CHAPTER 16: “FINALLY A EUROPEAN STATE”

  1. John Scott-Railton, Elies Campo, Bill Marczak, Bahr Abdul Razzak, Siena Anstis, Gözde Böcü, Salvatore Solimano, and Ron Deibert, CatalanGate: Extensive Merce- nary Spyware Operation against Catalans Using Pegasus and Candiru, Research Report No. 155, Citizen Lab, University of Toronto, April 18, 2022, https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalansusing-pegasus-candiru/.

  2. Paul Kirby, “Spain Dismisses Spy Chief in Pegasus Phone Spyware Scandal,” BBC, May 10, 2022, https://www.bbc.com/news/world-europe-61391849 (archive: perma.cc/J6DK-K6AH).

  3. Andrés Villena-Oliver, Bernabé Aldeguer, and Delio Lucena-Piquero, “Invisible Rulers: The ‘Latent Power Structure’ in Two Spanish Governments (2004 and 2012),” Government and Opposition 59, no. 1 (2024): 130–145.

  4. Ximena Villagrán, “El CNI pagó más de 200.000 euros a Hacking Team para espiar móviles,” El Confidencial, July 7, 2015, https://www.elconfidencial.com/tecnologia/2015-07-06/cni-hackers-team-espionaje-contratos_916216/ (archive: perma.cc/C44W-K8BR).

  5. Stephanie Kirchgaessner and Sam Jones, “Phone of Top Catalan Politician ‘Targeted by Government-Grade Spyware,’” Guardian, July 13, 2020, https://www.theguardian.com/world/2020/jul/13/phone-of-top-catalan-politician-targeted-bygovernment-grade-spyware (archive: perma.cc/C2CC-SFUJ).

  6. “Torrent y Maragall fueron espiados por un programa exclusivo de los gobiernos,” ElPeriódico, July 14, 2020, https://www.elperiodico.com/es/politica/20200714/parlamentroger-torrent-espia-movil-catalunya-8038888 (archive: perma.cc/6H7R-2QZ3); Stephanie Kirchgaessner, Sam Jones, and Jennifer Rankin, “Second Catalan Politician Says Phone Was Targeted by Spyware,” Guardian, July 14, 2020, https://www.theguardian.com/world/2020/jul/14second-catalan-politician-says-phone-was-targeted-by-spware; Kirchgaessner and Jones, “Phone of Top Catalan Politician ‘Targeted,’”; Sam Jones and Stephanie Kirch- gaessner, “Who Has Been Using Spyware on Catalan Independence Campaigners?,” Guardian, July 17, 2020, https://www.theguardian.com/world/2020/jul/17/whohas-been-using-spyware-on-catalan-independence-campaigners; “Report Alleges Targeting of Swiss-Based Catalan Separatist’s Phone,” SWI swissinfo.ch (archive: perma.cc/RS6J-ZYJN), July 14, 2020, https://www.swissinfo.ch (archive: perma.cc/RS6J-ZYJN)/eng/politics/report-alleges-targeting-of-swiss-basedcatalan-separatist-s-phone/45902640; Raquel Castillo and John Miller, “Spanish Supreme Court Orders Arrest of Former Catalan MP Anna Gabriel,” Reuters, February 21, 2018, https://www.reuters.com/article/idUSKCN1G515G/.

  7. Vicente Rodriguez, “Catalonia,” Encyclopedia Britannica, updated July 28, 2024, https://www.britannica.com/place/Catalonia (archive: perma.cc/U9ZZ-FPF2).

  8. James Sturcke, “Catalan Conundrum,” Guardian, June 7, 2006, https://www.theguardian.com/world/2006/jun/07/spain.jamessturcke (archive: perma.cc/9VJQ-NNL3).

  9. Spanish Constitution, Boletín Oficial del Estado, https://www.boe.es/buscar/pdf1978/BOE-A-1978-40001-consolidado.pdf.

  10. Sam Jones and Stephen Burgen, “Catalan Referendum: Preliminary Results Show 90% in Favour of Independence,” Guardian, October 1, 2017, https://www.theguardian.com/world/2017/oct/01/dozens-injured-as-riot-police-storm-catalanref-polling-stations (archive: perma.cc/S84Z-5K3D).

