Monday, 11 July 2022

Las 10 excepcionalidades jurídicas que ha sufrido Catalunya, según el magistrado Guillem Soler

Soler sostiene que han provocado "insensibilidad al dolor jurídico" en la sociedad catalana
Mayte Piulachs


El magistrado de Barcelona y miembro de la asociación Ágora judicial, Guillem Soler Solé, afirma que el intento de secesión de Catalunya se ha combatido, desde el otoño de 2017, con una "excepcionalidad jurídica" que se ha convertido en "permanente y general", vista su duración en el tiempo y la afectación en varios ámbitos sociales. Define como excepcionalidades jurídicas "aquellas decisiones públicas imperativas de gobierno o, especialmente, judiciales que se alejan de lo que hasta un momento determinado había sido la regla o criterio general". No todo cambio es malo, sostiene. En el caso catalán, sin embargo, el magistrado expone que "estos cambios o excepciones han implicado la afectación o vulneración de derechos fundamentales" y que estas "excepcionalidades jurídicas operan siempre, casual o sospechosamente, en el mismo sentido de reprimir o limitar las capacidades de actuación de una de las dos partes «enfrentadas» en el conflicto". La catalana.

El próximo otoño hará cinco años de esta "cronificación de las excepcionalidades jurídicas" y, en opinión del magistrado Guillem Soler, una de sus consecuencias es que "ha subido dramáticamente el nivel de tolerancia social al dolor jurídico" en Catalunya. Se han visto afectados políticos, activistas sociales, ciudadanos sin cargos públicos o, ahora, las instituciones de Educació. Y manifiesta: "La acumulación acelerada de excepcionalidades jurídicas sucesivas, convertidas, sin descanso, una tras la otra, nos hurta el tiempo necesario para analizarlas y asimilarlas, para adquirir conciencia del destrozo jurídico y el dolor que causan. Un dolor que a menudo no es sino la traducción personal o institucional de la vulneración de un derecho fundamental implicado." Un fenómeno que el juez bautiza como "insensibilidad al dolor jurídico". E insiste: "Vivimos ya inmersos en una fatalidad jurídica plenamente aceptada y contra la cual sólo se opone, de momento, ciertas dosis de resignación, humor o cinismo, tan característicos, por otra parte, del talante catalán."

Guillem Soler Solé, magistrado de Barcelona y miembro de Ágora Judicial. / Archivo

Doctrinas del nazismo o neo-autoritàries

Para el magistrado Soler las excepcionalidades jurídicas "parece que no se tengan que marchar hasta que no se abandonen definitivamente los planteamientos políticos (secesionistas) que la han motivado". Esta excepcionalidad catalana le recuerda teorías políticas y del derecho tan peligrosas como las desarrolladas por Günther Jakobs y Carl Schmitt. Del primero, el llamado derecho penal del enemigo, con el cual se relajan las garantías penales para perseguir al opositor de un estado. Además, "ciertas doctrinas de Carl Schmitt, un jurista antiliberal convertido miserablemente al nazismo, nos ofrecen unas analogías ineludibles respecto del caso catalán", manifiesta Soler. Como "la distinción, también, entre amigo y enemigo y la aceptación, precisamente, de la excepcionalidad jurídica para combatir el segundo".


El magistrado detalla diez excepcionalidades que se han producido a Catalunya para combatir la política independentista.
1a: Un TC que impide precipitadamente el debate parlamentario

El magistrado Guillem Soler afirma que la primera excepcionalidad jurídica es "a menudo demasiado obviada, a pesar de su extraordinaria importancia," como es "la anormalidad que un Tribunal Constitucional (TC) no se limite a pronunciarse sobre la constitucionalidad de normas ya aprobadas por los Parlamentos, sino que amplíe excepcionalmente su actuación hasta impedir que se produzca el mismo debate parlamentario previo a la aprobación de las normas". Detalla que la función de este tipo de tribunal siempre ha sido posterior a la aprobación de las normas. Así lo había establecido el mismo TC en casos precedentes. "Pero claro está -añade Soler- una actuación posterior a la aprobación de la norma no era eficaz para prevenir el avance del procés secesionista: el TC cambió el criterio, porque necesitaba cambiarlo, y mutó sustancialmente (y fatal) su misma naturaleza y función."

El juez añade: "Que quedara aniquilada la autonomía parlamentaria y el derecho de los elegidos y electores a la posibilidad del debate político parlamentario era un daño colateral que había que asumir, si es que se llegó a ser consciente en algún momento." El juez recalca que "este cambio de criterio fue determinante para el resto de excepcionalidades jurídicas. Fue, podríamos decir, la «madre de los huevos», porque una vez el TC declaró que el mero debate y tramitación (no sólo la aprobación) de la norma era contraria a la Constitución, cualquier acto vinculado, directa o indirectamente, a esta mera tramitación se podía convertir en un delito de desobediencia. Es decir, una actuación delictiva, con todo lo que eso implica."

Los miembros soberanistas de la Mesa del Parlament, presidida por Carme Forcadell, fueron condenados por desobediencia al TC al permitir el debate y la aprobación de las leyes de Transitoriedad Jurídica y la del Referéndum de Autodeterminación de Catalunya. Y ahora, con mayor gravedad, se juzgará por desobediencia la Mesa, presidida por Roger Torrent, por haber permitido sólo el debate de proposiciones soberanistas y contra el rey en el 2019.

El presidente del Parlament, Roger Torrent, y dos miembros de la Mesa, Josep Costa i Espejo Saavedra, en el 2018 / Foto: Marina Fernandez

2a: una desobediencia sin requerimiento previo

La segunda excepcionalidad jurídica, según el juez Guillem Soler, refuerza la primera. "Siempre se había considerado, como cuestión de la máxima obviedad (de primero de carrera de derecho, podríamos decir), que para poder cometer un delito de desobediencia había que haber sido requerido previamente de manera personal y clara con una orden, que precisamente se incumplía," expone al magistrado y añade: "De nuevo, sin embargo, eso podía tener un inconveniente: sólo podrían cometer el delito los miembros de la Mesa del Parlament, que estaban preparando el debate parlamentario y que habían sido expresamente requeridos. No podrían cometer el delito otros diputados o diputadas que hubieran tenido otro tipo de intervención, como por ejemplo presentar una proposición de ley. Hacía falta, por lo tanto, un nuevo cambio de criterio, que implicaba, de nuevo, mutar fatalmente la estructura misma del delito de desobediencia. Parecía jurídicamente imposible. Pero el milagro ocurrió y dejó de exigirse, como mínimo en el «caso catalán», la existencia de un requerimiento previo por poder cometer el delito de desobediencia."

El magistrado Soler sitúa el inicio de esta excepcionalidad en la imputación a la exdiputada de la CUP Anna Gabriel por haber registrado en el Parlament la proposición de Llei de Transitorietat Nacional y fundacional de la República y la proposición de ley del Referéndum, el 6 de septiembre de 2017. Gabriel se exilió en Suiza, mientras Mireia Boya, investigada por lo mismo, fue absuelta por el TSJC, en el 2020.

La diputada de la CUP, Anna Gabriel en el pleno de la DUI / Foto: Sergi Alcàzar

3a: Catalunya no se encuentra en Catalunya


En la tercera excepcionalidad, el magistrado Soler arranca con una obviedad: "Estaremos todos de acuerdo que los hechos del caso catalán sucedieron a Catalunya." Explica que en el ámbito legal lo que determina qué juez o tribunal tiene la competencia para investigar un delito es el lugar donde se ha cometido este hecho, pero que en el caso del procés de independencia de Catalunya "tenía un inconveniente no deseado": el juicio se tenía que celebrar en el Tribunal Superior de Justicia de Catalunya (TSJC), ubicado en Catalunya. "Esta eventualidad no era, por algún motivo, deseada. Y para ser evitada, exigía, de nuevo, un cambio de criterio. Un cambio nada fácil y por el cual había que disponer de un estómago jurídico muy resistente", afirma con ironía el juez.

