Catalonia reignites its court fight with Spain over spyware

Catalan spyware victims including the region's former President Artur Mas this week announced new court challenges against Spanish security services and Israeli surveillance software vendors over political espionage.

The victims are seeking retribution for the 2022 scandal called CatalanGate, when researchers found up to 65 civil society figures, politicians, activists, lawyers and journalists involved in the region's independence movement were spied on by hacking their phones using Israeli-made snooping tools Pegasus and Candiru.

The Spanish spyware scandal is the highest-profile case of political hacking with spyware in Europe in recent years. The government in 2022 said Prime Minister Pedro Sánchez as well as Defense Minister Margarita Robles were also hacked with Pegasus software. The Spanish revelations deepened an EU-wide crisis over the sprawling use of spyware in politics and business.

Catalan victims are now renewing their fight to seek justice through the courts. One of them, former regional President Mas, told the Spanish parliament on Monday that he will file a criminal lawsuit "against all those who caused such great harm to our democratic system." Mas was spied on with Pegasus from July 2015 to May 2020.

Another new case comes from Sentinel Alliance, a non-profit representing five Catalan software engineers who were targeted with spyware. The group filed a new legal case in Barcelona against the country's National Intelligence Center (CNI) and its Civil Guard law enforcement agency as well as spyware makers Pegasus and Candiru.

The Sentinel Alliance case is the first complaint against the makers of Candiru, a Tel Aviv-based spyware firm that, together with Pegasus maker NSO Group, was blacklisted by the previous U.S. administration.

The five plaintiffs include Joan Matamala i Alzina — the first known victim of Candiru worldwide — as well as Joan Arús, Jordi Baylina Melé, Pau Escrich Garcia and Xavier Vives Riba, all software engineers and tech researchers active in Catalonia's independence movement.

Arús, who is the president of the NGO behind the complaint, told POLITICO that he plans to take the challenge up to European courts after exhausting legal avenues in Spain, explaining how the group had little hope of achieving justice through Spanish courts only.

The new court cases add to nine existing challenges that seek retribution over spyware intrusions currently underway in various courts in Barcelona.

Arús called the plethora of legal challenges an "obstruction strategy" of Spanish prosecutors and courts: “Instead of unifying all the cases in one single, well-resourced legal proceeding, they are splitting them across multiple courts. This makes coordination across plaintiffs very hard and increases the difficulty to seek restitution for victims or even to find out the true extent and length of the surveillance,” he said in written comments.

The Spanish government previously denied any wrongdoing. In 2024, it agreed to release classified documents on the tapping of the mobile phone of the leader of the separatist Republican Left of Catalonia party, Pere Aragonès, by agents of CNI.

The Spanish Civil Guard, National Intelligence Center and NSO Group did not immediately respond to requests for comment. Candiru could not be reached for comment.