  11. “Catalan referendum: ‘Hundreds hurt’ as police try to stop voters,” BBC News, October 1, 2017, https://www.bbc.com/news/world-europe-41461032 (archive: perma.cc/8ZW5-YQ5J).

  12. Isa Soares, Vasco Cotovio, and Hilary Clarke, “Catalonia Referendum Result Plunges Spain into Political Crisis,” CNN, October 2, 2017, https://www.cnn.com/2017/10/01/europe/catalonia-spain-independence-referendum-result/index.html.

  13. “Spain: Police Used Excessive Force in Catalonia,” Human Rights Watch, October 12, 2017, https://www.hrw.org/news/2017/10/12/spain-police-used-excessive-force-catalonia (archive: perma.cc/Z7T3-HBPA); “Spain: Excessive Use of Force by National Police and Civil Guard in Catalonia,” Amnesty International, October 3, 2017, https://www.amnesty.org/en/latest/news/2017/10/spain-excessive-use-of-force-by-national-police-and-civilguard-in-catalonia-2/.

  14. “UN Human Rights Chief Urges Probe into Violence during Referendum in Cata- lonia,” UN News, October 2, 2017, https://news.un.org/en/story/2017/10/567542 (archive: perma.cc/WRR5-N4ZX).

  15. “Catalonia Independence: Rajoy Dissolves Catalan Parliament,” BBC, October 27, 2017, https://www.bbc.com/news/world-europe-41783289 (archive: perma.cc/V97G-ADFX).

  16. Sam Jones, “Catalan Leaders Facing Rebellion Charges Flee to Belgium,” Guardian, October 31, 2017, https://www.theguardian.com/world/2017/oct/30/spanish-prosecutor-calls-for-rebellion-charges-against-catalan-leaders; Stephen Burgen, “Catalan Politicians Charged a Year after Independence Vote,” Guardian, November 2, 2018, https://www.theguardian.com/world/2018/nov/02/catalan-politicians-charged-a-yearafter-independence-vote-referendum.

  17. Stephen Burgen and Sam Jones, “New Generation, New Tactics: The Changing Face of Catalan Protests,” Guardian, October 18, 2019, https://www.theguardiancom/world/2019/oct/18/new-generation-new-tactics-the-changing-face-ofcatalan-protests.

  18. Sam Jones, “Spanish Government Pardons Nine Jailed Catalan Leaders,”uardian, June 22, 2021, https://www.theguardian.com/world/2021/jun/22/spanish-government-pardons-nine-jailed-catalan-leaders (archive: perma.cc/E32X-TSMU).

  19. Jones, “Spanish Government Pardons Nine.”

  20. Nicholas Casey and Raphael Minder, “In Bid to End Secession Dispute, Spain Tries Talking with Catalonia,” New York Times, September 15, 2021, https://www.nytimes.com/2021/09/15/world/europe/catalonia-spain-sanchez-aragones.html.

  21. “Aragonès Calls to ‘Strengthen’ Catalonia in Face of Spanish ‘Authoritarianism,’” Catalan News, February 14, 2022, https://www.catalannews.com/politics/item/aragones-calls-to-strengthen-catalonia-in-face-of-spanish-authoritarianism (archive: perma.cc/YM3G-NCHL).

  22. Miguel González, “Los servicios secretos españoles tienen el programa que espió a Torrent,” El País, July 15, 2020, https://elpais.com/espana/2020-07-15/los-servicios-de-informacion-tienen-programas-como-el-que-espio-a-torrent.html (archive: perma.cc/M7K6-Q92Q).

  23. Lorenzo Franceschi-Bicchierai and Joseph Cox, “Source: Spain Is Customer of NSO Group,” Vice, July 14, 2020, https://www.vice.com/en/article/pkyzxz/spain-nso-group-pegasus-catalonia (archive: perma.cc/4RLJ-4BS2).

  24. Nicolas Tomás, “El CNI admite haber espiado a Aragonès y el entorno de Puig- demont con autorización,” El Nacional, May 5, 2022, https://www.elnacional.cat/es/politica/cni-espiado-independentismo-aval-judicial_752346_102.html (archive: perma.cc/44BA-MCEM).