Añade, con sorna, que "la fatalidad jurídica" ocurrió de nuevo: "Pasó a ser irrelevante que los hechos violentos del delito de rebelión se hubieran producido a Catalunya o que las decisiones parlamentarias clave se hubieran tomado en Barcelona (más concretamente, en la mesa del Parlamento, una mesa las cuatro o más patas de la cual, literalmente, descansan sobre suelo barcelonés)." La localización geográfica de estos dos hechos -precisa- dio paso a "hechos secundarios o a criterios jurídicos de cierta extravagancia que acudían desesperadamente al rescate para arrastrar el conocimiento del juicio a Madrid: una conferencia celebrada en el extranjero para hablar (sí, sólo para hablar) del proyecto de referéndum o una noción casi «moral» de España que permitiría entender que si los hechos afectaban a una de sus regiones, entonces se veía afectado todo el «territorio nacional» y, por lo tanto, había que llevar el juicio a la capital del reino."

Para rematarlo, el magistrado explica una realidad interna de los juzgados: "Habitualmente los tribunales no asumen más trabajo que el que les corresponde. Por lo tanto, hacerlo cuando es evidente que no hacía falta no deja de manifestar un cierto interés en conocer de la causa. Un interés, sin embargo, que, sea cuál sea, no parece demasiado compatible, como mínimo, con la necesaria imparcialidad (falta de interés, de cualquier interés) que tendría que guiar, en teoría, toda actuación judicial."

Ciertamente, el Tribunal Supremo asumió, de forma excepcional, la competencia para juzgar a los líderes independentistas catalanes y los condenó por sedición, malversación de fondos y desobediencia. El derecho a tener el juez predeterminado por la ley es una de las principales vulneraciones que los catalanes han presentado en sus demandas en el Tribunal Europeo de Derechos Humanos (TEDH) y uno de los motivos por los cuales ha sido denegada ya alguna orden europea de detención.

Los siete magistrados del Tribunal Supremo, presidido por Manuel Marchena, que juzgó a los independentistas catalanes, el 2019. / Foto: EFE

4a: euroórdenes de detención y retirada

La causa penal del procés independentista ha provocado una inmersión en el mundo judicial de gran parte de la sociedad catalana. En este caso, el juez Guillem Soler recuerda que una euroorden de detención la emite un tribunal de un Estado miembro de la Unión Europea hacia otro estado donde sabe que hay un investigado. Mientras no se resuelve el caso, el tribunal emisor espera cuál será la respuesta, que puede ser positiva o negativa. "Lo que no es nada habitual -afirma el juez Soler- es que el tribunal emisor retire la euroorden antes de que el receptor se pronuncie y que lo haga por temor que no sea aceptada íntegramente respecto de todos los delitos que se hayan podido cometer, como el de rebelión." El juez Soler manifiesta: "Para el lector no jurista esta puede parecer una incidencia menor, pero hay que destacar que pone de manifiesto una actuación judicial estratégica de nuevo escasamente compatible con la imprescindible imparcialidad judicial. Dicho de otra manera, una causa penal, si hay indicios, tiene que continuar adelante ininterrumpidamente, utilizando todos los mecanismos de investigación al alcance. Por el contrario, no puede operar como un badulaque al cual el tribunal puede acudir, cuando quiera, incluso los domingos, para comprar o comprar de nuevo lo que en cada momento le convenga más o para revender lo que ya no necesite." "Actuar así es, indudablemente, una excepcionalidad jurídica. Y de las más chillonas que se han visto", concluye.

Estas retiradas de órdenes de detención las ha acordado el juez instructor del Supremo en el caso del procés, Pablo Llarena.

El magistrado del Tribunnal Supremo, Pablo Llarena / Foto: Eduardo Parra / Europa Press

5a: una violencia no violenta para suspender cargos públicos

La quinta excepcionalidad jurídica habría sido asumida por la fiscalía, el instructor del Tribunal Supremo y el mismo tribunal sentenciador hasta antes de dictar sentencia, declara al magistrado Soler. Se refiere al hecho de que las acciones del otoño de 2017 fueran calificadas de violentas. "Se habló mucho de hasta qué punto era sorprendente que unos hechos en los cuales la policía ejerció violencia contra los ciudadanos pudieran ser interpretados como una violencia de los ciudadanos contra la policía", afirma Soler, que añade que "acudir a una interpretación tan extraña como esta era necesario para poder calificar los hechos como delito de rebelión, según la redacción del Código Penal, que exige la violencia".

El magistrado de Barcelona recuerda que "de repente, en la misma sentencia, parecía que se imponía el sentido común: los hechos no se consideraban ya constitutivos de rebelión (lo eran, sólo, de sedición), porque no estaba la necesaria violencia que exige aquel delito. ¿Y se pregunta cómo es que este planteamiento "expuesto de manera tan clara en la sentencia -en un solo párrafo bastante expeditivo- no lo habría podido seguir el tribunal también en fases anteriores del procedimiento, especialmente si tenemos en cuenta que los hechos eran desde un inicio notorios y conocidos por todo el mundo?" Y apunta a una posible respuesta: "Descubrimos que para poder suspender cautelarmente de sus cargos públicos a una parte de los acusados antes de dictarse sentencia condenatoria, hacía falta que el delito por el cual se seguía el procedimiento fuera de rebelión. Y para que fuera de rebelión había que sostener, aunque fuera provisionalmente, que los hechos eran violentos. Alguien podría especular que por eso se incurrió, estratégicamente, en esta nueva excepcionalidad jurídica". Y una vez condenados por sedición y ya en prisión, ya no había que forzar esta interpretación: "Que cada uno saque las conclusiones que le parezcan más pertinentes", indica Soler.

Abogados de los líderes independentistas catalanes, en el juicio en el Tribunal Supremo / Foto: EFE

6a: ahora los partidos pueden impugnar indultos

La sexta excepcionalidad jurídica planteada por el juez Soler está en un procedimiento contencioso administrativo actualmente abierto. El Gobierno concedió un indulto parcial a los nueve presos políticos catalanes el 22 de junio pasado, que les permitió salir de la prisión después de más de tres años encerrados. El cambio es que hasta ahora el Tribunal Supremo (TS) había considerado que los partidos políticos no tenían legitimación para poder instar la anulación de un indulto. Y de hecho inicialmente el tribunal rehusó sus recursos, pero no en el segundo recurso, con el cambio de uno de los magistrados del tribunal. "Después de un cambio providencial en la composición de la sala o sección que decidía, se ha invertido el criterio y se ha consagrado esta sexta excepcionalidad jurídica. Los argumentos, bastante técnicos, no dejan de remitirse a las especiales circunstancias del caso, por lo cual no dejan de corroborar que nos encontramos ante una «excepcionalidad jurídica», que, de nuevo, era necesaria para que pudiera continuar viva la eventualidad de que se anulen algún día estos indultos", sostiene Soler.

Los presos políticos hombres, al ser indultados, al salir la prisión de Lledoners / Foto: Sergi Alcazar

7a: el artículo 155 o la autocancelación de la Constitución


El magistrado Guillem Soler admite que "la gravedad de la situación en Catalunya en el 2017 podía justificar que el Gobierno acudiera a este mecanismo excepcional de intervención de una autonomía", que recoge el artículo 155. Afirma que en la decisión política no entra, pero que "el artículo 155 pueda habilitar medidas como las que se acordaron: cesar un gobierno autonómico, su sustitución por el gobierno central o disolver anticipadamente un Parlamento es, ya, claramente más dudoso". Y continúa: "Aceptarlo implica admitir una paradoja jurídica por medio de la cual un instrumento constitucional habilita la cancelación (la aniquilación) de la estructura institucional diseñada por la misma Constitución." Soler explica que había dos alternativas interpretativas para aplicar la intervención de Catalunya: la restrictiva y la expansiva. "Los genéricos términos del mismo artículo 155 no imponían ni excluían ninguna de las dos. La segunda era, evidentemente, mucho más funcional para quien tenía el poder de decisión. Y este optó por la segunda, la cual es, indudablemente, una excepcionalidad jurídica," señala.

