Could Spain’s Latest Spying Scandal, “Catalangate”, Topple the Pedro Sánchez Government?

The plot keeps thickening. First, Spain’s Government was accused of spying on figures in Catalonia’s independence movement. Now, Madrid claims it too has been a victim of spying by “external” forces.    

Spain’s fragile coalition government is beginning to show signs of strain following a succession of disagreements on major issues, from labor reform to providing arms to Ukraine, to Prime Minister Pedro Sánchez’ recent shock decision to recognize Moroccan sovereignty over Western Sahara. From one day to the next he put an end to 47 years of political and social consensus on the former colony’s status without even consulting certain members of his cabinet.

But one issue could end up raveling the frail threads holding the government together government: the extensive spying by Spain’s intelligence services on members of Catalonia and the Basque Country’s pro-independence movements, much of which appears to have taken place during Sánchez’s tenure. Among the victims of the spying scandal, which has been dubbed “Catalangate”, are members of Esquerra Republicana de Catalunya (the Republican Left of Catalonia), which is helping to prop up Sánchez’s coalition government.

They include the current president of Catalonia’s regional government, Pere Aragonès, whose phone was infected with the Pegasus virus in late 2019, when his party was negotiating Pedro Sánchez’s investiture. From that moment all of the messages, work and personal documents on his mobile as well as photos of his family were spied on, according to a joint investigation by The New Yorker and Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs at the University of Toronto, Canada.

In an interview this past weekend with the Spanish newspaper El Diario, Aragonès said it will be very difficult for the ERC to continue supporting the government in Congress if Pedro Sánchez’s executive does not respond robustly to the espionage of independence leaders, ideally with an internal government investigation with independent oversight. “Parliamentary stability will be very difficult to maintain if responsibilities are not assumed,” he said. In addition, he plans to file a lawsuit against the government in the coming weeks.

Pegasus Strikes Again

The Pegasus spyware was created and marketed by the Israeli cyber-arms company NSO Group, a company so secretive it didn’t even have a website for its first few years of existence. Now that it does, it is worth a visit. On its “About Us” page, the company waxes lyrical on how its Pegasus software is used by its government clients to help carry out all sorts of heroic deeds such as prevent terrorism; break up pedophilia, sex- and drug-trafficking rings, and money-laundering operations; rescue kidnapped children; and locate survivors trapped under collapsed buildings in the wake of natural disasters or construction failures.

As many as 45 national governments, including Mexico, Saudi Arabia, Morocco and a host of other African countries, have hired NSO’s services, and often not for good ends. In its Pegasus Project, “a ground-breaking collaboration by more than 80 journalists from 17 media organizations in 10 countries,” Amnesty International found that NSO’s spyware was being used as “a weapon of choice” by repressive governments “seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril.”

Similar findings were reported by Citizen Lab’s joint investigation with New Yorker, according to which some of the worst abuses have occurred at the hands of authoritarian regimes:

Most prominently, Pegasus was employed against family members of Saudi Arabian journalist Jamal Khashoggi before and after he was murdered in Turkey. It has been used against journalists around the world, as well as human rights defenders, dissidents, and truth tellers.

Still other abuses have happened at the hands of purported democracies like India, Poland, Hungary, and El Salvador…

Unsurprisingly, Israel, too, has used the made-in-Israel spyware against domestic citizens, including opponents of former right-wing Prime Minister Benjamin Netanyahu. So too have countries in Europe including Germany, Hungary, Poland and, as it now seems, Spain. In the latter case, most of the targets had no criminal record, including for their political activism, as Citizen Lab documents:

People’s views on Catalan independence differ, but many of the hacking victims have never been charged or convicted of criminal activity for their political activism. They are advocates, politicians, nonprofit leaders, lawyers, journalists, and even open-source software developers working on democratic participation. They include Catalan Presidents, legislators, and Members of the European Parliament. In some cases, family members were also infected.

The targeting occurred during political negotiations and debate over Catalan independence. Most would agree that spying on counterparts during a political negotiation process is an act of bad faith.

Long List of Targets

So far, a total of 65 members of Catalonia’s independence movement were been identified as targets of both Pegasus as well as Candiru, another spyware program that is designed to self-destruct and hide its traces. They include every Catalan Member of the European Parliament (MEP) that supported independence as well as some of their parliamentary staff, family members or close associates. Members of Catalan civil society associations such as Omnium Cultural and Assemblea Nacional Catalana, two organizations that support Catalan independence, were also targeted.

So too were lawyers representing prominent Catalans, in complete violation of lawyer-client privilege, as were several well-known open-source developers working on software projects related to democratic participation and decentralization. The list goes on and on:

Every Catalan president since 2010 has reportedly been targeted with Pegasus, either while serving their term, before they were elected, or after retiring. In addition, the leadership and members of Catalan legislative bodies were extensively targeted, including multiple presidents of the Catalan parliament either while in office, or prior to taking office. A wide range of legislators from Catalan political parties were also targeted.

It’s worth recalling that Catalonia’s last three elected presidents — Artur Mas, Carles Puigdemont and Quim Torra — have all been banned from holding public office, either during their tenure or just after their time as presidents. Puigdemont, who organized the self-determination referendum of 2017, is in self-imposed exile, together with a number of his ministerial colleagues.

Citizen Lab has so far detected 65 infected phones, belonging to Catalan and Basque pro-independence leaders, but believes that at least another 150 more people may have been targeted.

