Spain’s spy chief sacked over phone hacking scandal

Spain’s government on Tuesday sacked the country’s spy chief as part of a widening scandal over the hacking of the mobile phones of the prime minister and Catalan separatist leaders.

The affair broke in April when Canadian cybersecurity watchdog Citizen Lab said the phones of over 60 people linked to the Catalan separatist movement had been tapped using Pegasus spyware after a failed independence bid in 2017. 

Last week the government confirmed the phones of Prime Minister Pedro Sanchez and Defence Minister Margarita Robles were also targeted, raising concerns about cybersecurity among Spain’s leadership.  

Paz Esteban, the first woman to head Spain’s CNI intelligence agency, will be replaced, said Robles, whose ministry oversees the agency, confirming media reports.

“There are flaws, mistakes” in the way the affair was handled by the CNI, she told reporters.

Esteban appeared before a parliamentary committee for questioning on Thursday over the phone hacking scandal which has dominated headlines for days.

She confirmed that 18 Catalan separatists, including Pere Aragones, the head of Catalonia’s regional government, had been spied on by the CNI but always with court approval, according to participants at the closed-door meeting.

The affair has sparked a crisis between Sanchez’s minority government and Catalan separatist party ERC. Sanchez’s fragile coalition relies on the ERC to pass legislation in parliament.

The scandal deepened after the government announced on May 2 that the phones of Sanchez and Robles were hacked by the same spyware, made by Israel’s NSO group, in May and June 2021.

– ‘Not enough’ –

Sanchez is the first serving head of government confirmed to have been targeted by controversial Pegasus spyware.

The revelation raised questions over who is to blame and whether Spain has adequate security protocols.

Interior Minister Fernando Grande-Marlaska’s phone was also among those hacked last year, government spokeswoman Isabel Rodriguez said Tuesday after all cabinet ministers’ phones were analysed.

There have been “no traces” of other Pegasus infections of ministers’ phones since then, she told a joint news conference with Robles.

The leader of Spain’s main opposition conservative Popular Party (PP), Alberto Nunez Feijoo, accused Sanchez of “offering the head of the CNI chief” to Catalan separatists “to ensure his survival”.

But Catalonia’s regional government said Esteban’s dismissal was “not enough”. 

Some Spanish media have pointed the finger at Morocco, which was in a diplomatic spat with Spain at the time, but the government has said it was no evidence of who may be responsible.

Esteban will be replaced as head of the intelligence services by Esperanza Casteleiro Llamazares, who is currently secretary of state for defence, the second-highest ranking official in the defence ministry.

– Criminals and terrorists –

Pegasus spyware infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.

The Israel-based NSO Group claims the software is only sold to government agencies to target criminals and terrorists, with the green light of Israeli authorities.

The company has been criticised by global rights groups for violating users’ privacy around the world and it faces lawsuits from major tech firms such as Apple and Microsoft.

There have been a number of scandals in Spain over illegal wiretapping by the intelligence services since the country returned to democracy following the death of long-time dictator Francisco Franco in 1975.

In 1995 Deputy Prime Minister Narcis Serra, Defense Minister Julian Garcia Vargas and the head of the intelligence service at the time, Emilio Alonso Manglano, resigned following revelations that they had illegally monitored the conversations of hundreds of people.

More recently, an ex-mistress of Spain’s former king, Juan Carlos, claimed she was put under unlawful surveillance carried out by the intelligence service. 

She said former intelligence agency chief Felix Sanz Roldan threatened her with physical harm unless she remained quiet. Sanz Roldan has denied the accusations in court.