Conmemoración de la República, en el Palau Generalitat. / Foto: Pau de la Calle

8a: investigaciones prospectivas o «catch-all»

En el ámbito penal, la investigación se tiene que referir a unos hechos concretos y dirigir contra unas personas determinadas. "Los hechos y las personas se pueden ir precisando progresivamente, pero siempre se mantiene un anhelo de concreción o restricción, por la sencilla razón que la existencia misma del procedimiento penal genera unos efectos, unos perjuicios, que hay que contener en la medida del posible", afirma el magistrado Soler, que, con sinceridad, razona: "No parece, sin embargo, que se haya seguido este criterio en algunas causas abiertas contra el movimiento catalán. Causas que se mantienen latentes en el tiempo. Siempre están abiertas y a disposición 24h/365 días, para permitir ir metiendo todo lo que convenga e ir adoptando, en su marco, las medidas restrictivas de derechos que se necesiten respecto de cualquier persona relacionada en algún grado con el Procés."

El juez Soler manifiesta que "hay más de una causa prospectiva abierta, de manera tal que se podrá escoger el tribunal a quien solicitar cada medida en función de las probabilidades que sea concedida. Sólo habrá que ajustar («afinar») la argumentación". Y reflexiona: "Seguro que a Carl Schmitt le parecería bien, este sistema de investigaciones penales catch-all. Pero ya es más dudoso que sea lo bastante respetuoso con una concepción democrática de la instrucción penal."

En esta octava excepción, el magistrado hace referencia, por ejemplo, al caso del juzgado de instrucción 13 de Barcelona, que asumió investigar las afirmaciones del entonces senador de ERC y magistrado Santi Vidal, en unas conferencias sobre el futuro de Catalunya. Primero en secreto investigó cargos del Govern y empresarios, y al final una treintena están procesados por organizar el 1-O.

El magistrado Santiago Vidal, ahora jubilado, al ir a declarar al juzgado por el 1-O / Foto: Gemma Liñan

9a: una inmunidad parlamentaria no inmune

El magistrado de Barcelona también califica de excepcionalidad jurídica lo que pasó en el Tribunal Supremo (TS) con el líder de ERC Oriol Junqueras. Relata que es sabido que el Tribunal de Justicia de la UE (TJUE) reconoció la inmunidad parlamentaria de Junqueras por su condición de miembro electo del Parlamento Europeo. "La resolución judicial europea tenía que implicar, en principio, levantar la medida de prisión preventiva y que el TS pidiera una autorización (un suplicatorio) en el Parlamento Europeo para poder continuar la causa", afirma el magistrado Soler, que comparte: "Así había sido entendida, siempre, la inmunidad parlamentaria en el marco de un procedimiento penal. Sólo una excepcionalidad jurídica técnicamente muy elaborada podía impedirlo. Parecía, también en este caso, inviable. Pero, de nuevo, ocurrió el milagro: razones temporales (el hecho de que la vista ya hubiera acabado y que la causa sólo estaba pendiente de dictarse sentencia) hacían innecesario, según el TS, respetar la inmunidad reconocida por el TJUE." Para Soler este planteamiento puede implicar "un vaciado sustancial de la garantía de la inmunidad parlamentaria", ya que Junqueras siguió en prisión preventiva y después fue condenado "sin que llegara a poder dar su opinión el Parlamento Europeo".

Oriol Junqueras en el acto de ERC en el primer año de los induts y con el lema 'Prou Repressió' / Foto: Sergi Alcàzar

10a: un tribunal legisla de facto sobre el catalán en las aulas

En la décima excepcionalidad, el juez de Barcelona nos informa de un tema bien actual y polémico. "Todos sabemos que los parlamentos aprueban las normas y que los tribunales las aplican e interpretan", declara, y que si los tribunales creen que no pueden aplicar las normas o tienen dudas de su constitucionalidad, pueden preguntarlo al Tribunal Constitucional. Los tribunales de la jurisdicción contencioso-administrativa, por su parte, controlan los actos administrativos de los gobiernos. Ahora bien, sostiene Soler, "lo que no pueden hacer ni hacen los tribunales, tampoco los del contencioso-administrativo, es crear normas. Bien, no lo pueden hacer a no ser que se trate de una nueva excepcionalidad jurídica".

El magistrado Soler hace referencia a la sentencia del TSJC que impone el 25% de castellano en todas las escuelas de Catalunya. "El TSJC ha acabado fijando directamente, como si de un legislador se tratara, el ya famoso 25% de castellano en las escuelas", afirma. El juez no quiere entrar en los detalles del caso e indica que el interés está en preguntarse "hasta qué punto es anómalo y excepcional que un tribunal fije, en una sentencia, cuál tiene que ser, en forma de porcentajes, el sistema educativo catalán con respecto al bilingüismo oficial, en unos términos que no están previstos en ninguna norma y que sólo tendría que poder fijar la instancia legislativa competente, en este caso el Parlamento de Catalunya". Asegura que "estamos, como mínimo, ante una extraña concepción de la separación de poderes". Además, añade una nueva, muy reciente, "excepcionalidad" o cambio de criterio, ya que ahora ha pasado a admitirse la legitimación de un solo padre para instar la ejecución de una sentencia que fija el sistema lingüísitc general en Catalunya.

Carteles en defensa del catalán en las escuelas del país / Foto: Archivo

¿Uno exposición del "derecho degenerado"?


El magistrado afirma que hay "muchas otras excepcionalidades jurídicas", como: las restricciones en el derecho de defensa durante el juicio del procés; las prisiones provisionales acordadas a raíz de las protestas por la sentencia del Supremo; las causas por terrorismo abiertas o mantenidas mucho tiempo "sobre la base de indicios que harían reír si no hicieran llorar", etc. E insiste en que "la velocidad con que se suceden estas excepcionalidades impide su asimilación. Uno queda aturdido, anestesiado. No hay margen para adquirir conciencia del alcance de su efecto acumulado."

Para no olvidar, Guillem Soler apunta que una manera de preservar la memoria histórica sobre estos hechos podría ser una "exposición amplia y exhaustiva, con textos, imágenes y vídeos, organizada en un museo o un espacio que ofreciera las condiciones de tranquilidad y distanciamiento adecuadas. Quizás así podría hacerse justicia a la explicación que merece esta parte de la historia de Catalunya", llena de excepcionalidades jurídicas desde 2017. Se pregunta si esta hipotética exposición tendría un "paralelismo invertido, claro está, con la que se hizo en Munich el año 1937, en el campo del arte, en los tiempos nacional-socialistas de Carl Schmitt: bajo el título «arte degenerado», se exhibieron las obras que no se ajustaban al nuevo canon estético nazi, entre otros, de autores como Kandinsky, Max Ernst o Schiele".

¿Y el título de la exposición? "Derecho degenerado. Degenerado respecto de lo que habíamos creído que era, hasta un momento determinado, el derecho". Y plantea hacerla itinerante, "que pudiera ser visitada, por ejemplo, en otros países de la Unión Europea". Recuerda que algunos tribunales de países europeos ya se han pronunciado sobre alguna de las excepcionalidades jurídicas que ha expuesto, y con humor asegura: "Si la exposición se celebrara en Schleswig-Holstein, el título de la exposición tendría que ser, indudablemente, entartete Rechts". Es decir, "derecho degenerado".

Los eurodiputados Carles Puigdemont, Clara Ponsati y Toni Comin / Foto: Europa Press

El tribunal Scheleswig-Holstein rehusó la entrega del presidente Puigdemont en el 2018 al considerar que los hechos recogidos en del delito de rebelión de la euroorden no son ningún delito en Alemania.

https://www.elnacional.cat/es/politica/10-excepcionalidades-juridicas-sufrido-catalunya-segunl-juez-guillem-soler_784374_102.html

"A los catalanes, una manta de palos." El concepte. El concepte espanyol. El concepte espanyol des de 1707

 

 

La situación en S-pain o Hispanistán como algunos la llamamos para no morir de depresión es insostenible para muchísimos ciudadanos Catalanes hoy en día. Desde todo el referendum "ilegal" y él " A por ellos" del 1 de Octubre de 2017, la situación sigue en escalada. El caso con Cataluña refleja problemáticas muy complejas. Todas están enraizadas en la continuidad del concepto de España re-actualizado desde la táctica absolutista Borbona. Leyes, miradas, propaganda, tácticas y estrategias. 

