Spanish Prime Minister Pedro Sanchez and Defense Minister Margarita Robles had their mobile phones targeted with Israeli-made Pegasus spyware, Minister of the Presidency Felix Bolanos said on Monday. It is unknown who deployed the malware, but Catalan independence leaders have also accused the Spanish government of using it against them.
Bolanos told a press conference that Sanchez’ phone had been infected in May 2021, and that at least one data leak had occurred, Reuters reported.
“The interventions were illicit and external. External means carried out by non-official bodies and without state authorization,” he said, without disclosing whether foreign or Spanish groups are thought to have been behind the operation.
Pegasus is a sophisticated hacking tool developed by an Israeli firm, NSO Group, and sold to state-level clients around the world. Its widespread activity was revealed last summer by Amnesty International and more than a dozen media organizations, and those targeted by the spyware include top political leaders like British Prime Minister Boris Johnson, who a recent report claims was targeted for surveillance by hackers based in the United Arab Emirates.
Around 50,000 phones worldwide have been illegally accessed using the malware, with targets including journalists, activists, businesspeople and political figures. The Israeli software grants the hacker the ability to read messages, look through photos, track the person’s location, and even switch on the camera without the knowledge of the phone’s owner.
In Spain, more than 60 phones linked to Catalan independence activists were reportedly breached between 2015 and 2020, with those targeted including members of the European Parliament, Catalan presidents, legislators, jurists, and members of civil society organizations, according to a report last month by cyber research firm Citizen Lab.
“Every Catalan Member of the European Parliament (MEP) that supported independence was targeted either directly with Pegasus, or via suspected relational targeting,” Citizen Lab said. “Three MEPs were directly infected, two more had staff, family members, or close associates targeted with Pegasus.”
While the culprits remain unknown, Catalan politicians have blamed the Spanish government. Previous reports in local media accused Spain’s National Intelligence Center of using Pegasus to snoop on the separatists since 2015, under the governments of Sanchez and his predecessor, Mariano Rajoy.
Sanchez’ government has not taken responsibility for spying on the Catalonians, and said that it would investigate the allegations. NSO Group denied the claims unequivocally, telling the New Yorker “These allegations are, yet again, false,” having previously rebutted similar accusations. Despite a litany of other spying claims in the past, the company has insisted its products are used exclusively for legal law enforcement purposes only.