UN Special Rapporteur highlights 'relevance' of Catalangate and calls for Pegasus spyware ban

The United Nations Special Rapporteur on Freedom of Association and Peaceful Assembly, Clément Voule, considers Catalangate to be a "relevant" espionage case. 

On Monday, the UN representative also urged states to stop using Pegasus, calling for a "moratorium on the sale of this type of spyware." 

During the UN Human Rights Council meeting, the president of the Catalan civil society group Òminium Cultural, Xavier Antich, requested that the committee "implement strict measures" to "forbid the use of Pegasus." 

"It endangers all of us," Antich argued, urging the UN to intervene in the matter to compel the Spanish government to "undertake an investigation immediately."

"Spain used Pegasus to attack the heart of democracy: civil society and political opponents," Antich said before adding that it was “fundamental to guarantee that these intolerable acts are not repeated."  

What is Catalangate?

Catalangate is the name that Citizen Lab, a University of Toronto-based research group that reports on high-tech human rights abuses gave its investigation into the espionage of several Catalan pro-independence politicians, activists, and their close associates. 

It is "the largest forensically documented cluster of such attacks and infections on record," the New Yorker published on April 18, 2022. 

Phones were infected using spyware programs Pegasus and Candiru. Pegasus, from Israeli company NSO Group, is known internationally for its previous infections of renowned people, such as murdered Saudi Arabian journalist Jamal Khashoggi, or members of Rwanda’s opposition party.

Candiru, founded by former NSO Group employees, is not as well known but is similar to Pegasus. 

Who are the main victims?

Although most infection attempts took place between 2017 and 2020, Citizen Lab did detect one in 2015. The victim of this early cyberattack was Jordi Sánchez, the former Catalan National Assembly (ANC) president and one of the jailed and then pardoned leaders of the October 1, 2017 referendum.

Other targets include all of the Catalan presidents who have been in office since 2010. Artur Mas (in power from 2010 to 2015) was hacked after leaving office, while Quim Torra (2018 - 2020) had his phone infected while still serving as president. The phone of Pere Aragonès, the leader since 2021, was infected while he was serving as vice president under Torra.

Carles Puigdemont (2016 - 2017) was not attacked directly but was a relational target as up to 11 of his close associates, including his spouse and his lawyer, Gonzalo Boye, had their phones hacked.

Other political figures whose phones were infected are the former parliament speaker and current business minister, Roger Torrent, of senior coalition partner Esquerra Republicana, who was targeted while at the helm of the Catalan chamber bureau, and Laura Borràs, the current parliament speaker, whose phone was hacked while she was serving as a member of the Spanish Congress for Junts, the junior partner in the Catalan government.

Was this espionage allowed?

The head of Spain's intelligence agency (CNI), Paz Esteban, admitted having spied on 18 out of the over 60 Catalan pro-independence figures that have been accredited as victims of the Citizen Lab organization research.

After weeks of mounting pressure from the Catalan pro-independence parties and human rights groups on her and on Spain's defense minister, Margarita Robles, in charge of CNI, on May 5, Esteban explained in the congress official secrets committee that the Catalan president, Pere Aragonès, and several close associates of former president Carles Puigdemont in Belgium were among those targetted by the agency after granted approval to do so by Spain's Supreme Court.

Filling the Sink

Take a listen to our Filling the Sink podcast episode published on May 7 on Catalangate to learn more about the espionage case.