Calls for inquiry over claims Catalan lawmaker's phone was targeted

Current and former leaders of Catalonia’s pro-independence government have called for an inquiry after it emerged that the speaker of the region’s parliament has been warned that his mobile was targeted using spyware its makers say is only sold to governments to track criminals and terrorists.

On Monday, a joint investigation by the Guardian and El País revealed that Roger Torrent and at least two other pro-independence supporters have been told they were targeted last year in what experts describe as a “possible case of domestic political espionage” in Europe.

Speaking on Tuesday morning, Torrent called for an investigation, calling the reports “extraordinarily serious”, adding: “We cannot normalise spying on political dissidence.”

Torrent said that if the Spanish government knew of the facts in the case “then it would have been complicit in a crime”.

If it did not, he said, “it would be a very worrying symptom of political negligence and unawareness of illegal practices”.

The speaker said that the matter had to be investigated and responsibility for the targeting established so that what he termed “the dirty war against the independence movement” could be put to an end.

His calls were echoed by the Catalan vice-president, Pere Aragonès, a fellow member of the Catalan Republican Left (ERC) party.

“The persecution of pro-independence ideas has neither ethics nor limits,” Aragonès said in a tweet on Tuesday morning. “The speaker was spied on using a tool that only states can acquire. This needs to be investigated now!”

Gabriel Rufián, ERC’s spokesman in the national parliament, called on Spain’s interior minister, Fernando Grande-Marlaska, to “provide explanations over the alleged spying and invasion of privacy against Catalan political leaders by government organisations”.

Oriol Junqueras, the former Catalan vice-president who is serving a 13-year prison sentence after being convicted of sedition and misuse of public funds over his role in the failed bid for independence in 2017, said “the sewers of state” were once again persecuting the independence movement.

“In a democratic state based on the rule of law, you don’t spy on political rivals,” he said in a message on his Twitter account, which is thought to be run by an ERC official. “They can’t get away with this. There has to be an investigation to find out who was responsible.”

Related: Phone of top Catalan politician 'targeted by government-grade spyware'

Carles Puigdemont, the former regional president who fled Spain to avoid arrest after staging the illegal, unilateral independence referendum nearly three years ago, also urged an investigation.

“The Spanish state has not respected the rule of law for some time now,” Puigdemont said in a tweet.

“The problem is that even with such irrefutable evidence they are not able to thoroughly investigate and attribute responsibility. A scandal that cannot go unpunished!”

In a statement to the Guardian and El País, the Spanish prime minister’s office said it had no evidence that Torrent, the former Catalan MP Anna Gabriel, or the activist Jordi Domingo had been the targets of hacking via their mobiles.

It added: “Furthermore, we must state that any operation involving a mobile phone is always conducted in accordance with the relevant judicial authorisation.”

Spain’s National Intelligence Centre (CNI) said in a statement that it acts “in full accordance with the legal system, and with absolute respect for the applicable laws” and that its work is overseen by Spain’s supreme court.

It did not respond to specific questions about the alleged use of “Pegasus” spyware sold by the Israeli company NSO Group.

The Spanish government said it was a legal, rather than political matter, and suggested that Torrent report his concerns to the judicial authorities.

“The government has no evidence that the speaker of the Catalan parliament has been the victim of a hack or theft involving his mobile,” the government’s spokeswoman, María Jesús Montero told reporters on Tuesday afternoon.

“When questions of this nature arise, the procedure is well known - you inform the relevant judicial authorities about the hack or tapping, or the theft from a device, and they can then investigate whether it has happened and under what circumstances. Any mobile phone tapping always requires preliminary judicial authorisation. This isn’t something for the government.”

According to a US lawsuit, the spyware exploited a previous vulnerability in WhatsApp software that would have given the operator potential access to everything on the target’s mobile phone – including emails, text messages and photographs. It could also have turned on the phone’s recorder and camera, turning it into a listening device.

WhatsApp believes the attacks occurred over a two-week period in April to May 2019, when a total of 1,400 of its users were allegedly targeted by the spyware.

The popular messaging app claims more than 100 members of civil society – including journalists in India, human rights activists in Morocco, diplomats and senior government officials – are alleged to have been affected.

John Scott-Railton, a senior researcher at CitizenLab who has closely monitored the use of NSO Group’s spyware and collaborated with WhatsApp to engage those targeted by the 2019 attack, confirmed – with Torrent’s permission – that Torrent had been targeted.

“This case is extremely troubling because it suggests that possible domestic political espionage was taking place,” he said. “And certainly we look forward to continuing to investigate the targeting that happened in Spain.”

NSO Group said it operated under “industry-leading governance policies” and that it could not confirm or deny which authorities use its technology because of confidentiality constraints.

“Once again speculative comments from CitizenLab only serve to highlight its continued, naive and ulterior agenda which fails to competently address the challenges faced by law enforcement agencies,” an NSO Group spokesperson said.