CatalanGate

CatalanGate is a 2022 political scandal involving espionage, perpetrated mainly using the NSO Group's Pegasus spyware, against figures of the Catalan independence movement, and the Basque independence movement. Targets of the espionage included elected officials (including the four presidents of the Generalitat of Catalonia since 2010, two presidents of the Parliament of Catalonia, and MEPs), activists, lawyers, and computer scientists; in some cases, families of the main targets were also targeted.[1]

The espionage was uncovered by Citizen Lab in a report published on April 18, 2022. The report identified up to 65 victims, consummated or attempted. The number of targets exceeded previous cases of espionage studied by Citizen Lab, far surpassing those of Al Jazeera (36 victims) and El Salvador (35 victims).[2][3] Citizen Lab did not definitively attribute the responsibility for the attacks to a particular perpetrator, however, it went on to state that circumstantial evidence strongly suggests the perpetrator to be the Spanish Government.[4] The term CatalanGate originates from the title of the Citizen Lab report.[4] Despite the scandal's dissemination as CatalanGate, it also affected two prominent Basque pro-independence figures.[1]

The domain catalangate.cat was registered on 28 January 2022 by Òmnium Cultural.[5][6][7] According to ABC's sources, Puigdemont and his entourage have had in their possession Citizen Lab's report for over a year and they are releasing it in order to try to deflect attention from his ties with Russia and Putin and to influence the upcoming CJEU ruling regarding his immunity, being the whole operation coordinated by Puigdemont's lawyer, Gonzalo Boye.[8][6][9]

Background

The investigation into the spying was conducted and published by Citizen Lab, a Canadian interdisciplinary laboratory, based at the Munk School of Global Affairs at the University of Toronto, which focuses on research, development, strategic policy and high-level legal engagement at the confluence of information and communication technologies, human rights and global security.[10][11]

Previously (in 2019), Citizen Lab worked on a case involving Pegasus infections that exploited a WhatsApp security bug that - between April and May 2019 - enabled infiltration of at least 1,400 terminals. Among the people alerted to the problem was the President of the Parliament, Roger Torrent, who was the first to jump into the media when El País and The Guardian reported on the subject in July 2020.[12][13] The same case involved Ernest Maragall, Anna Gabriel -who exiled in Switzerland-, the activist member of the ANC Jordi Domingo, and Sergi Miquel Rodríquez, member of Carles Puigdemont's team. Basque leaders Arnaldo Otegi and Jon Iñarritu were also cited in the list of people presumably subject to secret scrutiny in the same program.[14][15]

The investigation was initiated by ERC MEP Jordi Solé who - a few weeks before replacing Oriol Junqueras as a Member of the European Parliament in June 2020 - suspected that he was a victim of cell phone spying and contacted security researcher Elies Campo, a former WhatsApp employee and outspoken Catalan independence supporter who colaborates with Citizen Lab.[16][17][6]

CatalanGate scandal

Collaboration between potential victims and Citizen Lab helped identify at least 65 people attacked or infected with the spyware, 63 of them with Pegasus and 4 with Candiru (two victims were targeted using both). The actual figure could be higher as Citizen Lab's tools are developed for use with iOS systems and, in Spain, Android devices predominate (80% of the total in 2021). A selection of the cases was also analyzed by Amnesty International's Tech Lab, and the results independently validated the forensic methodology used. Virtually all incidents correspond to the period between 2017 and 2020 (although Jordi Sanchez suffered an attempted infection via SMS in 2015).[4]

In its findings, Citizen Lab states that "while we do not attribute the operation to a specific government entity at this time, the circumstantial evidence shows a strong link to the Spanish government, especially given the nature of the individuals targeted, the timing of the attacks, and the fact that Spain is listed as a client of NSO Group".[4]

Methods of infiltration

In some cases (and as is often the case), the attack was carried out by an intermediary: infecting, or attempting to infect, the terminal of family members or people close to the target to be spied on.[4]

Pegasus

A peculiarity of this case for Citizen Lab was the discovery of a new iOS zero-click vulnerability, which they called HOMAGE, that had not previously been seen used by NSO Group, and which was effective against some versions prior to 13.2.