Hoy confluyen costrosas todas ellas ante la indiferencia constante de toda la europa falsamente anti-fascista. 

Saturday, 9 July 2022

Franco sigue montando a caballo en nueve lugares ocultos de España


La arquitecta Julia Schulz-Dornburg se pregunta “¿Dónde está Franco?” en un libro en el que presenta la búsqueda de los vestigios de la representación del dictador





La escultura de Franco en una base militar en Valencia, dentro de una caja de metal Julia Schulz-Dornburg


Ángeles Oliva
31 de enero de 2022 22:40h
Actualizado el 01/02/2022 15:30h


En octubre de 2016 un grupo de personas derribó una estatua de Franco en el barrio del Born en Barcelona. La escultura se había colocado cuatro días antes como parte de la exposición Franco, Victoria, República. Impunidad y espacio urbano. Junto a la de Franco, una escultura de la Victoria y otra de la República, situadas en la explanada delante de la exposición, buscaban reflexionar sobre la manipulación ideológica del espacio público. La estatua del dictador a caballo, que había sido decapitada mucho antes en circunstancias poco claras, estaba bajo el foco mediático antes de ser sacada del almacén donde se guardaba y fue vandalizada desde el primer momento de su instalación con pintura, huevos, y todo tipo de objetos, desde una muñeca hinchable a una cabeza de cerdo. Después de cuatro días de tensión creciente, un grupo de personas la derribó, y los selfies de la acción se compararon en redes sociales con el derrumbe de la estatua de Saddam Hussein en la Guerra del Golfo. Entonces, el Ayuntamiento de Barcelona decidió retirarla.

El Arco de la Victoria y otros grandes vestigios de la España de Franco que aún exaltan la dictadura
SABER MÁS


Esos días de violencia dejaron huella en Julia Schulz-Dornburg, arquitecta encargada de la puesta en escena de la exposición. Ella había sido la responsable de sacar las estatuas de los almacenes donde estaban y de colocarlas en la plaza. La conmoción que provocó la estatua del dictador la dejó impactada, y al finalizar la exposición, decidió recorrer el país con una cámara siguiendo las huellas de Franco que aún quedan escritas en el paisaje.
La estatua derribada en Barcelona Julia Schulz-Dornburg

La investigadora fue contactando, ciudad por ciudad, con los responsables de la custodia de las nueve estatuas ecuestres que quedaban de Franco, y les pidió verlas y hacerles fotos. Lo consiguió con cuatro de ellas. La vida de todas esas esculturas, por qué y cuándo se hicieron, qué edificios o calles habitaron y dónde se guardan ahora se cuenta en el libro ¿Dónde está Franco? (Tres Hermanas).
Estrategia disuasoria

No le costó mucho saber dónde estaban las nueve estatuas ecuestres del dictador, aunque no hay un registro donde esa información esté recopilada. El recorrido para fotografiarlas es una peripecia rocambolesca que la arquitecta ha recogido en un diario de viaje que a ratos recuerda al universo de Berlanga y que muestra la compleja relación que existe hoy con los vestigios de Franco.La estatua de Barcelona en 2018, empaquetada Julia Schulz-Dornburg

Tramitar los permisos para hacer las fotos fue una tarea compleja que le llevó más de un año. Se encontró, en todos los casos, con respuestas que suponían una cadena de consultas, gestiones y retrasos en los que, aunque nadie se negaba, se podía ver una clara incomodidad ante la petición y una estrategia disuasoria dirigida a agotar a quien quisiera ver las estatuas. Las distintas instituciones intentaban posponer la visita, alegando no ser los propietarios legales, comunicando que la escultura estaba cedida a otra organización, o que la persona responsable de dar el permiso estaba tan ocupada que nunca se podía contactar con ella. La mayoría de las veces, las comunicaciones fueron por teléfono en un intento, dice Julia Schulz-Dornburg, de no dejar las respuestas por escrito.
Franco en el jardín abandonado

El recorrido de la investigadora partió de Barcelona, visitando el almacén al que volvió la estatua derribada en el Born. Siguió en Toledo, donde no consiguió el permiso para ver la estatua de Franco que está en la Academia militar en la que él se formó y que utilizó presos republicanos para su construcción. Continuó hasta Zaragoza, donde la escultura de Franco realizada para reconocer su labor como director de la Academia Militar y que inicialmente se instaló en ella, ha acabado en los jardines de la Universidad Laboral, un complejo de edificios que se cerró en 1997 por aluminosis, y que es ahora un almacén de diversos objetos. En sus jardines, donde se entrenan los antidisturbios de la Policía Nacional y se han rodado series de televisión, fue colocada la estatua de Franco en 2006 al aire libre, hasta que alguien se quejó de su estado en una web franquista, y entonces la taparon con una estructura metálica y una tela verde. Después de varios intentos para conseguir el permiso para fotografiarla, Julia Schulz-Dornburg convenció al vigilante de seguridad de la Universidad, quien le dejó entrar diez minutos en el recinto, lo justo para meterse bajo la estructura y hacer unas fotos.La escultura de Santander, guardada en un almacén municipal entre coches oficiales Julia Schulz-Dornburg

La parada en Madrid es un agujero negro. A la investigadora le fue imposible saber cuál fue el destino de la estatua después de que la desmontaran de una zona céntrica de la capital en 2005. La Fundación Francisco Franco demandó entonces al Estado por su retirada, aunque el Tribunal Supremo desestimó la causa porque, en vista de la Ley de Memoria Histórica, no era posible su recolocación.

Las gestiones más fáciles para Julia Schulz-Dornburg fueron en Valencia, que fue la primera ciudad española en retirar una estatua del dictador del espacio público, en 1983. Aquella vez, las maniobras para moverla acabaron con la estatua rota y el busto de Franco colgado de la grúa con la cadena al cuello. Después de 27 años expuesta en la Capitanía General, la estatua se metió en una caja metálica y se llevó a la base militar de Bétera. Allí, en un almacén entre sacos de cemento y andamios, se abrió la caja delante de la arquitecta y de militares de élite europeos que nunca habían visto lo que había dentro.
La estatua más grande

Schulz-Dornburg pudo ver y hacerle fotos a la estatua que se guarda en Santander, aparcada en un almacén municipal entre coches oficiales. Pero no en la ciudad natal de Franco, Ferrol, donde está la estatua más grande. De siete toneladas de peso, el Ejército Guerrillero del Pueblo Gallego Libre detonó un explosivo contra ella en 1988 pero, aunque todos los cristales de la plaza en la que estaba se rompieron, la estatua no sufrió ni un rasguño. Es la única de todas que no se tapó cuando la sacaron de la plaza en 2002 y fue acompañada de unos mil seguidores hasta el Museo Naval donde se quedó hasta que fue retirada en aplicación de la Ley de Memoria Histórica. Yolanda Díaz, entonces portavoz de En Marea, planteó en 2017 una proposición para que la estatua fuera fundida y esculpir con ese bronce otra escultura homenaje a las víctimas de la represión franquista.La nave en Valencia, en la base militar de Bétera, en la que se guarda la estatua ecuestre de Franco, el día que la autora pudo visitarla Julia Schulz-Dornburg

La última de las estatuas de Franco se inauguró en Melilla en 1978, como homenaje de la Legión después de muerto el dictador. Fue financiada por Legionarios de honor y se expuso en el Acuartelamiento Millan Astray durante 32 años hasta que, en aplicación de la Ley de Memoria Histórica, tuvo que retirarse. Se trasladó entonces a la fundación de la empresa eléctrica Gaselec, cuyo presidente era legionario de honor, gracias a un convenio con el Ministerio de Defensa bajo mandato de Cospedal. Melilla fue la experiencia más frustrante para Julia Schulz-Dornburg, porque su petición de visitar la escultura fue muy bien recibida por los legionarios, pero finalmente le pidieron que dejara de preguntar por ella.

Tampoco pudo ver la estatua que se conserva en Segovia en los jardines de La Granja de San Ildefonso. Fue encargada por Carrero Blanco para celebrar los 50 años de la boda de Franco. Carrero iba a dar el visto bueno a la estatua cuando lo mataron en un atentado y la estatua nunca se exhibió en el espacio público.