  25. Jones, “Spanish Government Pardons.”

  26. Alexandra Borgeaud, “Market Share Held by Smartphone Operating Systems in Spain from 2017 to 2023, by Month,” Statista, August 1, 2023, https://www.statista.com/statistics/260419/market-share-held-by-smartphone-operating-systems-inspain/.

  27. “Would You Click?,” Citizen Lab, updated December 23, 2022, https://catalonia.citizenlab.ca/ (archive: perma.cc/N92K-2ZQ2).

  28. Ronan Farrow, “How Democracies Spy on Their Citizens,” New Yorker, April 18, 2022, https://www.newyorker.com/magazine/2022/04/25/how-democracies-spy-on-their-citizens (archive: perma.cc/HL54-QF7S).

  29. “Democracies Shouldn’t Surrender to a Future of Limitless Surveillance,” editorial, Washington Post, April 21, 2022, https://www.washingtonpost.com/opinions/202204/21/democracies-should-write-rules-spyware-not-abuse-it/.

  30. Sam Jones, “Catalan President Calls for Investigation as Spyware Targets Pro- Independence Leaders,” Guardian, April 19, 2022, https://www.theguardian.comworld/2022/apr/19/catalan-president-calls-for-investigation-as-spyware-targetspro-independence-leaders.

  31. Jones, “Catalan President Calls for Investigation.”

  32. Nicolas Tomás, “ERC Calls for Support from Junts: ‘Head-on Opposition Would Not Be Understood,’” El Nacional, October 10, 2022, https://www.elnacional.caten/politics/erc-calls-support-junts-opposition-not-understood-catalonia_897888102.html.

  33. Fernando Heller, “‘Catalan Gate’ Puts Spanish Government Stability at Risk Ahead of Crucial Vote,” Euractiv, April 27, 2022, https://www.euractiv.com/section/politics/short_news/catalan-gate-puts-spanish-government-stability-at-risk-ahead-of-crucial-vote/ (archive: perma.cc/G8SQ-YUD6).

  34. “Spanish Prime Minister’s Mobile Phone Infected by Pegasus Spyware, Govern- ment Says,” Reuters, May 2, 2022, https://www.reuters.com/world/europe/spanishprime-ministers-telephone-infected-by-pegasus-spyware-2022-05-02/.

  35. Nicolas Tomás, “Spanish Minister Robles, Defiant on CatalanGate Espionage: ‘Go to the Courts,’” El Nacional, April 26, 2022, https://www.elnacional.cat/en/politicsspanish-minister-robles-defiant-catalangate_747783_102.html (archive: perma.cc/Z5AP-WCFZ).

  36. “Spanish Defense Minister, on Espionage: ‘What Should a State Do When Someone Declares Independence?,’” Catalan News, April 27, 2022, https://www.catalannews.com/politics/item/spanish-defense-minister-on-espionage-what-should-a-statedo-when-someone-declares-independence.

  37. Sam Jones, “Spanish Prime Minister’s Phone ‘Targeted with Pegasus Spyware,’”uardian, May 2, 2022, https://www.theguardian.com/world/2022/may/02/spain-prime-minister-pedro-sanchez-phone-pegasus-spyware (archive: perma.cc/G5QB-5GVW).

  38. “Spyware in Spain Targeted the Prime Minister and His Enemies,” Economist, May 7, 2022, https://www.economist.com/europe/spyware-in-spain-targeted-the-primeminister-and-his-enemies/21809099; Mayte Piulachs, “Catalangate Could End Up in Hands of a Judge at Spain’s National Audience,” El Nacional, May 2, 2022, https://www.elnacional.cat/en/politics/catalangate-hands-judge-spain-nationalaudience_750840_102.html (archive: perma.cc/6TFW-GZBS); J.M. Zuloaga, “Marlaska, el miembro del Gobierno al que han robado más datos de su teléfono,” La Razón, May 11, 2022, https://www.arazon.es/espana/20220510/gwxedc4drzhali5bqi4vbhk7kq.html; Sophie in ’t Veld, Report of the Investigation of Alleged Contraventions and Maladministration in the Applica- tion of Union Law in Relation to the Use of Pegasus and Equivalent Surveillance Spyware, Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveil- lance Spyware, European Parliament, May 22, 2023, https://www.europarl.europaeu/doceo/document/A-9-2023-0189_EN.pdf.

