The ideal group of people to review this topic would be Cyber Policy Experts, International Human Rights Lawyers, and Investigative Journalists.
Abstract: Suing Spyware in Europe: News from the Front
This presentation details strategic litigation efforts across Europe targeting the unauthorized use of mercenary surveillance tools, primarily Pegasus, against civil society members, activists, lawyers, and journalists. The discussion centers on the "Catalangate" case in Spain (2017-2021), where 65 individuals were illegally surveilled. A key legal development is the successful filing of a criminal complaint that led to the indictment request for NSO Group directors in Luxembourg, representing a global first in holding company leadership personally liable. The analysis reveals systemic failures in national oversight, including the lack of victim notification (despite EU court rulings) and the routine rejection of forensic evidence in domestic courts (Spain). The broader European pattern, evidenced by cases in Hungary and Poland, underscores the weaponization of spyware as "authoritarianism as a service," undermining democratic safeguards, particularly freedom of the press and attorney-client privilege. Policy solutions discussed include the urgent need for vulnerability management laws and stricter regulation of dual-use technologies, acknowledging the profound risk posed by administrative control capabilities inherent in zero-click exploitation tools like Pegasus.
Suing Spyware in Europe: News from the Front
0:29 Data Rights and Idia: Data Rights (operating across the EU since 2024) focuses on fighting internet arms races and monopolies. Idia, a human rights association based in Catalonia, combines direct support with strategic litigation and political advocacy.
1:30 Context: Catalonian Political Crisis: The surveillance context is set by the Catalonian independence movement (2017-2021). The political turmoil, including the 2017 referendum and the subsequent jailing of 12 political leaders, provides the backdrop for the espionage.
3:50 The Target and Discovery: The specific litigation case involves Andreo, a lawyer whose phone was infected with Pegasus during an online legal defense meeting for political prisoners on May 14, 2020. Citizen Lab subsequently uncovered that 65 people in Catalonia were surveilled using Pegasus and Candiru between 2017 and 2021.
5:07 Main Suspect and Legal Environment: The primary suspect is the Spanish National Intelligence Center (CNE). Its activities are classified under a 1968 Official Secrets Act signed by Franco, which remains in force. Officially, the surveillance has not been confirmed, though the CNI director was dismissed shortly after the Catalangate findings were published.
6:09 Illegal Surveillance: Andreo is one of the 47 people who were spied on illegally (without judicial authorization) in connection with the Catalangate scandal.
6:35 Litigation Strategy (Targeting NSO Group): A criminal complaint was filed in May 2022 against the companies responsible for developing and exporting Pegasus (NSO Group), emphasizing the need to target the actors who build and deploy these disproportionately powerful systems.
7:46 NSO Group Structure in Europe: NSO Group, founded in 2010, is an umbrella brand with a vast network, notably concentrated in Luxembourg (described as NSO's "operational gateway into Europe").
8:49 Focus on Luxembourg Entities: The strategic focus targeted two Luxembourg-registered NSO companies, Aussie Technologies and QC Technologies, due to their direct structural ties, shared board of directors (2019β2020), and links to civil security/spyware activities.
10:13 Global Legal Precedent: A judge for the Barcelona Court of Appeal accepted the request to indict NSO directors, marking the first criminal investigation anywhere in the world where NSO executives are being investigated in connection with targeting a Pegasus victim.
11:28 Active Company Participation: Evidence suggests NSO-linked companies were not passive distributors but actively involved in technical and support services, including deployment, installation, monitoring, and providing ongoing operational support.
12:16 Judicial Obstruction in Spain: The investigation burden has fallen almost entirely on the victims. The judge is not specialized in high-tech cases, and the public prosecutor repeatedly opposes the investigation, which, after nearly four years, remains in the preliminary stage.
15:31 European Parliament Response: A European Parliament investigation (2019-2024) into widespread European spyware abuse produced strong recommendations, but little political action followed ("not even a sausage"). Litigation is now seen as the only forward path.
16:47 Litigation Coalition Formed: A coalition of European organizations was launched to pool resources and strategize litigation, aiming to establish precedents in European courts.
18:01 Hungarian Case Patterns: In Hungary, seven targets (mostly journalists specializing in anti-corruption) are pursuing cases. The Data Protection Authority ruled favorably toward the state. Three cases are now before the Constitutional Court.
19:11 Polish Case (Data Modification): The Polish political context is crucial. Pegasus was used against political opponents, including politician Krzysztof Brejza. Attackers used Pegasus to extract 10 years of texts, then rearranged and merged texts to create a completely new, damaging narrative, which was then broadcast on Polish TV during elections.
20:46 Polish Government Acknowledgment: Following a change in power, the Polish state investigated and concluded that Pegasus was used and that its use was illegal, a major divergence from the Spanish approach.
21:53 Pattern: Targets and "Authoritarianism as a Service": Primary targets are historically protected professions (lawyers, journalists, particularly anti-corruption investigators). This constitutes "authoritarianism as a service," characterized by the destruction of separation of powers, free press, and the rule of law.
22:39 Pattern: No Notification: Despite a 2020 EU top court ruling mandating notification of surveillance after the threat has passed, targeted individuals in Spain and Hungary were never notified, preventing them from seeking legal remedy.
24:56 Pattern: Evidence Rejection: Spanish judges have repeatedly refused to accept forensic analyses from recognized bodies (Citizen Lab, Amnesty Security Lab) as hard evidence, forcing victims to pay for independent exams or hand over devices to the police (the initial suspects) for testing.
28:46 Long-Term Stakes: Stockpiling Hacking Tools: Stockpiling zero-day exploits turns governments into honeypots (exemplified by the WannaCry attack). Vulnerability management is critical to protect basic rights.
29:41 Long-Term Stakes: Capabilities and Data Integrity: Zero-day exploits grant administration control, enabling not just spying but modification, removal, and injection of data, as demonstrated in the 2018 Indian case where activists were framed using injected fake evidence.
31:28 Root Cause: Monopolistic Operating Systems: The lack of a diversified mobile operating system environment makes developing spyware against the dominant systems more profitable and effective.
32:06 Policy Focus: Dual-Use Technologies: Spyware falls under dual-use technologies (having potent military and civil applications). States resist safeguards, seeking a surveillance edge. Future challenges will involve combining spyware with AI and biometrics.
36:06 Public Discourse: Speakers acknowledge that media narratives often focus on the "fighting terrorism" justification, making it difficult to shift public opinion toward the human rights violations faced by activists and lawyers.
40:54 Mutual Legal Assistance: The need for cross-border cooperation is critical, focusing on non-state networks involving researchers, journalists, and legal professionals (like the PEGA coalition) to overcome state isolation and resistance to investigation.
47:08 Legislative Solutions: The urgent need is for vulnerability management laws and for existing legal safeguards to be strictly enforced, as current laws, if followed, would already provide significant relief.
51:47 Root Causes and Import Control: The question of regulating imports (particularly from sources like Israel) is strategic. Current EU dual-use export controls are often disastrously easy to bypass.
55:00 International Aspect: The fight is fundamentally international, emphasizing the history of testing such tools on vulnerable populations, citing the example of Palestinians subjected to NSO surveillance for many years before the technology was exported globally.