Julia Schulz-Dornburg recuerda cómo “tras la Guerra Civil, el franquismo se lanzó a ocupar el espacio público con una política monumental que llenó pueblos y ciudades de estatuas del dictador, en un ejercicio de poder y propaganda”. También hubo imágenes alegóricas de la victoria y otras que glorificaban al alzamiento y los caídos, y el territorio se llenó de cruces. Con el fin del franquismo, “en el caso de los monumentos alegóricos, se ha optado por banalizarlos de alguna forma, o bien colocándolos en sitios poco visibles, como rotondas, o bien quitándoles referencias explícitas o desmembrándolas”, apunta la arquitecta a elDiario.es.
Un almacén en los jardines de la Universidad Laboral, en Zaragoza 2018 Julia Schulz-Dornburg

“Se las ha tuneado y hay millones que siguen instaladas por plazas y calles de todo el país. Pero el retrato del dictador tiene un peso tan potente que no puede desvincularse de su significado cuando, además, en este caso son figuras a caballo que expresan la victoria y el poder”. El periplo de la investigadora dibuja un mapa de la presencia del dictador en España y confirma que “Franco sigue entre nosotros. Está escondido, aguarda tapado, espera oculto, aparece decorado y duerme en una caja metálica”.

El viaje para buscarlo empezó en Barcelona, con la sorpresa de una reacción con la que ella no contaba. “El poder del símbolo, incluso descabezado, fue mucho más potente de lo que hubiera podido imaginar. Curiosamente, nadie atacó a la estatua de la Victoria, que en el fondo simboliza la caída de la Barcelona republicana y la proclamación del régimen franquista. Fue Franco quien acaparó toda la atención y la ira”, concluye.

Monday, 28 February 2022

Catalangate: Catalonia Spied by Spain at The New Yorker


How Democracies Spy on Their Citizens

The inside story of the world’s most notorious commercial spyware and the big tech companies waging war against it.

NSO Group’s software has been linked to repressive regimes, but now “all types of governments” use it, an observer said.Illustration by Timo Lenzen

The parliament of Catalonia, the autonomous region in Spain, sits on the edge of Barcelona’s Old City, in the remains of a fortified citadel constructed by King Philip V to monitor the restive local population. The citadel was built with forced labor from hundreds of Catalans, and its remaining structures and gardens are for many a reminder of oppression. Today, a majority of Catalan parliamentarians support independence for the region, which the Spanish government has deemed unconstitutional. In 2017, as Catalonia prepared for a referendum on independence, Spanish police arrested at least twelve separatist politicians. On the day of the referendum, which received the support of ninety percent of voters despite low turnout, police raids of polling stations injured hundreds of civilians. Leaders of the independence movement, some of whom live in exile across Europe, now meet in private and communicate through encrypted messaging platforms.

One afternoon last month, Jordi Solé, a pro-independence member of the European Parliament, met a digital-security researcher, Elies Campo, in one of the Catalan parliament’s ornate chambers. Solé, who is forty-five and wore a loose-fitting suit, handed over his cell phone, a silver iPhone 8 Plus. He had been getting suspicious texts and wanted to have the device analyzed. Campo, a soft-spoken thirty-eight-year-old with tousled dark hair, was born and raised in Catalonia and supports independence. He spent years working for WhatsApp and Telegram in San Francisco, but recently moved home. “I feel in a way it’s a kind of duty,” Campo told me. He now works as a fellow at the Citizen Lab, a research group based at the University of Toronto that focuses on high-tech human-rights abuses.



Campo collected records of Solé’s phone’s activity, including crashes it had experienced, then ran specialized software to search for spyware designed to operate invisibly. As they waited, Campo looked through the phone for evidence of attacks that take varied forms: some arrive through WhatsApp or as S.M.S. messages that seem to come from known contacts; some require a click on a link, and others operate with no action from the user. Campo identified an apparent notification from the Spanish government’s social-security agency which used the same format as links to malware that the Citizen Lab had found on other phones. “With this message, we have the proof that at some point you were attacked,” Campo explained. Soon, Solé’s phone vibrated. “This phone tested positive,” the screen read. Campo told Solé, “There’s two confirmed infections,” from June, 2020. “In those days, your device was infected—they took control of it and were on it probably for some hours. Downloading, listening, recording.”

Solé’s phone had been infected with Pegasus, a spyware technology designed by NSO Group, an Israeli firm, which can extract the contents of a phone, giving access to its texts and photographs, or activate its camera and microphone to provide real-time sur­veillance—exposing, say, confidential meetings. Pegasus is useful for law enforcement seeking criminals, or for authoritarians looking to quash dissent. Solé had been hacked in the weeks before he joined the European Parliament, replacing a colleague who had been imprisoned for pro-independence activities. “There’s been a clear political and judicial persecution of people and elected representatives,” Solé told me, “by using these dirty things, these dirty methodologies.”

In Catalonia, more than sixty phones—owned by Catalan politicians, lawyers, and activists in Spain and across Europe—have been targeted using Pegasus. This is the largest forensically documented cluster of such attacks and infections on record. Among the victims are three members of the European Parliament, including Solé. Catalan politicians believe that the likely perpetrators of the hacking campaign are Spanish officials, and the Citizen Lab’s analysis suggests that the Spanish government has used Pegasus. A former NSO employee confirmed that the company has an account in Spain. (Government agencies did not respond to requests for comment.) The results of the Citizen Lab’s investigation are being disclosed for the first time in this article. I spoke with more than forty of the targeted individuals, and the conversations revealed an atmosphere of paranoia and mistrust. Solé said, “That kind of surveillance in democratic countries and democratic states—I mean, it’s unbelievable.”


Commercial spyware has grown into an industry estimated to be worth twelve billion dollars. It is largely unregulated and increasingly controversial. In recent years, investigations by the Citizen Lab and Amnesty International have revealed the presence of Pegasus on the phones of politicians, activists, and dissidents under repressive regimes. An analysis by Forensic Architecture, a research group at the University of London, has linked Pegasus to three hundred acts of physical violence. It has been used to target members of Rwanda’s opposition party and journalists exposing corruption in El Salvador. In Mexico, it appeared on the phones of several people close to the reporter Javier Valdez Cárdenas, who was murdered after investigating drug cartels. Around the time that Prince Mohammed bin Salman of Saudi Arabia approved the murder of the journalist Jamal Khashoggi, a longtime critic, Pegasus was allegedly used to monitor phones belonging to Khashoggi’s associates, possibly facilitating the killing, in 2018. (Bin Salman has denied involvement, and NSO said, in a statement, “Our technology was not associated in any way with the heinous murder.”) Further reporting through a collaboration of news outlets known as the Pegasus Project has reinforced the links between NSO Group and anti-­democratic states. But there is evidence that Pegasus is being used in at least forty-five countries, and it and similar tools have been purchased by law-­enforcement agencies in the United States and across Europe. Cristin Flynn Goodwin, a Microsoft executive who has led the company’s efforts to fight spyware, told me, “The big, dirty secret is that governments are buying this stuff—not just authoritarian governments but all types of governments.”

NSO Group is perhaps the most successful, controversial, and influential firm in a generation of Israeli startups that have made the country the center of the spyware industry. I first interviewed Shalev Hulio, NSO Group’s C.E.O., in 2019, and since then I have had access to NSO Group’s staff, offices, and technology. The company is in a state of contradiction and crisis. Its programmers speak with pride about the use of their software in criminal investigations—NSO claims that Pegasus is sold only to law-enforcement and intelligence agencies—but also of the illicit thrill of compromising technology platforms. The company has been valued at more than a billion dollars. But now it is contending with debt, battling an array of corporate backers, and, according to industry observers, faltering in its long-standing efforts to sell its products to U.S. law enforcement, in part through an American branch, Westbridge Technologies. It also faces numerous lawsuits in many countries, brought by Meta (formerly Facebook), by Apple, and by individuals who have been hacked by NSO. The company said in its statement that it had been “targeted by a number of politically motivated advocacy organizations, many with well-known anti-Israel biases,” and added that “we have repeatedly cooperated with governmental investigations, where credible allegations merit, and have learned from each of these findings and reports, and improved the safeguards in our technologies.” Hulio told me, “I never imagined in my life that this company would be so famous. . . . I never imagined that we would be so successful.” He paused. “And I never imagined that it would be so controversial.”