The initial response of the Sánchez government, which depends on the support in Congress of ERC as well as the Basque National Party and EH Bildu, a left-wing, Basque nationalist, pro-independence political coalition, was to deny the allegations before finally agreeing to investigate them. Both the executive and the National Intelligence Center (CNI) have also downplayed the findings of the joint report by Citizen Lab and the New Yorker while also questioning the rigor of its underlying analysis. Spain’s Minister of Defense, Margarita Robles, even claimed she had never heard of the New Yorker, which is not beyond the realms of possibility.

Although the CNI now acknowledges that it spied on pro-independence figures using Pegasus spyware, which it bought six or seven years ago, it claims that it did so only on an individual rather than collective basis, as claimed by Catalan government figures, and always with judicial authorization. That was according to a report by El País a week ago. Yet on the same day another Spanish newspaper, El Español, published a report that totally contradicted those claims:

The National Intelligence Center (CNI) has never requested authorization to carry out “mass interceptions” of communications such as those that would have been carried out through the Pegasus program. This is stated by different magistrates of the Supreme Court who have had been in charge of prior control of requests from the secret service to intercept communications.

The Plot Thickens

The PSOE’s coalition partners, including the left-wing party Podemos, have warned that an internal investigation by the CNI, the same institution that ordered the spying in the first place, will not suffice.

“The CNI should not investigate itself. The solution should go through Congress where we can ask all the questions,” said Jaume Asens, the congressional president of Podemos, adding Spain’s international prestige is “at stake”, as is that of the CNI. Both ERC and Podemos are also calling for the head of Spanish Minister of Defense Margarita Robles after she melted down under grilling by pro-independence groups in Congress:

I ask you: what does a state have to do? What does a government have to do when someone violates the Constitution? When someone declares independence. When someone cuts off public roads. Makes public disorders. When someone is having relations with leaders politicians from a country that is invading Ukraine…

“It is all very good for you to try to make out as victims now, but I have never seen you defend the basic principles of the rule of law or the rights and freedoms of all.

The tirade was celebrated by many on the right in Spain, who are vehemently opposed to Catalan independence, but has further poisoned relations between Sanchez’s PSOE and its Catalan coalition partners.

Just when it looked as though Sánchez had no option but to bow to their demands and deliver Robles’ head on a platter, the plot thickened. In an emergency press conference on Monday, a public holiday in Madrid, the minister of the presidency, Félix Bolaños, announced that both Sánchez and Robles’ phones has also been targeted by Pegasus spyware. In May and June 2021 the phones has been intercepted by an “external force,” said Bolaños:

“When we say external intrusions, we mean that they are alien to state agencies and do not have judicial authorization from any official agency. That is why we classify them as illegal and external.”

The revelation has added a whole new twist to the plot. All of a sudden, much of the focus has shifted to the potential perpetrators of the spying. One possible candidate is Morocco’s state security services, which are already alleged to have used Pegasus to spy not only on senior government figures in France including President Macron but also Spain’s former Foreign Minister Aranhca González Laya. That was during a major diplomatic row between Spain and  Morocco, in June 2021, over Madrid’s decision to let the president of the Sahrawi Arab Democratic Republic, Brahim Ghali, be treated for COVID-19 in a Spanish hospital.

Interestingly, Sánchez’s phone was intercepted twice during May 2021 when his government was in the process of deciding whether or not to pardon the leaders of Catalonia’s independence movement, many of whom were in jail at the time. It was a move that was fiercely opposed by many senior members of Spain’s so-called “deep state.”

Victims and Instigators

Both Sánchez and Robles can now paint themselves as victims rather than possible instigators of a spy operation. In stark contrast to their response to the allegations of internal spying on Catalan political figures, the Government has demanded an immediate investigation. But the latest revelations raise huge questions about the performance, or even loyalties, of Spain’s National Intelligence Center (CNI), for which Robles herself, as Minister of Defense, is ultimately responsible.

They certainly do not seem to have placated the demands of Sánchez’s coalition partners from Catalonia. In the words of Oriol Junqueras, the ERC veteran who served as former vice president of Catalonia and spent almost four years in jail for his role in organizing the independence referendum in 2017, the Sánchez government is fast losing its credibility, having gone “in the space of just a few days from denying espionage to admitting and justifying it, just as Minister Robles did in parliament. Now it turns out that themselves they have also been spied on.”

At every twist and turn, the Government does everything it can to avoid assuming responsibility, Junqueras says:

“[It] gives more credibility to an investigation carried out by and for themselves than an investigation carried out by a prestigious international entity and published by a prestigious international media — although the Minister [of Defense] may not know it. They generate very little confidence.”

How this all ultimately plays out, it is hard to tell. On the one hand, it is hard to see how Sánchez will be able to resolve the differences with ERC without sacrificing his defense minister, which he clearly doesn’t want to do. At the same time, members of the coalition government — including even ERC, which has expanded significant sums of political capital backing up the government — have every interest and motivation in trying to keep the sinking ship afloat, especially with support for the right gradually rising in the polls.

With relations between Catalonia and Spain still at an impasse, there is a huge amount at stake in what happens next, not just for the political parties involved but for people living in Catalonia as well as the rest of Spain. If this government were to fall and be replaced by a right-wing coalition consisting of the strongly unionist People’s Party and Cuitadans as well as the far-right, anti-immigrant, fiercely nationalist party Vox, the fragile peace fire that has reigned between Madrid and Catalonia over the past couple of years will be very quickly shattered.