Citizen Lab’s ‘CatalanGate’ report sparks debate over government use of spyware – The Varsity

On April 18, Citizen Lab – a lab based at the Munk School of Global Affairs and Public Policy that studies internet use and safety as it relates to human rights – released a report revealing that members of the Catalan independence movement had been the target of mercenary spyware. Although the lab could not conclusively attribute the “operations to a specific entity”, it found “strong circumstantial evidence [that] suggests a link with the Spanish authorities.

The report, titled “CatalanGate,” found evidence of 65 cases of “extensive surveillance directed against Catalan civil society and government using mercenary spyware.” It sparked a wave of angry convictions, investigations and firings, as well as interest in surveillance technology in Spain and around the world. Simultaneously, it sparked waves of skepticism and misrepresentation about the lab and its report.

On May 11, 2022, six Spanish Members of the European Parliament (MEPs) wrote a letter to Citizen Lab, outlining 32 questions regarding the accuracy and reproducibility of the report, as well as funding sources. MEPs also questioned the laboratory’s links with Catalan secessionist organisations.

In a letter posted online, Ron Deibert, the director of Citizen Lab, reaffirmed the thoroughness of the report in an attempt to combat misinformation about the lab, its mission and its independence.

Catalan independence movement

Catalonia is an autonomous region in the northeast of Spain, covering the provinces of Girona, Barcelona, ​​Tarragona and Lleida.

The region has been part of Spain since its unification in the 15th century. Following the formation of the Second Spanish Republic in 1931, the Spanish government granted extensive autonomy to Catalonia in 1932. However, Catalonia lost its autonomy in 1939, after the victory of right-wing nationalist forces in the Spanish Civil War .

In 1979, after the fall of the right-wing regime, Catalonia acquired a rule of relative self-determination. It was only with the Autonomy Statute of 2006 that Catalonia moved closer to what Pasqual Maragall, Catalonia’s former president, called “unprecedented, ‘state-like’ autonomy”.

However, the Spanish Constitutional Court overturned a number of articles of the law in 2010, interrupting Catalonia’s period of relative independence. This decision triggered numerous protests in the region and marked the resurgence of the Catalan independence movement.

In 2017, the President of Catalonia, Carles Puigdemont, organized a referendum on the independence of Catalonia. Although the referendum was 90% in favor of independence, the Spanish government sacked Puigdemont and dissolved the Catalan parliament. Independence parties won subsequent elections and the independence movement has only grown since then.

The report

In the CatalanGate report, the lab referred to several cases of “documented surveillance abuse in Spain and Catalonia” between 2001 and 2020.

The report details the lab’s discovery that one or more entities, likely including Spanish authorities, used spyware to monitor the phones and computers of at least 65 Catalan politicians, community leaders and other public figures and their relatives. .

Although the report refers to several previous cases of surveillance abuse by Spanish authorities, it suggests that citizens of Catalonia were first targeted in 2017. As a result, the use of spyware on Catalans has probably started the same year that the Catalan parliament undertook a failed attempt. candidacy for independence which led to its dissolution.

The Citizen Lab discovered that two different technologies were used to infect the devices of Catalan leaders: Pegasus, sold by the NSO group, and an elusive spyware sold by the Candiru company.

These technologies allow the investigator to monitor calls, read texts, collect passwords, track locations, and even access the infected device’s microphone and camera.

Candiru and the NSO Group claim that they sell their products exclusively to government entities with intended uses listed as the prevention of terrorism and other crimes.

Responses to the report

Citizen Lab’s CatalanGate report has sparked major controversy inside and outside Spain. After the report was released, Paz Esteban, the head of Spain’s National Intelligence Center (CNI), admitted that the center was responsible for spying on 18 of the victims identified in the report, and that they did so with the approval of the Spanish Supreme Court. To research. The Spanish government has since sacked Esteban from his post.

Even after his attempts to sweep the scandal under the rug with the dismissal of Esteban, the refusal of the Spanish government to declassify the CNI reports on the operation halted any further negotiations between him and the Catalan government.

Amid this controversy, six MEPs affiliated with the Spanish political party Ciudadanos – a right-wing Spanish political party with a history of opposing Catalan independence – sent a letter to Citizen Lab.

According to Deibert, the letter was preceded by a wider “disinformation and defamation campaign” against the Citizen Lab “in pro-Madrid media”.

“The Catalonia issue is highly controversial in Spain…we expected the findings of our report to be met with a range of opinions and reactions from various partisan interests,” Deibert wrote in a statement. email to the university.

The laboratory’s response

In an effort to dispel some of the misinformation, Deibert posted his answers to MPs’ questions.

“My goal was to communicate as widely as possible that Citizen Lab’s mission is to undertake unbiased, evidence-based research in the public interest,” Deibert asserted in his email to the university. “We are not beholden to any particular group or cause. We are strictly independent of governments and companies.

In his response to MEPs, Deibert highlighted the lab’s track record of validating Pegasus attacks. He clarified: “To date, no reliable technical analysis has contradicted our conclusions, and no specific concerns regarding our technical methodology for identifying Pegasus have been substantiated.”

He also highlighted the laboratory’s strict adherence to research ethics, as well as its independence. “Citizen Lab has never been commissioned to find evidence of a lawsuit by litigants,” Deibert confirmed. “Under no circumstances would we undertake commissioned research.”

A number of questions posed by MEPs concerned Elies Campo, one of the lab’s field coordinators and a victim of Candiru targeting. MPs asked whether Campo had disclosed any conflicts of interest to the lab and whether the lab was aware of Campo’s alleged involvement in “several illegal secessionist activities”.

After the report was published, it was revealed that Spanish intelligence services had been monitoring Campo for his alleged involvement in secessionist activities.

However, Deibert denied that the allegations compromised the integrity of the report. In an interview with The Guardian, Deibert said Campo had been the victim of an “outrageous smear campaign”. He also noted in his letter to MEPs that all of Campo’s activities were at the direction of Deibert himself and his co-investigator, John Scott-Railton.

MEPs also asked the lab to clarify whether it had any monetary ties to Apple or WhatsApp/Facebook and whether any “Catalan political party…or secessionist organizations” were involved in the lab’s research. The laboratory denied having links with Apple and WhatsApp/Facebook, as well as with Catalan political parties.

Deibert views attempts to discredit Citizen Lab’s work as validation. “Powerful interests will not sit idly by as we expose abuses of power. They will push back and use anything to try to discredit your work,” he wrote. “But, when you are careful, follow strict ethical principles, undertake careful peer review of your methods, and publish thorough evidence-based reports, then you have a good chance that the truth will ultimately prevail.”

the university contacted two signatories of the letter, MEP Luis Garicano and MEP Jordi Cañas. Garicano declined to comment.

Comments are closed.