Hulio, who is forty, has a lumbering gait and pudgy features. He typically wears loose T-shirts and jeans, with his hair in a utilitarian buzz cut. Last month, I visited him at his duplex in a luxury high-rise in Park Tzameret, the fanciest neighborhood in Tel Aviv. He lives with his three small children and his wife, Avital, who is expecting a fourth. There’s a pool on the upper level of Hulio’s apartment, and downstairs, in the double-height living room, is a custom arcade cabinet stocked with retro games and bearing a cartoon portrait of him, wearing shades, next to the word “Hulio” in large eight-bit font. Avital attends to the children, frequent renovations, and an ever-shifting array of pets: rabbits remain, a parrot does not. The family has a teacup poodle named Marshmallow Rainbow Sprinkle.

Hulio, Omri Lavie, and Niv Karmi founded NSO Group in 2010, creating its name from the first letters of their names and renting space in a converted chicken coop on a kibbutz. The company now has some eight hundred employees, and its technology has become a leading tool of state-sponsored hacking, instrumental in the fight among great powers.



“Your résumé looks terrific, but I’m just not sure we can deal with the shedding.”

Cartoon by Elisabeth McNair

The Citizen Lab’s researchers concluded that, on July 7, 2020, Pegasus was used to infect a device connected to the network at 10 Downing Street, the office of Boris Johnson, the Prime Minister of the United Kingdom. A government official confirmed to me that the network was compromised, without specifying the spyware used. “When we found the No. 10 case, my jaw dropped,” John Scott-Railton, a senior researcher at the Citizen Lab, recalled. “We suspect this included the exfiltration of data,” Bill Marczak, another senior researcher there, added. The official told me that the National Cyber Security Centre, a branch of British intelligence, tested several phones at Downing Street, including Johnson’s. It was difficult to conduct a thorough search of phones—“It’s a bloody hard job,” the official said—and the agency was unable to locate the infected device. The nature of any data that may have been taken was never determined.


The Citizen Lab suspects, based on the servers to which the data were transmitted, that the United Arab Emirates was likely behind the hack. “I’d thought that the U.S., U.K., and other top-tier cyber powers were moving slowly on Pegasus because it wasn’t a direct threat to their national security,” Scott-­Railton said. “I realized I was mistaken: even the U.K. was underestimating the threat from Pegasus, and had just been spectacularly burned.” The U.A.E. did not respond to multiple requests for comment, and NSO employees told me that the company was unaware of the hack. One of them said, “We hear about every, every phone call that is being hacked over the globe, we get a report immediately”—a statement that contradicts the company’s frequent arguments that it has little insight into its customers’ activities. In its statement, the company added, “Information raised in the inquiry indicates that these allegations are, yet again, false and could not be related to NSO products for technological and contractual reasons.”


According to an analysis by the Citizen Lab, phones connected to the Foreign Office were hacked using Pegasus on at least five occasions, from July, 2020, through June, 2021. The government official confirmed that indications of hacking had been uncovered. According to the Citizen Lab, the destination servers suggested that the attacks were initiated by states including the U.A.E., India, and Cyprus. (Officials in India and Cyprus did not respond to requests for comment.) About a year after the Downing Street hack, a British court revealed that the U.A.E. had used Pegasus to spy on Princess Haya, the ex-wife of Sheikh Mohammed bin Rashid al-Maktoum, the ruler of Dubai, one of the Emirates. Maktoum was engaged in a custody dispute with Haya, who had fled with their two children to the U.K. Her attorneys, who are British, were also targeted. A source directly involved told me that a whistle-blower contacted NSO to alert it to the cyberattack on Haya. The company enlisted Cherie Blair, the wife of former Prime Minister Tony Blair and an adviser to NSO, to notify Haya’s attorneys. “We alerted everyone in time,” Hulio told me. Soon afterward, the U.A.E. shut down its Pegasus system, and NSO announced that it would prevent its software from targeting U.K. phone numbers, as it has long done for U.S. ­numbers.

Elsewhere in Europe, Pegasus has filled a need for law-enforcement agencies that previously had limited cyber-intelligence capacity. “Almost all governments in Europe are using our tools,” Hulio told me. A former senior Israeli intelligence official added, “NSO has a monopoly in Europe.” German, Polish, and Hungarian authorities have admitted to using Pegasus. Belgian law enforcement uses it, too, though it won’t admit it. (A spokesperson for the Belgian federal police said that it respects “a legal framework as to the use of intrusive methods in private life.”) A senior European law-enforcement official whose agency uses Pegasus said that it gave an inside look at criminal organizations: “When do they want to store the gas, to go to the place, to put the explosive?” He said that his agency uses Pegasus only as a last resort, with court approval, but conceded, “It’s like a weapon. . . . It can always occur that an individual uses it in the wrong way.”

The United States has been both a consumer and a victim of this tech­nology. Although the National Security Agency and the C.I.A. have their own surveillance technology, other government offices, including in the military and in the Department of Justice, have bought spyware from private companies, according to people involved in those transactions. The Times has reported that the F.B.I. purchased and tested a Pegasus system in 2019, but the agency denied deploying the technology.


Establishing strict rules about who can use commercial spyware is com­plicated by the fact that such technology is offered as a tool of diplomacy. The results can be chaotic. The Times has reported that the C.I.A. paid for Djibouti to acquire Pegasus, as a way to fight terrorism. According to a previously unreported investigation by WhatsApp, the technology was also used against members of Djibouti’s own government, including its Prime Minister, Abdoulkadar Kamil Mohamed, and its Minister of the Interior, Hassan Omar.

Last year, as the Washington Post reported and Apple disclosed in a legal filing, the iPhones of eleven people working for the U.S. government abroad, many of them at its embassy in Uganda, were hacked using Pegasus. NSO Group said that, “following a media inquiry” about the incident, the company “immediately shut down all the customers potentially relevant to this case, due to the severity of the allegations, and even before we began the investigation.” The Biden Administration is investigating additional targeting of U.S. officials, and has launched a review of the threats posed by foreign commercial hacking tools. Administration officials told me that they now plan to take new, aggressive steps. The most significant is “a ban on U.S. government purchase or use of foreign commercial spyware that poses counterintelligence and security risks for the U.S. government or has been improperly used abroad,” Adrienne Watson, a White House spokesperson, said.

In November, the Commerce Department added NSO Group, along with several other spyware makers, to a list of entities blocked from purchasing technology from American companies without a license.

I was with Hulio in New York the next day. NSO could no longer legally buy Windows operating systems, iPhones, Amazon cloud servers—the kinds of products it uses to run its business and build its spyware. “It’s outrageous,” he told me.“We never sold to any country which is not an ally with the U.S., or an ally of Israel. We’ve never sold to any country the U.S. doesn’t do business with.” Deals with foreign clients require “direct written approval from the government of Israel,” Hulio said.

“I think that it is not well understood by American leaders,” Eva Gal­perin, the director of cybersecurity at the watchdog group Electronic Frontier Foundation, told me. “They keep expecting that the Israeli government will crack down on NSO for this, whereas, in fact, they’re doing the Israeli government’s bidding.” Last month, the Washington Post reported that Israel had blocked Ukraine from purchasing Pegasus, not wanting to alienate Russia. “Everything that we are doing, we got the permission from the government of Israel,” Hulio told me. “The entire mechanism of regulation in Israel was built by the Americans.”

NSO sees itself as a type of arms dealer, operating in a field without established norms. Hulio said, “There is the Geneva Conventions for the use of a weapon. I truly believe that there should be a convention of countries that should agree between themselves on the proper use of such tools” for cyber warfare. In the absence of international regulation, a battle is taking place between private companies: on one side, firms like NSO; on the other, the major technology platforms through which such firms implement their spyware.