Candiru

Citizen Lab identified four victims of espionage involving Candiru. Candiru spyware was used to infiltrate the targets' personal computers. The targets were sent emails containing malicious links and enticed to click on them, with personal computers becoming infected with Candiru spyware once they clicked on the link. A total of seven such emails was identified. Some of the emails appeared to be messages from a Spanish governmental institution with public health recommendations in connection to the 2019 coronavirus epidemic.[18]

List of victims

With the exception of four people who requested anonymity, this is the list of victims of the CatalanGate espionage case:[19]

  • Alba Bosch (activist)
  • Albano-Dante Fachín (journalist and former member of Parliament for Catalunya Sí que es Pot)
  • Albert Batet (president of the parliamentary group Junts)
  • Albert Botran (deputy of the CUP in the Congress)
  • Andreu Van den Eynde (lawyer of Junqueras, Torrent, Romeva and Maragall)
  • Anna Gabriel (former deputy of the CUP in the Parliament)
  • Antoni Comín (Junts MEP)
  • Arià Bayé (member of the ANC)
  • Arnaldo Otegi (secretary general of EH Bildu)
  • Artur Mas (president of the Generalitat 2010-2015)
  • Carles Riera (member of the CUP in the Parliament)
  • David Bonvehí (president of PDeCAT)
  • David Fernández (former deputy of the CUP in the Parliament)
  • David Madí (ex-Secretary of Communication of CDC)
  • Diana Riba (ERC MEP)
  • Dolors Mas (businesswoman)
  • Elías Campo (doctor) (father of Elies Campo Cid)
  • Elena Jimenez (lawyer and member of Òmnium Cultural)
  • Elies Campo Cid (ex-director of Telegram and WhatsApp)
  • Elisenda Paluzie (president of the ANC)
  • Elsa Artadi (deputy of Junts per Catalunya)
  • Ernest Maragall (president of the ERC group in the Barcelona City Council)
  • Ferran Bel (deputy in Congress for PDeCAT)
  • Gonzalo Boye (lawyer of Puigdemont, Torra and Comín)
  • Jaume Alonso-Cuevillas (lawyer and deputy of Junts)
  • Joan Matamala (businessman) (close to Carles Puigdemont)
  • Joan Ramon Casals (former deputy in the Parliament for Junts, former director of the office of President Torra)
  • Joaquim Jubert (deputy of Junts in the Parliament)
  • Joaquim Torra (president of the Generalitat 2018-2020)
  • Jon Iñarritu (deputy of EH Bildu in the Congress)
  • Jordi Baylina (developer)
  • Jordi Bosch (ex-director of Òmnium Cultural)
  • Jordi Domingo (ANC member)
  • Jordi Sánchez (ex-president of the ANC and secretary general of Junts)
  • Jordi Solé (ERC MEP)
  • Josep Costa (former vice-president of the Parliament)
  • Josep Lluís Alay (director of the Office of Carles Puigdemont)
  • Josep Maria Ganyet (businessman and professor at the UPF)
  • Josep Maria Jové (deputy of ERC in the Parliament and former secretary general of the vice-presidency of Economy)
  • Josep Rius (vice-president and spokesman of Junts, member of Parliament)
  • Laura Borràs (president of the Parliament)
  • Marc Solsona (former deputy of PDeCAT in the Parliament)
  • Marcel Mauri (former vice-president of Òmnium Cultural)
  • Marcela Topor (journalist and partner of Carles Puigdemont)
  • Maria Cinta Cid (senior consultant Hospital Clínic, professor and doctor) (mother of Elies Campo Cid)
  • Marta Pascal (secretary general of the Nationalist Party of Catalonia)
  • Marta Rovira (general secretary of ERC)
  • Meritxell Bonet (journalist and partner of Jordi Cuixart)
  • Meritxell Budó (former Minister of the Presidency)
  • Meritxell Serret (deputy of ERC in the Parliament)
  • Miriam Nogueras (deputy of Junts al Congrés)
  • Oriol Sagrera (general secretary of Enterprise and Labor, ERC)
  • Pau Escrich (developer)
  • Pere Aragonès (President of the Generalitat)
  • Pol Cruz (parliamentary assistant in the Eurochamber)
  • Roger Torrent (President of the Parliament 2018-2020, Minister of Enterprise and Labor)
  • Sergi Miquel (PDeCAT deputy in the Congress, Council for the Republic)
  • Sergi Sabrià (Director of the Office of Strategy and Communication of the government, former deputy of ERC in the Parliament)
  • Sonia Urpí (member of the ANC)
  • Xavier Vendrell (former minister and former deputy of ERC in the Parliament)
  • Xavier Vives (developer)

Reactions

Press coverage

On the same day that saw the publication of CitizenLab's technical report, The New Yorker published an extensive report entitled "How democracies spy on their citizens" (of which the Catalan case occupied a seventh part) as their cover story.[20]

