On April 18, Citizen Lab — a laboratory based in the Munk School of Global Affairs and Public Policy that researches internet use and safety as it relates to human rights — published a report revealing that members of the Catalan independence movement had been targets of mercenary spyware. While the lab cannot conclusively attribute the “operations to a specific entity,” it has found “strong circumstantial evidence [that] suggests a nexus with Spanish authorities.”
The report, titled ‘CatalanGate,’ found evidence of 65 cases of “extensive surveillance directed against Catalan civil society and government using mercenary spyware.” It has set off a flurry of angry condemnations, investigations, and firings, as well as an interest in surveillance technology in Spain and around the world. Simultaneously, it triggered waves of skepticism and false claims about the lab and its report.
On May 11, 2022, six Members of the European Parliament (MEPs) from Spain wrote a letter to Citizen Lab, outlining 32 questions concerning the report’s accuracy and replicability, and sources of funding. The MEPs also questioned the lab’s ties with Catalan secessionist organizations.
In a letter published online, Ron Deibert, the director of Citizen Lab, reaffirmed the report’s rigour in an attempt to combat misinformation about the lab, its mission, and its independence.
Catalan independence movement
Catalonia is an autonomous region in north-eastern Spain, covering the provinces of Girona, Barcelona, Tarragona, and Lleida.
The region has been a part of Spain since it was unified in the 15th century. Following the formation of the Second Spanish Republic in 1931, the Spanish government granted Catalonia broad autonomy in 1932. However, Catalonia lost its autonomy in 1939, after the victory of nationalist, right-wing forces in the Spanish Civil War.
In 1979, after the fall of the right-wing regime, Catalonia gained relative self-determining rule. It was not until the 2006 Statute of Autonomy that Catalonia came close to what Pasqual Maragall, former president of Catalonia, referred to as “unprecedented, ‘state-like’ autonomy.”
However, the Spanish Constitutional Court struck down a number of the statute’s articles in 2010, interrupting the period of relative Catalan independence. This decision set in motion numerous protests in the region and marked the reemergence of the Catalan independence movement.
In 2017, then president of Catalonia, Carles Puigdemont, held a referendum on the independence of Catalonia. Although the referendum was 90 per cent in support of independence, the Spanish government fired Puigdemont and dissolved the Catalan parliament. Pro-independence parties went on to win in the subsequent elections, and the independence movement has only grown since.
The report
In the CatalanGate report, the lab referenced several instances of “documented surveillance abuses in Spain and Catalonia” between 2001 and 2020.
The report details the lab’s discovery that one or more entities, likely including Spanish authorities, used spyware to monitor the phones and computers of at least 65 Catalan politicians, community leaders, and other public figures and their relatives.
While the report references several earlier cases of surveillance abuses by the Spanish authorities, it suggests that citizens of Catalonia were first targetted in 2017. Accordingly, the use of spyware on Catalans is likely to have begun the same year that the Catalan parliament undertook a failed bid for independence that led to its dissolution.
The Citizen Lab found that two different pieces of technology were used to infect the devices of Catalan leaders: Pegasus, sold by the NSO Group, and an elusive spyware sold by the company Candiru.
These technologies allow the surveyor to monitor calls, read texts, collect passwords, track locations, and even access the infected device’s microphone and camera.
Both Candiru and the NSO Group claim that they sell their products exclusively to government entities with intended uses listed as preventing terrorism and other crimes.
Responses to the report
The Citizen Lab’s CatalanGate report has sparked major controversy in and outside of Spain. After the report’s publication, Paz Esteban, the head of Spain’s National Intelligence Centre (CNI), admitted that the centre was responsible for spying on 18 of the victims identified in the report, and that they had done so with the approval of the Spanish Supreme Court. The Spanish government has since fired Esteban from his position.
Even after its attempts to sweep the scandal under the rug with Esteban’s dismissal, the Spanish government’s refusal to declassify the CNI’s reports on the operation has halted any further negotiations between it and the Catalan government.
In the midst of this controversy, six MEPs affiliated with the Spanish political party Ciudadanos — a Spanish, right-wing political party with a history of opposing Catalan independence — addressed a letter to the Citizen Lab.
According to Deibert, the letter was preceded by a broader “disinformation and smear campaign” conducted against the Citizen Lab “in pro-Madrid media.”
“The Catalonia issue is highly controversial in Spain… we expected our report’s findings to be met with a range of opinions and pushback from various partisan interests,” wrote Deibert in an email to The Varsity.
The lab’s response
In an effort to dispel some of the misinformation, Deibert published his responses to the MEPs’ questions.
“My objective was to communicate as widely as possible that the mission of the Citizen Lab is to undertake impartial, evidence-based research in the public interest,” asserted Deibert in his email to The Varsity. “We are not beholden to any particular group or cause. We are strictly independent of governments and companies.”
In his response to the MEPs, Deibert highlighted the lab’s track record of validating Pegasus attacks. He elaborated, “To date, no reputable technical analysis has contradicted our findings, nor have any specific concerns regarding our technical methodology for identifying Pegasus been substantiated.”
He also noted the lab’s strict adherence to research ethics, as well as its independence. “The Citizen Lab has never been commissioned to find evidence for a lawsuit by any parties to any litigation,” confirmed Deibert. “Under no circumstances would we undertake commissioned research.”
A number of the questions posed by the MEPs concerned Elies Campo, one of the lab’s fieldwork coordinators and a victim of Candiru targetting. The MEPs questioned whether Campo had disclosed any conflicts of interests to the lab and whether the lab was aware of Campo’s alleged involvement with “several illegal secessionist activities.”
After the report was released, it was revealed that Spanish intelligence services had monitored Campo for his suspected involvement in secessionist activities.
However, Deibert refuted that the allegations had compromised the integrity of the report. In an interview with The Guardian, Deibert said that Campo was the victim of an “outrageous smear campaign.” He also noted in his letter to the MEPs that all of Campo’s activities took place under the direction of Deibert himself and his co-investigator, John Scott-Railton.
The MEPs also asked the lab to clarify whether it had monetary ties with Apple or WhatsApp/Facebook and whether any “Catalan political party… or secessionist organizations” were involved in the lab’s research. The lab denied having any ties with Apple and WhatsApp/Facebook, as well as with Catalan political parties.
Deibert views the attempts to discredit Citizen Lab’s work as validating. “Powerful interests will not sit idly by as we expose abuses of power. They will push back and use anything to try and discredit your work,” he wrote. “But, when you are careful, follow strict ethical principles, undertake careful peer review of your methods, and publish careful evidence-based reports, then you stand a good chance that the truth will ultimately win out.”
The Varsity reached out to two signatories of the letter, MEP Luis Garicano and MEP Jordi Cañas. Garicano declined to comment.