On Thursday, May 2, 2019, Claudiu Dan Gheorghe, a software engineer, was working at Building 10 on Facebook’s campus in Menlo Park, where he managed a team of seven people responsible for WhatsApp’s voice- and video-calling infrastructure. Gheorghe, who was born in Romania, is thirty-five, with a slight frame and dark, close-cropped hair. In a photograph he used as a professional head shot during his nine years at Facebook, he wears a black hoodie and looks a little like Elliot Alderson, the protagonist of the hacking drama “Mr. Robot.” Building 10 is a two-story structure with open-plan workspaces, brightly colored accent walls, and whiteboards. Engineers, most of them in their twenties and thirties, hunch over keyboards. The word “focus” is written on a wall and stamped on magnets scattered around the office. “It often felt like a church,” Gheorghe recalled. WhatsApp, which Facebook bought for nineteen billion dollars in 2014, is the world’s most popular messaging application, with about two billion monthly users.

Facebook had presented the platform, which uses end-to-end encryption, as ideal for sensitive communications; now the company’s security team was more than two years into an effort to reinforce the security of its products. One task entailed looking at “signalling messages” automatically sent by Whats­App users to the company’s servers, in order to initiate calls. That evening, Gheorghe was alerted to an unusual signalling message. A piece of code that was intended to dictate the ringtone contained, instead, code with strange instructions for the recipient’s phone.


In a system as vast as Facebook’s, anomalies were routine, and usually innocuous. Unfamiliar code can stem from an older version of the software, or it can be a stress test by Facebook’s Red Team, which conducts simulated attacks. But, as engineers in Facebook’s international offices awoke and began to scrutinize the code, they grew concerned. Otto Ebeling, who worked on Facebook’s security team in London, told me that the code seemed “polished, slick, which was alarming.” Early on the morning after the message was discovered, Joaquin Moreno Garijo, another member of the London security team, wrote on the company’s internal messaging system that, owing to how sophisticated the code was, “we believe that attacker may have found a vulnerability.” Programmers who work on security issues often describe their work in terms of vulnerabilities and exploits. Ivan Krstić, an engineer at Apple, compared the concept to a heist scene in the film “Ocean’s Twelve,” in which a character dances through a hall filled with lasers that trigger alarms. “In that scene, the vulnerability is that there exists a path through all the lasers, where it’s possible to get across the room,” Krstić said. “But the exploit is that somebody had to be a precise enough dancer to actually be able to do that dance.”


By late Sunday, a group of engineers working on the problem had become convinced that the code was an active exploit, one that was attacking vulnerabilities in their infrastructure as they watched. They could see that data were being copied from users’ phones. “It was scary,” Gheorghe recalled. “Like the world is sort of shaking under you, because you built this thing, and it’s used by so many people, but it has this massive flaw in it.”

The engineers quickly identified ways to block the offending code, but they debated whether to do so. Blocking access would tip off the attackers, and perhaps allow them to erase their tracks before the engineers could make sure that any solution closed all possible avenues of attack. “That would be like chasing ghosts,” Ebeling said. “Made a decision to not roll out the server-side fix,” Andrey Labunets, a WhatsApp security engineer, wrote, in an internal message, “because we don’t understand the root cause the impact for users and other possible attacker numbers / techniques.”

On Monday, at crisis meetings with WhatsApp’s top executive, Will Cathcart, and Facebook’s head of security, the company told its engineers around the world that they had forty-eight hours to investigate the problem. “What would the scale of the victims be?” Cathcart recalled worrying. “I mean, how many people were hit by this?” The company’s leadership decided not to notify law enforcement immediately, fearing that U.S. officials might tip off the hackers. “There’s a risk of—you might go to someone who’s a customer,” he told me. (Their concerns were valid: weeks later, the Times has reported, the F.B.I. hosted NSO engineers at a facility in New Jersey, where the agency tested the Pegasus software it had purchased.) Cathcart alerted Mark Zuckerberg, who considered the problem “horrific,” Cathcart recalled, and pressed the team to work quickly. For Gheorghe, “it was a terrifying Monday. I woke up at like 6 a.m., and then I worked until I couldn’t stay awake anymore.”

NSO’s headquarters are in a glass-and-steel office building in Herzliya, a suburb outside Tel Aviv. The area is home to a cluster of technology firms from Israel’s thriving startup sector. The beach is a twenty-minute walk away. The world’s most notorious commercial hacking enterprise is remarkably unprotected: at times, a single security guard waved me through.




Cartoon by Tim Hamilton

On the building’s fourteenth floor, programmers wearing hoodies gather in a cafeteria outfitted with an espresso machine and an orange juicer, or sit on a terrace with views of the Mediterranean. A poster reads “life was much easier when apple and blackberry were just fruits.” Stairs descend to the various programming groups, each of which has its own recreational space, with couches and PlayStation 5s. The Pegasus team likes to play Electronic Arts’ football game, fifa.

Employees told me that the ­company keeps its technology covert through an information-security department with several dozen experts. “There is a very large department in the company which is in charge of whitewashing, I would say, all connection, all network connection between the client back to NSO,” a former employee said. “They are purchasing servers, V.P.N. servers around the world. They have, like, this whole infrastructure set up so none of the communication can be traced.”

Despite these precautions, Whats­App engineers managed to trace data from the hack to I.P. addresses tied to properties and Web services used by NSO. “We now knew that one of the biggest threat actors in the world has a live exploit against WhatsApp,” Gheorghe recalled. “I mean, it was exciting, because it’s very rare to catch some of these things. But, at the same time, it was also extremely scary.” A picture of the victims began to emerge. “Likely there are journalists human rights activists and others on the list,” Labunets, the security engineer, wrote on the company’s messaging system. (Eventually, the team identified some fourteen hundred WhatsApp users who had been targeted.)

By midweek, about thirty people were working on the problem, operating in a twenty-four-hour relay, with one group going to sleep as another came online. Facebook extended the team’s deadline, and they began to reverse engineer the malicious code. “To be honest, it’s brilliant. I mean, when you look at it, it feels like magic,” Gheorghe said. “These people are very smart,” he added. “I don’t agree with what they do, but, man, that is a very complicated thing they built.” The exploit triggered two video calls in close succession, one joining the other, with the malicious code hidden in their settings. The process took only a few seconds, and deleted any notifications immediately afterward. The code used a technique known as a “buffer overflow,” in which an area of memory on a device is overloaded with more data than it can accommodate. “It’s like you’re writing on a piece of paper and you go beyond the bounds,” Gheorghe explained. “You start writing on whatever the surface is, right? You start writing on the desk.” The overflow allows the software to overwrite surrounding sections of memory freely. “You can make it do whatever you want.”


I spoke with a vice-president for product development at NSO, whom the firm requested I identify only by his first name, Omer—citing, without apparent irony, privacy concerns. “You find the nooks and crannies enabling you to do something that the product designer didn’t intend,” Omer told me. Once in control, the exploit loaded more software, allowing the attacker to extract data or activate a camera or a microphone. The entire process was “zero click,” requiring no action from the phone’s owner.


The software was designed by NSO’s Core Research Group, made up of several dozen software developers. “You’re looking for a silver bullet, a simple exploit that can cover as much mobile devices around the world,” Omer told me. Gheorghe said, “A lot of people, you know, would think about the hackers as being, like, just one person in a dark room, like, typing on a keyboard, right? That’s not the reality—these people are just, like, another tech company.” It is common for tech companies to hire people with backgrounds in hacking, and to offer bounties to outside programmers who identify vulnerabilities in their systems. Facebook’s headquarters have the vanity address 1 Hacker Way. At both NSO and WhatsApp, the engineers closest to the coding are often described by colleagues as quirky introverts, resembling the hacker archetypes of fiction. “They are special people. Not all of them can communicate clearly with other human beings,” Omer said, of the programmers who work on Pegasus. “Some of them don’t sleep for two days. They get crazy when they don’t sleep.”

Late in the week, Facebook’s security team devised an act of subterfuge: they would simulate an infected device, to get NSO’s servers to send them a copy of the code. “But their software was smart enough to basically not be tricked by this,” Gheorghe said. “We never really were able to get our hands on that.”

