Elisenda Paluzie and Jordi Sànchez, together with former board member Sònia Urpí, testify in court, supported by a Catalan Police report that confirms the Pegasus spyware espionage on their phones
This Wednesday, former presidents of the Catalan National Assembly (ANC) Elisenda Paluzie and Jordi Sànchez, as well as former board member Sònia Urpí, have testified as plaintiffs in the CatalanGate case judging the espionage of 65 pro-independence activists with Pegasus. The complaint was filed in May 2022 and admitted for proceeding in July of the same year at pre-trial investigating court 23 of Barcelona.
Elisenda Paluzie detailed that they “want to know the extent of the infection”: what information was accessed, for how long, and what the justification for such intrusive spying was. “We want to go all the way regarding the assumption of responsibilities because this not only affects the victims of the espionage but the entire Catalan pro-independence movement, since this flagrant violation of the right to privacy can create a paralyzing effect within civil society”.
Jordi Sànchez highlighted the need to know whether the 26 attacks documented by the Catalan police (Mossos) were under the aegis of the Magistrate of the Supreme Court. “We know that those in June and July 2020 were, but we know nothing from 2015 to 2017. Unauthorized espionage is a crime that any democratic state must pursue to preserve political and civil liberties.”
Lawyer Jordi Cortada insisted on finding those responsible for this espionage: “We want to know who, when and to what extent the installation of this intrusive spyware was ordered.” He also emphasized that the fundamental rights of the plaintiffs have been violated.
Something that the plaintiffs explained and which had not been made public until today, 27 November, is the fact that in December 2023 they handed over their mobile phones to the Mossos. On September 2, 2024 they were notified that the Mossos expert report had already been submitted in court, by which the infection of the mobile phones of Jordi Sànchez, Elisenda Paluzie and Sònia Urpí was corroborated. The report also validated the data from the analyses by Citizen Lab and Amnesty Tech. In the cases of Paluzie and Urpí it was in fact possible to determine the total amount of information extracted.
Jordi Sànchez received the first SMS with a link to Pegasus in September 2015, two years before the October 1st referendum, and when he was already president of Assemblea. The espionage continued with a minimum of 19 messages, three of which in 2020, coinciding with prison leave. A malicious Pegasus process was detected on his mobile phone with activity from September 11th, 2017 to October 13th of that year, three days before his entry into preventive detention.
In the case of Elisenda Paluzie, there is evidence of attacks on two different mobile phones, an Android and an iPhone, in 2019 and 2020, during her time as president of Assemblea. The first evidence is prior to the “Catalan procés” trial verdict, with an attack that took place on August 6, 2019. After the verdict, she suffered two malicious processes on October 29, 2019, a few days after the post-sentence demonstrations, taking advantage of a zero-click vulnerability called HOMAGE, which was also confirmed in the Mossos report. One of the SMSes detected as infected with Pegasus is from June 10, 2020, the day that the elections for the secretariat of the Catalan National Assembly began, with the title “Elecciones ANC”, specifically designed to catch her attention on that specific day.
Sònia Urpí was elected a Board Member of Assemblea on June 14, 2020, and coordinator of the Mobilization Committee a month later. The SMS with the infiltration links was received on June 22 and 24, and could be related to her election as Board Member and the fact that her partner, Jordi Baylina, a blockchain expert, resident in Switzerland and a member of the Catalan National Assembly, is one of the CatalanGate victims with the most recorded attacks.
It should be remarked that in the case of the two former presidents of the Catalan National Assembly, Sànchez and Paluzie, the espionage carried out in the autumn of 2019 and spring of 2020 had prior judicial authorization from the Supreme Court, but the information is not public, and they were only made aware of it through leaks to the press. According to Spanish legislation (Article 588 of Law 13/2015), this espionage is only permitted in cases of pre-trial proceedings and following the principles of “exceptionality, necessity and proportionality,” which are not met in this case. The recommendations of the European Parliament highlighted that those affected should have access to judicial authorization. This is the first objective to be achieved, as well as ascertaining who authorized the spying on both Sònia Urpí in 2020 and Jordi Sànchez between 2015 and 2017.
The plaintiffs have also managed to get the judge to issue a letter rogatory to Israel and a European Investigation Order in Luxembourg. The objective is for the authorities of these two countries to inform whether they retain data on the operation of Pegasus on their mobile phones and to certify whether they have marketed it to government agencies in Spain, as well as to which agencies and who has acted as their representatives. They have asked them to provide documentation of the purchase and payment, and whether they retain information, data or computer records.
