Spanish Intelligence Agency Accused of Gross Negligence After Spyware Hacked Phones of Top Officials

Hacking revelations involving the cell phones of politicians have put Spain's typically circumspect intelligence agency in an uncomfortable spotlight.

In one case, Spain's National Intelligence Center is accused of gross negligence for allowing unknown sources to tap the phone in Prime Minister Pedro Sánchez's pocket with the Pegasus spyware. Although Spain has refused to point a finger at Morocco, the dates the phones of Sánchez and Defense Minister Margarita Robles were hacked last year match up with a diplomatic crisis between the two countries.

The intelligence agency, known by its Spanish acronym CNI, also is accused of using the Pegasus program to hack the phones of over 60 Catalan separatists. Amid the back-to-back scandals involving alleged espionage, plans for a public ceremony to observe CNI's 20th anniversary were postponed.

Agency director Paz Esteban López is appearing on Thursday before a select parliamentary committee behind closed doors, where she will be able to break the secrecy code that prohibits members of the government from revealing the workings of her agency.

Esteban, the first woman to serve as CNI's director, will speak to just 11 members of parliament, all of whom will have to swear not to reveal what they are told. Spain's Parliament voted to let members of Catalan and Basque separatist parties sit on the special committee.

The highly anticipated meeting at Spain's Parliament building in Madrid is set to take place inside an austere meeting room at one end of a hallway flanked by portraits of Spain's parliament speakers.

The Catalan separatists, who want to carve out a new state for northeast Spain around Barcelona, are expected to grill Esteban about CNI's alleged use of the spyware. They directly accused the CNI of being behind the hacks that came to light two weeks ago when the digital rights group Citizen Lab based in Canada published a report citing the use of Pegasus to hack into the phones of dozens of pro-independence supporters in Spain's northeastern Catalonia region, including politicians, lawyers and activists.

Spain's government has repeatedly said that the CNI cannot tap phones without prior judicial authorisation. At the same time, the government said that the secrecy law shielding all CNI activities prevents the agency from confirming whether it possesses Pegasus, the spyware sold by Israeli company NSO Group.

“If Paz Esteban presents evidence that three or four years ago there was judicial authorisation to tap the phones of some 60 people because they supported (Catalonia's) independence, then we are going to have a problem,” Gabriel Rufián, a member of parliament for a Catalan separatist party, told Cadena SER radio before attending the committee.

The Spanish government nevertheless has promised that both CNI and the nation's ombudsman will investigate the report published by Citizen Lab. It has also encouraged those affected to take their cases to court.

But Robles, the defense minister, appeared to justify the crackdown on the separatists for their role in organising and participating in mostly peaceful pro-secession street protests. The events sometimes spiraled out of control and led to clashes with police, the blocking of roads and train lines, and the closure of Barcelona's airport in 2019.

Robles herself faced a barrage of questions Wednesday during a parliamentary commission's public meeting. The hearing was supposed to be about European defense but ended up focusing on Pegasus.

“I am particularly proud of the 3,000 men and women of the CNI who risk their lives to protect our peace and security, and always within the law,” Robles said. “(The CNI) director is being targeted by allegations that don't have any basis in reality.”

Esteban also can expect questions from members of mainstream parties who accuse the agency of letting foreign actors infiltrate the most sensitive phones in the country.

The CNI, which oversees Spain's cybersecurity, only discovered that Sánchez's and Robles' phones had been hacked after the devices underwent deep scans following the revelations of the breaches into the phones of the Catalans.

Previous checks found no evidence of the hacks in May and June 2021, the government has been forced to admit.

“The prime minister's phone is regularly checked, but the protocols improve every day,” government spokeswoman Isabel Rodríguez told Onda Cero Radio. “It is clear that mistakes were made, and we are working to improve things so they don't happen again.”

The government's refusal to commit to Esteban remaining in her post for the long term has fanned Spanish media reports suggesting that her days as head of the CNI may be numbered.

“Before determining responsibilities, we have to find out what happened,” Rodríguez said.

Digital break-ins of phones with Pegasus have been reported and denounced in several countries. French President Emmanuel Macron was included on a list of heads of state that Amnesty International suspected were targeted last year.

The European Parliament opened an investigation into Pegasus' use in the European Union U, initially intended to focus on Hungary and Poland. The list of Catalans allegedly hacked also includes European Parliament members.

Amnesty International, which has denounced the use of the Pegasus spyware in several countries, demanded on Thursday more transparency from Spain.

“This committee, characterised for its secrecy and obscurantism, cannot be considered the appropriate venue to investigate the alleged violence of human rights,” said Esteban Beltrán, the director of the rights group in Spain.