Catalan government response

On April 19 (one day after the initial publication of the revelations), Carles Puigdemont and Oriol Junqueras appeared in the European Parliament to denounce the spying perpetrated upon the pro-independence leaders, an intervention that was joined by the Popular Unity Candidacy, the Catalan National Assembly, and Òmnium Cultural. John-Scott Railton, from Citizen Lab, also took part, detailing "circumstantial evidence": that agencies linked to the structure of the Spanish State would have used Pegasus and Candiru to infiltrate the cell phones of the victims for political purposes.[21] The previous March, the European Parliament had approved the creation of a committee of inquiry called Committee to investigate the use of Pegasus surveillance spyware on the alleged use of Pegasus surveillance spyware against journalists, politicians, security agents, diplomats, lawyers, businessmen, civil society actors and other citizens in, among other countries, Hungary and Poland, and whether such use had infringed European Union law and fundamental rights. The first meeting of the committee was held the same day that Puigdemont and Junqueras denounced the spying.[22][23]

References
  1. "Hauek dira Pegasus eta Candiru programekin ustez espiatu dituzten independentistak". EITB (in Basque). 2022-04-19. Retrieved 2022-04-23.
  2. "Al Jazeera journalists 'hacked via NSO Group spyware'". BBC News. 2020-12-21. Retrieved 2022-04-21.
  3. Pérez, José de Córdoba and Santiago (2022-01-13). "Pegasus Spyware Deployed Against El Salvador Journalists and Activists". Wall Street Journal. ISSN 0099-9660. Retrieved 2022-04-21.
  4. "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru". The Citizen Lab. 2022-04-18. Retrieved 2022-04-21.
  5. "Òmnium preparó hace meses una campaña contra el 'Catalan Gate'". El Español (in Spanish). 21 April 2022. Retrieved 26 April 2022.
  6. "El independentismo oculta que el autor del informe sobre Pegasus tiene vínculos con la Generalitat". The Objective (in Spanish). 24 April 2022. Retrieved 26 April 2022.
  7. "El separatismo preparó con meses de antelación la campaña propagandística sobre el supuesto espionaje masivo". El Mundo (in Spanish). 21 April 2022. Retrieved 26 April 2022.
  8. "Puigdemont destapa el informe Pegasus que tenía desde hace un año". ABC (in Spanish). 24 April 2022. Retrieved 26 April 2022. El objetivo sería doble. Por un lado, desviar la atención mediática sobre la relación del entorno de Puigdemont con el Gobierno ruso –embarcado en una guerra contra Ucrania– y, por otro, tratar de influir en la decisión del Tribunal de Justicia de la Unión Europea, que en verano tiene que determinar sobre la inmunidad parlamentaria de Puigdemont después de que la Eurocámara se la retirase para facilitar su enjuiciamiento en España.
  9. "El 'CatalanGate': la última campaña de propaganda y chantaje". El Mundo (in Spanish). 25 April 2022. Retrieved 26 April 2022.
  10. "About the Citizen Lab". The Citizen Lab. Retrieved 2022-04-21.
  11. "Espanya va espiar l'independentisme amb Pegasus, segons 'The New Yorker'". ElNacional.cat (in Catalan). 2022-04-18. Retrieved 2022-04-21.
  12. Gil, Joaquín (2020-07-14). "El mòbil del president del Parlament va ser objectiu d'un programa espia que només poden comprar Governs". EL PAÍS (in Catalan). Retrieved 2022-04-21.
  13. "Phone of top Catalan politician 'targeted by government-grade spyware'". the Guardian. 2020-07-13. Retrieved 2022-04-21.
  14. "Otegi: "Aquí algunos salieron de rositas de 40 años de dictadura y ese Estado profundo sigue funcionando al margen"". www.publico.es. Retrieved 2022-04-23.
  15. Lete, Irati Urdalleta. "Pegasus: zelatari isila norbere poltsikoan". Berria (in Basque). Retrieved 2022-04-23.
  16. "Pegasus ha espiat quatre presidents de la Generalitat i més de seixanta polítics i activistes independentistes". VilaWeb (in Catalan). Retrieved 2022-04-21.
  17. "El factótum catalán, rico y proindepe tras la denuncia del espionaje con Pegasus". El Mundo (in Spanish). 25 April 2022. Retrieved 26 April 2022.
  18. "CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru". The Citizen Lab. 2022-04-18. Retrieved 2022-04-26.
  19. "La llista de totes les persones espiades en el CatalanGate". dBalears (in Catalan). 2022-04-18. Retrieved 2022-04-21.
  20. "How Democracies Spy on Their Citizens". The New Yorker. 2022-04-14. Retrieved 2022-04-21.
  21. NacióDigital. "Els investigadors de l'espionatge a l'independentisme estableixen un "nexe sòlid" amb l'Estat | NacióDigital". www.naciodigital.cat (in Catalan). Retrieved 2022-04-21.
  22. "European Parliament Multimedia Platform". multimedia.europarl.europa.eu. Retrieved 2022-04-21.
  23. NacióDigital. "Es constitueix la comissió del Parlament Europeu que investiga Pegasus en ple "Catalangate" | NacióDigital". www.naciodigital.cat (in Catalan). Retrieved 2022-04-21.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.