Spanish government dismisses head of intelligence agency amid espionage scandals

The Spanish government has dismissed the head of the intelligence agency (CNI), Paz Esteban, replacing her with Esperanza Casteleiro.

Following initial reports by the El País newspaper on Tuesday, the Spanish government cofirmed the move made during a cabinet meeting, which comes a few days after Esteban admitted that authorities had spied on Catalan pro-independence leaders, with judicial authorization.

The Spanish government also revealed the results of tests on cabinet members' devices for spyware infection, confirming three cases already known: phones belonging to Spanish prime minster Pedro Sánchez, the defense minister, Margarita Robles, and the interior minister, Fernando Grande-Marlaska. 

Catalan pro-independence figures and victims of the Catalangate espionage scandal had been calling for Esteban to be removed from her post.

On Thursday, she admitted in the Spanish congress that the state had spied on 18 pro-independence leaders with judicial authorization, including current president Pere Aragonès, and several close associates of former president Carles Puigdemont. 

After weeks of mounting pressure from the Catalan pro-independence parties and human rights groups - on both Esteban and on Spain's defense minister, Margarita Robles, in charge of CNI - on May 5, Esteban explained to a congress official secrets committee that the intelligence agency had been granted approval to carry out a surveillance operation by Spain's Supreme Court. 

Judge Pablo Lucas greenlighted phonehacking against some of the politicians and activists featured in Citizen Lab's Catalangate report, but, it would seem, not all of them.

In recent days, neither the Spanish government nor the ruling Socialist Party rejected the idea that sackings were an option, as they waited for the analysis of other ministers' phones.

Phones belonging to Sánchez, Robles, and Grande-Marlaska were infected with Pegasus, but in these cases, it was down to an "external and illicit" attack, presidency minister Félix Bolaños said at the time. 

The Spanish government confirmed on Tuesday that analysis showed that devices belonging to Sánchez, Robles, and Grande-Marlaska had indeed been infected, and that there was also a failed attempt to hack a phone belonging to Luis Planas, Spain's agriculture minister, but that no another ministers were affected.

Those attacks took place in May and June 2021 and the perpetrators remain unknown.

Catalan government: Esteban dismissal "not enough"

The change at the head of the Spanish intelligence services "does not resolve everything and does not bring an end to the issue," the Catalan government spokesperson, Patrícia Plaja, said on Tuesday, adding "anyone who believed it did was wrong."

"It is not enough," she told press following the Catalan executive's weekly meeting, and called for "explanations and transparency" in order to find out "who allowed the spying, who ordered it, and who knew about it."

Plaja also called for the declassification of documents and a "guarantee that something like this will not be repeated."

"Documents must be declassified. This is not about gestures." 

First dismissal since Pegasus espionage scandal

Esteban becomes the first casualty since the Pegasus spyware scandal broke on April 18. Announcing Esperanza Casteleiro Llamazares as the new head of the CNI, Robles chose to describe Esteban's dismissal as a "replacement," rather than sacking.   

During the press conference following the cabinet meeting, Robles stressed that the appointment will see things "continue as normal" at the CNI, as Casteleiro brings "almost 40 years" of experience.

Robles neglected to share what motivated Esteban's removal and thanked her for her work as director of the intelligence services.

The defense minister has also faced calls from pro-independence parties for her to step down, but maintains that she will continue to "serve Spain" as she has done for the last four years," and that she will act guided by "respect for the rule of law" and "empathy".

Robles added that she was in favor of declassifying information, without mentioning the scope or timeframe, saying it would show that actions were "in accordance with the law."

Paz Esteban led the CNI from July 2019, initially in an interim capacity until February 2020 when she was officially appointed. She has been working at the intelligence agency since 1983, when it was called the Centro Superior de Información de la Defensa (CESID). In 2017, she became secretary-general of the Centro Nacional de Investigación (CNI). 

Catalangate

Catalangate is the name given by the Citizen Lab, a University of Toronto-based research group that reports on high-tech human rights abuses, to its investigation into the espionage against several Catalan pro-independence politicians, activists, and their close associates. 

It is "the largest forensically documented cluster of such attacks and infections on record," the New Yorker magazine said on April 18. 

Although most infection attempts took place between 2017 and 2020, Citizen Lab did detect one in 2015. The victim of this early cyberattack was Jordi Sánchez, the former Catalan National Assembly (ANC) president and one of the jailed and then pardoned leaders of the October 1, 2017 referendum.

Other targets include all of the Catalan presidents who have been in office since 2010. Artur Mas (in power from 2010 to 2015) was hacked after leaving office, while Quim Torra (2018 - 2020) had his phone infected while still serving as president. The phone of Pere Aragonès, the leader since 2021, was infected while he was serving as vice president under Torra.

Carles Puigdemont (2016 - 2017) was not attacked directly but was a relational target as up to 11 of his close associates, including his spouse and his lawyer, Gonzalo Boye, had their phones hacked.