The lawyer Gonzalo Boye has filed a suit in a Madrid investigative court against the companies responsible for the Pegasus spyware program, namely the Israeli firm NSO, in addition to the company on which it depends, Q Cyber Technologies, and a subsidiary company in Luxembourg, OSY, and against the senior officers of these businesses, Niv Karmi, Shalev Hulio and Omri Lavie and “as many other people as are responsible for all the facts which are the subject of this lawsuit”. In the 109-page brief, to which ElNacional.cat has had access, the lawyer recalls that the Pegasus spyware is malicious cyberintelligence software that makes possible the unlimited extraction of information from virtually any mobile device, as well as the information collection, classification and transmission in its entirety. He warns that it is not clear how this information is administered and where it is hosted, and he stresses that different material published in Israel has indicated that this data could be "stored on NSO's own servers and from there administered or forwarded, totally or partially to its customers”. He does not even rule out that the defendants "might use the data or provide and/or sell it to third parties." The text recalls that several scandals have arisen as a result of espionage that has occurred with this technology in countries such as Mexico, Panama, Poland, India, Hungary, Rwanda, El Salvador and the United Arab Emirates, which allegedly used it to monitor the journalist Jamal Khashoggi, assassinated in 2018 at the Saudi consulate in Istanbul, Turkey.
Eighteen attacks
The legal suit notes that Boye is the lawyer defending several members of the Catalan government in exile, including president Carles Puigdemont, in coordination with a team of lawyers in Scotland, Belgium, France, Germany and Italy, who have successfully taken action to prevent the European Arrest Warrant against them from being carried out and currently maintain open several defence actions in the Courts of Justice of the European Union. It states that during this time he has been the victim of espionage and the target of smear campaigns and unfounded accusations - even criminal ones - and notes that, according to the Citizen Lab research centre which carried out the Catalangate investigation, between January and May 2020, he was the victim of at least 18 attacks with Pegasus via SMS messages with malicious links, malware, disguised as Twitter notifications, purporting to be from The Guardian, Politico, Columbia Journalism Review and Human Rights Watch. He was also attacked in October 2020, coinciding with the arrest of Josep Lluís Alay in the Volhov case. The text recalls that on those days Boye held virtual or face-to-face meetings relating to this and other cases in France, Germany or Belgium.
Civil servants
The lawyer recalls in the text that the placing of limitations on the confidentiality of communications not only requires prior judicial authorization but must also be sufficiently motivated, directed at a specific purpose, in the framework of a judicial procedure for the investigation of certain offences, and has to be executed by Spanish civil servants, subject to strict judicial control.
The text denounces that the Pegasus system "is not compatible with the guiding principles and essential presuppositions established by law" to limit the fundamental right to the confidentiality of communications, since once installed on the cellphone of the targeted person it grants unlimited access to all information, even the most sensitive and intimate data. At this point, he recalls that it also violates professional secrecy, as it spies on communications with the clients a lawyer is defending. Likewise, the professional secrecy of journalists, given the public projection of most of those affected, which keeps them in constant contact with the press. The text also adds that the software makes it possible to "contaminate or plant" evidence on the phones that are attacked, which goes against the evidential value of the investigations. This means, it adds, that "the use of Pegasus invalidates any judicial investigation" against a person who has been infected because the integrity of the evidence extracted from the device cannot be assured with certainty.
Offences
The conclusion is that this system is clearly illegal, whatever the reason claimed for its use. The suit denounces that Boye has been the victim of an offence of disclosure of secrets under the Spanish penal code, which alleges that his privacy and, in particular, his professional secrecy as a lawyer have been seriously violated. In order for the software to make this possible, a further crime is also committed: an offence of illegal access to information systems or computer intrusion, also provided for in the penal code. In addition, the extent and complexity of the espionage necessary to illegally monitor the Catalan political processes would require an organized and concerted structure that would add a level of aggravation to the offence, provided for in the penal code with regard to a criminal organization or group, which the text asserts is applicable to the companies and individuals whom it denounces.
Resulting from all this, among the steps that the suit demands be taken, is the declaration to the court as experts of the Citizen Lab specialists who prepared the expert report, which is also included in the complaint; the collection of all the financial and banking data of the managers of the company that sells the Pegasus program, Niv Karmi, Shalev Hulio and Omri Lavie, as well as of the companies themselves, NSO, Q Cyber, and OSY; and the requesting from the Bank of Spain of information on any money transfer made from the Spanish banking system in favour of these individuals or the companies included in the complaint.
Israel and Luxembourg
It also requests that, through an international rogatory commission or, preferably, through the travel of a judicial commission to Israel, the complaint be notified to Karmi, Hulio and Lavie as persons under investigation as well as to those who legally represent the companies included in the suit, and that the legal representatives be required to provide documentation accrediting all contracts, agreements or accords signed with the Spanish government, the CNI intelligence centre or any other Spanish public body or company, or private company that works with public bodies for the use of Pegasus in Spanish territory.
The text asserts that the Israeli authorities should be asked to access all the banking information of the companies NSO, Q Cyber, and Technologies LTD to determine “payments and money related, exclusively, to Spanish companies, individuals or public entities” or to those that have originated in Spain; it also asks the court to seek from Israel all the information they have about travel to Spain by the defendants or company employees, as well as about “migratory movements” to Israel by Spanish citizens who have maintained trading or any other type of relations with the companies listed in the complaint. Information from Israel is also sought on the authorizations for the provision of services or sale of material from these companies to Spanish state agencies or Spanish nationals.
As the Òmnium organization and the CUP party did yesterday, Boye is also requesting, as provided for in the directive over European Investigation Orders that the Luxembourg judicial authorities notify and take statements as persons under investigation of the representatives of OSY Technologies and that they be required to provide documentation of contracts, agreements or any accord signed with the Spanish government, the CNI or any other company or body, public or private, that works with Spanish bodies for the use of Pegasus.
Also, that banking institutions operating in Luxembourg or under the Belgian banking supervisory authority be required to report on the existence of bank accounts, deposits, security deposits or any other type of financial assets that appear under their ownership of companies, and that they provide their accounting summaries for 2014 to 2021. In addition, the Luxembourg authorities are requested to investigate any transfers from Spain to the bank accounts of these companies.