is worth mentioning that, last April 18, Citizen Lab -a multidisciplinary laboratory of the University of Toronto focused on research-, together with Amnesty International, denounced the case known as “Catalangate”, which consists of the spying, through Pegasus, of at least 65 telephone numbers of Catalan political figures, their relatives, lawyers and representatives of the civil society and non-governmental organizations, all of them linked to the Catalan pro-independence movement. This adds to this new case of espionage, this time at the heart of the Spanish government.
A report published by the British newspaper The Guardian, points to Morocco as the author of the selection of more than 200 Spanish phones as possible surveillance targets by a client of the Israeli company NSO Group.
