The Pegasus scandal has revealed how, for years, governments worldwide have used advanced technology to spy on civil society actors (lawyers, journalists, human rights defenders, political representatives, etc.), putting fundamental rights at risk, such as the right to privacy and the secrecy of communications, as well as civil liberties, like freedom of expression, peaceful assembly, the right to information, and the right of association. The impact of using spyware entails a chain of rights violations with incalculable scope, affecting not only the individual being spied on and their environment but society as a whole.
This project highlights the extent to which the boundaries of any democratic state governed by the rule of law have been crossed: the Spanish State’s espionage on practicing lawyers as a way to access their clients and the legal strategies they were using.
Through strategic litigation on behalf of one of the spied-on lawyers, which is already underway for crimes of breach of confidentiality, we aim to raise awareness about the dangers of software like Pegasus and to change Spanish and European laws so that the strategies used by States are subject to thorough oversight. We are fighting for the prohibition of these illegal state espionage tools, aiming to protect citizens from abuses, defend human rights and democracy, and ensure that those who were spied on are compensated and that non-repetition guarantees are established.
What is Pegasus?
Pegasus is spyware developed by the Israeli company NSO Group. Since 2010, the cybersecurity company has sold its flagship product (Pegasus) to intelligence services of various states worldwide to spy on and intercept devices such as mobile phones, tablets, and computers belonging to a wide range of civil society actors. According to the manufacturer’s guidelines, in Spain, the governmental body that could acquire this type of spyware is the National Intelligence Center (CNI).
In April 2022, the Canadian institute Citizen Lab and Amnesty International uncovered the espionage of 65 people between 2017 and 2022 in Spain, in what has come to be known as the "Catalan Gate," due to the targeting of the Catalan independence movement, including lawyers defending accused individuals. To date, the CNI has only confirmed its role in the espionage of 18 of the 65 spied-on individuals, arguing it acted with judicial authorization from the Supreme Court. It is important to note that this espionage was not part of any judicial investigation for a criminal offense, but rather part of the CNI’s "security investigations."
The remaining 47 individuals, including the lawyer represented by Irídia, still do not know what happened to their devices, why they were spied on, or what has become of the information and documentation collected. Among those spied on are two additional lawyers, journalists, human rights defenders, and political representatives of the independence movement.
Pegasus allows access to all content on a device and even enables the remote activation of the camera and microphone without the knowledge of the targeted individual. Additionally, since its creation, this software has evolved to the point where its latest version requires no user action (zero-click) to infect the device. The surveillance industry is growing rapidly, and we know for a fact that new programs are continuously being developed. The speed and complexity with which this industry advances calls for urgent and decisive action.
Why is it so dangerous?
The ability of the state to spy on any individual merely for being considered a dissident — or even on the lawyers representing them — gravely infringes on the right to privacy, the confidentiality of communications, and the right to defense, while also having a chilling effect on the right to assembly and demonstration, freedom of expression, and freedom of information, among others. Carrying this out without any kind of oversight — neither before, during, nor after — undermines public institutions, deepens public distrust, and attacks the rule of law. It is worth reiterating that these individuals were not even under investigation for any criminal offense.
The legal framework governing the CNI and its oversight is contained in laws dating back to 2002, which are entirely outdated by technological and social advancements. Furthermore, the activities of the CNI are classified information, regulated by a law predating democracy, the 1968 Official Secrets Act.
Following the discovery of the "Catalan Gate," the European Parliament established the PEGA Commission and identified Spain, along with Hungary, Greece, and Poland, as one of the countries responsible for using Pegasus against civil society actors. After a year of its mandate, the commission recommended that Spain conduct a thorough and comprehensive investigation, as well as a reform of the legal framework. The Catalan Parliament also conducted an investigative commission. The Spanish Congress did not approve the creation of an investigative commission until the end of 2023, and to date, it has not met even once.
Through the strategic litigation funded by this project, we seek to bring those responsible for these acts to justice, as well as to achieve changes in current legislation at the state and European levels to ensure that incidents like these do not happen again.
The project aims to combat the illegal use of Pegasus and protect fundamental rights. We will focus on three main lines of action:
1. Legal Actions and Investigation:
Irídia represents one of the lawyers who was spied on, advancing a strategic litigation that seeks to identify those responsible for the espionage and bring them to justice. Given the great opacity in the operations of both the CNI and the manufacturing and distributing company, a thorough investigation into NSO Group's corporate network is absolutely necessary to uncover individual responsibilities beyond those of the legal entity. At the same time, we continue working to identify those responsible within the implicated public institutions.
2. Networking:
Irídia will work with other organizations in Catalonia and throughout Spain, as well as with organizations in Poland, Hungary, and Greece—countries where the state has also used Pegasus—and with European organizations. The goal is to pursue joint and/or coordinated litigation before the European Court of Human Rights and the Court of Justice of the European Union. We will also share information and documentation with regional organizations, such as the Council of Europe, and with United Nations mechanisms, highlighting the impact of such practices and proposing changes.
3. Political Advocacy Campaign:
In parallel, we will carry out a political advocacy campaign at different levels, both at the national level, to reform the regulation of the CNI and the outdated Franco-era Official Secrets Act, and at the European level, to ensure that mechanisms used by the state towards its citizens are controlled and respectful of human rights. We believe that highly invasive tools like Pegasus should be banned due to the impossibility of ensuring proper control and responsible use.
Through these legal actions, networking, and political advocacy efforts, we aim to denounce the illegal use of Pegasus, hold those responsible accountable, and implement the necessary legislative changes to prevent abuses like these from occurring again.
We want to bring those responsible for illegal espionage to justice.
We want to know who is behind the corporate network of Pegasus and ensure they are held accountable before the law.
We want to end state espionage and understand who, how, and why the victims of Pegasus were investigated and infected.
This project is directed at society as a whole, at all those who believe that there are limits that a democratic state should never cross. Because these limits are essential guarantees for the right to a fair defense, free from interference, as well as for privacy, freedom of expression, information, and political participation.
The Irídia team is made up of individuals with diverse professional backgrounds: lawyers, psychologists, journalists, political scientists, and sociologists, all bringing experience in the field of human rights protection. We combine paid technical work with volunteer and activist efforts.
Nine years of work back our track record, with hundreds of people assisted and supported in both the legal and psychosocial fields, dozens of advocacy campaigns, and real changes in public policies, legislation, and jurisprudence. During this time, the organization and the team have continued to grow and solidify.
Regarding spyware, the Irídia team has been training and participating in spaces at the Catalan, national, and European levels for more than two years to integrate the best litigation and advocacy strategies. These efforts aim to ensure a positive impact not only on the specific case but also to lead to legislative, jurisprudential, and public policy changes.
Channel 
