“Spanish authorities must conduct a full, fair, and effective investigation into these allegations, publish the findings and stop any unlawful interference into the fundamental rights of the Catalan minority activists in Spain,” they said in a statement.

Top leaders arrested

Following the October 2017 independence referendum, Spain arrested leaders of the Catalonian independence movement on charges of sedition. 

The alleged spying occurred between that year and 2020, with most incidents taking place soon after the vote.

Mobile phones of at least 65 Catalan politicians and activists were reportedly hacked using Pegasus and Candiru spyware. 

Victims included members of the European Parliament, legislators, jurists, and civil society representatives, according to the experts.

Sophisticated spying programme

Pegasus spyware was created by the NSO Group, an Israeli cyber-intelligence firm that develops technology to help governments prevent and detect threats, according to its website. 

Spain’s national intelligence agency reportedly became one of the company’s customers, the Human Rights Council-appointed experts said.

They were particularly concerned by the extent and sophistication of the alleged spying programme, noting that those targeted had not engaged in violent activities.

Furthermore, they warned that widespread use of such spyware may lead to increased self-censorship, which has a chilling effect on human rights, including those of minorities.

Customized text messages

Reports indicate that many victims were targeted through SMS-based attacks, where they received text messages containing malicious links designed to trick them.

“The sophistication and personalisation of the messages varied across attempts, but reflect a detailed understanding of the target’s habits, interests, activities, and concerns,” said the experts.

“In many cases, either the timing or the contents of the text were highly customised to the targets and indicated the likely use of other forms of surveillance on them,” they added. 

Victims also were targeted using highly personalised official notifications from Spanish government entities, including tax and social security authorities. 

“For example, a message sent to one victim included a portion of his actual official tax identification number, suggesting that the attackers had access to this information,” they said. 

Moratorium on spyware

The experts wrote to the Spanish Government in October 2022. In a reply that December, the authorities reported that investigations were ongoing and said they could not pronounce on cases that were pending judicial investigation.

“We are looking forward to the outcomes of the ongoing judicial investigation,” the UN experts said.

“We further wish to reiterate our call for a global moratorium on the sale and transfer of surveillance technology, until robust regulations are in place that guarantee its use in compliance with international human rights standards,” they added, urging Spain to join.