  39. “Luis Planas Puchades, nuevo embajador en Marruecos,” El Mundo, April 30, 2004, https://www.elmundo.es/elmundo/2004/04/30/espana/1083337276.html (archive: perma.cc/AK68-MJTM).

  40. Sam Jones, “Catalans Demand Answers after Spanish Spy Chief Confirms Phone Hacking,” Guardian, May 5, 2022, https://www.theguardian.com/world/2022/may/05/catalans-demand-answers-after-spanish-spy-chief-confirms-phone-hacking (archive: perma.cc/5L6G-UFFV).

  41. Jones, “Catalans Demand Answers”; Nicolas Tomás, “Spain’s CNI Admits Spying on Aragonès and on Puigdemont’s Circle, with Court Approval,” El Nacional, May 5, 2022, https://www.elnacional.cat/en/politics/spain-cni-admits-spying-catalan-inde pendence-judge_752448_102.html.

  42. Tomás, “Spain’s CNI Admits Spying.”

  43. Adam Hulcoop, John Scott-Railton, Peter Tanchak, Matt Brooks, and Ron Deibert, Tainted Leaks: Disinformation and Phishing with a Russian Nexus, Research Report No. 92, Citizen Lab, University of Toronto, May 25, 2017, https://citizenlab.ca/2017/05/tainted-leaks-disinformation-phish/ (archive: perma.cc/4EKM-Y8NB).

  44. “Pegasus Infection of Galina Timchenko, Exiled Russian Journalist and Publisher,”Citizen Lab, September 13, 2023, https://citizenlab.ca/2023/09/pegasus-infection-of-galina-timchenko-exiled-russian-journalist-and-publisher/ (archive: perma.cc/TH6E-UABW); John Scott-Railton, Bill Marczak, Bahr Abdul Razzak, Ksenia Ermoshina, Siena Anstis, and Ron Deibert, By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe, Research Report No. 176, Citizen Lab, University of Toronto, May 30, 2024, https://citizenlab.ca/2024/05/pegasus-russian-belarusian-speaking-opposition-media-europe/ (archive: perma.cc/A5PS-TLA5).

  45. “Russia Labels Two Canadian Schools, Democracy NGO as ‘Undesirable Organi- zations,’” Radio Free Europe/Radio Liberty, March 18, 2024, https://www.rferl.orga/russia-labels-canadian-schools-ngo-undesirable/32867431.html.

  46. Jeffrey Knockel, Cross-Country Exposure: Analysis of the MY2022 Olympics App, Research Report No. 149, Citizen Lab, University of Toronto, January 18, 2022, https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/ (archive: perma.cc/E8HA-2D2U).

  47. Mona Wang, Pellaeon Lin, and Jeffrey Knockel, Should We Chat? Privacy in the WeChat Ecosystem, Research Report No. 167, Citizen Lab, University of Toronto, June 28, 2023, https://citizenlab.ca/2023/06/privacy-in-the-wechat-ecosystem-full-report/ (archive: perma.cc/BG3J-974Q).

  48. Bill Marczak and John Scott-Railton, Move Fast and Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings, Research Report No. 126, Citizen Lab, University of Toronto, April 3, 2020, https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ (archive: perma.cc/FE6T-LBCG).

  49. Sam Jones, “Spain’s Spy Chief Sacked after Pegasus Spyware Revelations,” Guardian, May 10, 2022, https://www.theguardian.com/world/2022/may/10/spains-spy-chief-paz-esteban-sacked-after-pegasus-spyware-revelations (archive: perma.cc/S9QW-PS6R).

  50. Jose Javier Olivas (@josejolivas), “This is a thread on the curious #catalangate and on the presumed espionage of separatist leaders in Catalonia. First a disclaimer: I do not intend to defend in any way the Spanish secret services, whose in my view either for action or omission have contributed to the scandal 1/,” X, April 23, 2022, https://x.com/josejolivas/status/1517996367939084288 (archive: perma.cc/GM4T-SR4Y).

