Draft EU spyware inquiry findings suggest Spain behind espionage of independence movement

The preliminary findings of the EU Parliament inquiry into the use of Pegasus and equivalent surveillance spyware point to the Spanish government as the party behind the mass espionage of members of the Catalan independence movement.

Known as Catalangate, this was first revealed by tech crime research group Citizen Lab and The New Yorker in April.

According to the EU Parliament's draft report, these instances "show a clear pattern" and "relate to moments of political relevance, such as court cases against Catalan separatists, public rallies, and communication with Catalan separatists living outside Spain."

"Very little official information"

In a press conference in Brussels on Tuesday, Dutch MEP and inquiry committee rapporteur Sophie in 't Veld stated that Spain was "probably" NSO Group's first client in the European Union. 

"We have very little official information on what is happening but what we do see is that there are strong indications that politicians and others have been monitored, spied upon, with no evident, imminent, immediate threat to national security," in 't Veld said of Spain.

"We warmly invite Spanish authorities to provide us with more information so we can assess the situation," she said, adding that she understood it was "a very delicate" matter. 

The draft report also suggests that, as Spanish authorities have only admitted to 18 of the 65 cases that were revealed, "it is not possible to determine" that the independence movement posed a "threat to national security or the integrity of the state."

In 't Veld called the use of espionage tools by governments "deeply worrying" when "there is no accountability" and said that sending a delegation to Spain to investigate the case would be helpful. 

"Velvet gloves" for internal threats 

The Dutch MEP was very critical of what she described as the EU's "firm" stance against external threats to democracy, including new Twitter CEO Elon Musk's stance on content moderation, while being "silent" about threats that do not come from "some faraway stranger but the governments of EU member states."

And although the European Commission fights attacks on democracy from the outside and has a democracy action plan to counter fake news, she said "the commission suddenly considers that the defense of EU democracy is no longer a European matter, but a matter for the member states" when threats come from within. 

"The commission shows muscle to Musk, but velvet gloves to member states using spyware on citizens," the MEP said. 

Catalan president: "In a democracy, you don't spy on your political opponent"

Catalan president Pere Aragonès took to Twitter to react to the draft report's findings: "In a democracy, you don't spy on your political opponent. We must get to the bottom of the matter."

Aragonès himself is reported to have been infected with spyware while serving as vice president under former president Quim Torra.

All four Catalan presidents since 2010 have been targeted either while in office, beforehand, or during their retirement. 

Foreign minister Meritxell Serret, meanwhile, said that the Catalan government "welcomed" the draft report's findings and would be paying close attention to the final conclusions in the coming months. "We celebrate the warning that has been issued to Spain," she said. 

Reactions from other parts of the independence movement were quick to come. The far-left CUP party called for Spanish justice minister Margarita Robles and interior minister Fernando Grande Marlaska to step down, while civil society group Òmnium said Spain was prepared to face "international discredit" before backing down. 

Spanish government defends actions

Despite the preliminary findings of the report, Spanish government sources have defended their handling of the Pegasus affair. 

They say that the government are the "first ones interested" in clarifying the facts and point out that it is a provisional report, not yet definitive. 

The executive "did what it had to do" when it learned of "criminal actions," – referring only to the spying cases that affected Spanish prime minister, Pedro Sánchez, and ministers Marlaska and Robles. 

Regarding the other cases, they say, the executive has nothing more to add.