Spyware use on separatists in Spain "extensive," group says

MADRID (AP) — The phones of dozens of pro-independence supporters in Spain's northeastern Catalonia, including the regional chief and other elected officials, were hacked with controversial spyware available only to governments, a cybersecurity rights group said Monday.

Citizen Lab, a research group affiliated with the University of Toronto, said a large-scale investigation it had conducted in collaboration with Catalan civil society groups found that at least 65 individuals were targeted or their devices infected with what it calls “mercenary spyware” sold by two Israeli companies, NSO Group and Candiru.

Almost all of the incidents occurred between 2017 and 2020, when efforts to carve out an independent state in northeastern Spain led to the country's deepest political crisis in decades. The former Catalan Cabinet that pushed ahead with an illegal referendum on independence was sacked. Most of its members were imprisoned or fled the country, including ex regional president Carles Puigdemont.

NSO’s Pegasus spyware has been used around the world to break into the phones and computers of human rights activists, journalists and even Catholic clergy. The firm has been subject to export limits by the U.S. federal government, which has accused NSO of conducting “transnational repression." NSO has also been brought to court by major technology companies, including Apple and Meta, the owner of WhatsApp.

Citizen Lab said its investigations into the use in Spain of Pegasus and spyware developed by Candiru — another Israeli firm founded by former NSO employees — started in late 2019 after a handful of cases targeting high-profile Catalan pro-independence individuals were revealed. Amnesty International said its technical experts had independently verified the attacks.

The Toronto-based non-profit said it could not find...