  51. Ariel Kahana, “‘NSO Accusations Were Part of International Disinformation Campaign,’” Israel Hayom, September 2, 2022, https://www.israelhayom.com/202209/02/the-accusations-against-nso-were-part-of-a-disinformation-campaign/ (archive: perma.cc/N9D3-QEKX).

  52. Alfonso Valero, “Presentación / Introduction,” Foro de Profesores, February 15, 2019, https://paginadelforodeprofesores.wordpress.com/ (archive: perma.cc/429X-TGXE).

  53. Carlos Conde Solares, “Re: Independent Investigation Request on Citizen Lab’s Report ‘CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru,’” email, July 5, 2022, https://paginadelforodeprofesores.wordpress.com/wp-content/uploads/2022/07/letter-to-university-of-toronto-by-foro-de-profesores-5-july-2022-re-catalangate-report.pdf (archive: perma.cc/D6CH-NRZA).

  54. Jose Javier Olivas Osuna, The Pegasus Spyware Scandal: A Critical Review of Citizen Lab’s “CatalanGate” Report, March 2023, https://doi.org/10.13140/RG.2.2.17511.93603.

  55. Stephanie Kirchgaessner and Sam Jones, “Pegasus Spyware Inquiry Targeted by Disinformation Campaign, Say Experts,” Guardian, November 28, 2022, https://www.theguardian.com/world/2022/nov/28/pegasus-eu-parliament-spyware-inquiry-targeted-disinformation-campaign (archive: perma.cc/3FYE-T9RF); Antoaneta Roussi, “EU Spyware Inquiry Fails to Put Spain on List of Fact-Finding Trips,” Politico, July 7, 2022, https://www.politico.eu/article/pedro-sanchez-spain-spyware-inquirys-visit-fallsflat-for-fear-of-embarrassment/.

  56. Runa Sandvik, “Fact Check: Gregorio Martin’s Presentation to the European Parliament,” Untidy (blog), March 18, 2023, https://www.untidy.news/p/fact-check-gregorio-martins-presentation (archive: perma.cc/QDJ9-2G8Z); Jonathan Scott, Uncovering the Citizen Lab—An Analytical and Technical Review Disproving CatalanGate, July 2022, https://staticecestaticos.com/file/b9e/fff/e37/b9efffe37b7e3cf717aa7cd584db8fba.pdf.

  57. Runa Sandvik, “Fact Check: José Javier Olivas-Osuna’s Review of Citizen Lab’s CatalanGate Report,” Untidy (blog), March 16, 2023, https://www.untidy.newsp/fact-check-jose-javier-olivas-osunas.

  58. Ronald Deibert, “About the Citizen Lab’s CatalanGate Report,” Ronald Deibert, May 14, 2022, https://deibert.citizenlab.ca/2022/05/about-the-citizen-labs-catalangate-report/ (archive: perma.cc/KWE9-ZHUM) .

  59. Jose Javier Olivas (@josejolivas), “Apple keeps on funding Citizens Lab via the Ford Foundation and #CitizenLab still conceals in their ‘academic reports’ that Apple (and who knows what other big techs) fund their research that blame others for security breaches 958/ @UofT @munkschool https://T.Co/s4QFoqPDAy,” X, March 12, 2024, https://x.com/josejolivas/status/1767452378188431766 (archive: perma.cc/HE4A-5HRC).

  60. Quico Sallés, “La Guàrdia Civil va espiar durant mesos l’investigador del Catalan- gate,” El Món, January 18, 2024, https://elmon.cat/politica/tribunals/guardia-civilespiar-mesos-investigador-catalangate-787559/ (archive: perma.cc/N6EJ-F8HQ).

  61. “Windows Kernel Elevation of Privilege Vulnerability: CVE-2021-31979,” Micro- soft Security Update Guide, July 13, 2021, https://msrc.microsoft.com/updateguide/vulnerability/CVE-2021-31979; “Windows Kernel Elevation of Privilege Vulnerability: CVE-2021-33771,” Microsoft Security Update Guide, July 13, 2021, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771 (archive: perma.cc/WEW9-X4Z3).

  62. Microsoft Threat Intelligence, “Protecting Customers from a Private-Sector Offen- sive Actor Using 0-Day Exploits and DevilsTongue Malware,” Microsoft Secu- rity, July 15, 2021, https://www.microsoft.com/en-us/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/ (archive: perma.cc/FSB6-NN3C).

  63. “Consell de Degans i Deganes Emèrits i Emèrites,” Bar, accessed May 29, 2024, https://www.icab.cat/en/colegi/coneix-el-col-legi/organs-consultius/consell-dedegans-i-deganes-emerits-i-emerites/index.html (archive: perma.cc/VTZ2-YFUP); “Former Presidents,” FBE, accessed May 29, 2024, https://www.fbe.org/about/former-presidents/ (archive: perma.cc/444A-HSFJ).

  64. Quino Petit and Miguel González, “Ronald Deibert, fundador de Citizen Lab: ‘Los gobiernos usan Pegasus porque tienen apetito de espiar,’” El País, May 14, 2022, https://elpais.com/espana/2022-05-15/ronald-deibert-fundador-de-citizen-lab-los-gobiernos-usan-pegasus-porque-tienen-apetito-de-espiar.html (archive: perma.cc/X3G5-CHJ7); Sam Jones, “Use of Pegasus Spyware on Spain’s Politicians Causing ‘Crisis of Democracy,’” Guardian, May 15, 2022, https://www.theguardian.com/world/2022/may/15/use-of-pegasus-spyware-on-spains-politicians-causing-crisis-of-democracy (archive: perma.cc/PD9K-L6XJ).

  65. “Investigation of the Use of Pegasus and Equivalent Surveillance Spyware,” Euro-pean Parliament, June 7, 2023, https://www.europarl.europa.eu/thinktank/en/document/EPRS_ATA(2023)747923 (archive: perma.cc/Q62P-BCCJ).

  66. Cornelia Ernst (@ErnstCornelia), “Truly unbelievable and an insult to all MPs: The secret service chief from #Spain reads a bit of blah blah off the page, then simply refuses to answer our 28 questions and leaves the @EP_PegaInquiry. Here is our transcript of today’s hearing: https://cornelia-ernst.eu/2022/11/country-hearingspain-29-november/ (archive: perma.cc/N52C-GXYD) #CatalanGate,” X, November 29, 2022, https://x.comErnstCornelia/status/1597558061828214785; Efi Koutsokosta, “All Questions and No Answers, as Spanish Spy Chief Stays Mute on Pegasus Hacking Scandal,” Euronews, November 29, 2022, https://www.euronews.com/my-europe/2022/1129/all-questions-and-no-answers-as-spanish-spy-chief-stays-mute-on-pegasushacking-scandal.

  67. Jones, “Use of Pegasus Spyware on Spain’s Politicians.”

  68. Laura Hülsemann, “Spanish Court Halts Probe into Israeli Spyware Hacking of Pedro Sánchez’s Phone,” Politico, July 10, 2023, https://www.politico.eu/article/spain-shutters-investigation-into-pegasus-hacking-of-pedro-sanchez-phone/ (archive: perma.cc/5KAK-BWPX).

  69. “Spain Reopens Israeli Spyware Probe, Sharing Information with France,” Reuters, April 23, 2024, https://www.reuters.com/technology/cybersecurity/spain-reopensisraeli-spyware-probe-sharing-information-with-france-2024-04-23/.

  70. Lorenzo Franceschi-Bicchierai and Carly Page, “Hackers Used Spyware Made in Spain to Target Users in the UAE, Google Says,” TechCrunch, March 29, 2023, https://techcrunch.com/2023/03/29/hackers-variston-spyware-uae-google/ (archive: perma.cc/59P6-VWDS).

  71. “Barcelona Emerges as New Cyber-Offensive Hub in Europe,” Intelligence Online, July 21, 2023, https://www.intelligenceonline.com/surveillance—interception/202307/21/barcelona-emerges-as-new-cyber-offensive-hub-in-europe,110005885-gra.