Omer told me, “It’s a cat-and-mouse game.” Although NSO says that its customers control the use of Pegasus, it does not dispute its direct role in these exchanges. “Every day, things are being patched,” Hulio said. “This is the routine work here.”

At times, WhatsApp users received repeated missed calls, but the malware wasn’t successfully installed. Once the engineers learned about these incidents, they were able to study what it looked like when Pegasus failed. Toward the end of the week, Gheorghe told me, “we said, O.K., we don’t have a full understanding at this point, but I think we captured enough.” On Friday morning, Facebook notified the Department of Justice, which is developing a case against NSO. Then the company updated its servers to block the malicious code. “Ready to roll,” Gheorghe wrote on the internal messaging service that afternoon. The fix was constructed to look like routine server maintenance, so that NSO might continue to attempt attacks, providing Facebook with more data.

The next day, WhatsApp engineers said, NSO began to send what looked like decoy data packets, which they speculated were a way to determine whether NSO’s activities were being watched. “In one of the malicious packets, they actually sent a YouTube link,” Gheorghe told me. “We were all laughing like crazy when we saw what it was.” The link was to the music video for the Rick Astley song “Never Gonna Give You Up,” from 1987. Ambushing people with a link to the song is a popular trolling tactic known as Rickrolling. Otto Ebeling recalled, “Rickrolling is, I don’t know, something my colleague might do to me, not some sort of semi-state-sponsored people.” Cathcart told me, “There was a message in it. They were saying, We know what you did, we see you.” (Hulio and other NSO employees said they could not recall Rickrolling WhatsApp.)

In the months that followed, WhatsApp began notifying users who had been targeted. The list included numerous government officials, including at least one French ambassador and the Djiboutian Prime Minister. “There wasn’t, you know, overlap between this list and, like, legitimate law-enforcement outreach,” Cathcart said. “You could see, wow, there’s a lot of countries all around the world. This isn’t just one agency or organization in one country targeting people.” WhatsApp also began working with the Citizen Lab, which warned victims of the risk that they might be hacked again, and helped them secure their devices. John Scott-­Railton said, “It really was interesting how many people were upset and saddened, but in a deep way not surprised, almost relieved, as if they were getting a diagnosis for a mystery ailment they had suffered for many years.”

Five people in the initial group identified by WhatsApp were Catalans, including elected lawmakers and an activist. Campo, the Catalan security researcher, realized that the cases “were probably just the tip of the iceberg.” He added, “That’s when I found ­myself in the intersection of tech­nology—­a product that I contributed to building—and my home country.”

WhatsApp continued sharing information with the Department of Justice, and, that fall, the company sued NSO in federal court. NSO Group “breached our systems, damaged us,” Cathcart told me. “I mean, do you just do nothing about that? No. There have to be consequences.”

Hulio said, “I just remember that one day the lawsuit happened, and they shut down the Facebook account of our employees, which was a very bully move for them to do.” He added, referring to scandals about Facebook’s role in society, “I think it’s a big hypocrisy.” NSO has pushed for the suit to be dismissed, arguing that the company’s work on behalf of governments should grant it the same immunity from lawsuits that those governments have. So far, the U.S. courts have rejected this argument.

WhatsApp’s aggressive posture was unusual among big technology companies, which are often reluctant to call attention to instances in which their systems have been compromised. The lawsuit signalled a shift. The tech companies were now openly aligned against the spyware venders. Gheorghe described it as “the moment the whole thing just exploded.”

Microsoft, Google, Cisco, and others filed a legal brief in support of WhatsApp’s suit. Goodwin, the Microsoft executive, helped to assemble the coalition of companies. “We could not let NSO Group prevail with an argument that, simply because a government is using your products and services, you get sovereign immunity,” she told me. “The ripple effect of that would have been so dangerous.” Hulio argues that when governments use Pegasus they’re less likely to lean on platform holders for wider “back door” access to users’ data. He expressed exasperation with the lawsuit. “Instead of them, like, actually saying, ‘O.K., thank you,’ ” he told me, “they are going to sue us. Fine, so let’s meet in court.”


Microsoft, too, has a security team that engages in combat with hackers. Although Pegasus is not designed to target users through Microsoft platforms, at least four people in Catalonia running Microsoft Windows on their computers have been attacked by spyware made by Candiru, a startup founded by former NSO employees. (A spokesperson for Candiru said that it requires its products to be used for the “sole purpose of preventing crime and terror.”) In February, 2021, the Citizen Lab identified evidence of an active infection—a rarity for spyware of this calibre—on a laptop belonging to Joan Matamala, an activist closely connected to separatist politicians. Campo called Matamala and instructed him to wrap the laptop in aluminum foil, a makeshift way of blocking the malware from communicating with servers. The Citizen Lab was able to extract a copy of the spyware, which Microsoft dubbed DevilsTongue. Several months later, Microsoft released updates blocking DevilsTongue and preventing future attacks. By then, the list of activists and journalists targeted “made the hairs on the back of our neck stand on end,” Goodwin said. Matamala has been targeted more than sixteen times. “I still have the aluminum paper stored here, in case we ever have a suspicion of having another infection,” he told me.


Last November, after iPhone users were allegedly targeted by NSO, Apple filed its own lawsuit. NSO has filed a motion to dismiss. “Apple is a company that does not believe in theatrical lawsuits,” Ivan Krstić, the engineer, told me. “We have this entire time been waiting for a smoking gun that would let us go file a suit that is winnable.”



“You still have to choose which chef you want to prepare your food.”
Cartoon by Frank Cotham

Apple created a threat-intelligence team nearly four years ago. Two Apple employees involved in the work told me that it was a response to the spread of spyware, exemplified by NSO Group. “NSO is a big pain point,” one of the employees told me. “Even before the stuff that hit the news, we had disrupted NSO a number of times.” In 2020, with the launch of its iOS 14 software, Apple had introduced a system called BlastDoor, which moved the processing of iMessages—including any potentially malicious code—into a chamber connected to the rest of the operating system by only a single, narrow pipeline of data. But Omer, the NSO V.P., told me that “newer features usually have some holes in their armor,” making them “more easy to target.” Krstić conceded that there was “a sort of an eye of a needle of an opening still left.”

In March, 2021, Apple’s security team received a tip that a hacker had successfully threaded that needle. Even cyber warfare has double agents. A person familiar with Apple’s threat-intelligence capabilities said that the company’s team sometimes receives tips from informants connected to spyware enterprises: “We’ve spent a long time and a lot of effort in trying to get to a place where we can actually learn something about what’s going on deeply behind the scenes at some of these companies.” (An Apple spokesperson said that Apple does not “run sources” within spyware companies.) The spyware venders, too, rely on intelligence gathering, such as securing pre-release versions of software, which they use to design their next attacks. “We follow the publications, we follow the beta versions of whatever apps we’re targeting,” Omer told me.

That month, researchers from the Citizen Lab contacted Apple: the phone of a Saudi women’s-rights activist, Loujain al-Hathloul, had been hacked through iMessage. Later, the Citizen Lab was able to send Apple a copy of an exploit, which the researcher Bill Marczak discovered after months of scrutinizing Hathloul’s phone, buried in an image file. The person familiar with Apple’s threat-intelligence ca­pabilities said that receiving the file, through an encrypted digital channel, was “sort of like getting a thing handed to you in a biohazard bag, which says, ‘Do not open except in a Biosafety Level 4 lab.’ ”

Apple’s investigation took a week and involved several dozen engineers based in the United States and Europe. The company concluded that NSO had injected malicious code into files in Adobe’s PDF format. It then tricked a system in iMessage into accepting and processing the PDFs outside BlastDoor. “It’s borderline science fiction,” the person familiar with Apple’s threat-intelligence capabilities said. “When you read the analysis, it’s hard to believe.” Google’s security-­research team, Project Zero, also studied a copy of the exploit, and later wrote in a blog post, “We assess this to be one of the most technically sophisticated exploits we’ve ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.” In the NSO offices, programmers in the Core Research Group printed a copy of the post and hung it on the wall.

Apple shipped updates for its platforms that rendered the exploit useless. Krstić told me that this was “a massive point of pride” for the team. But Omer told me, “We saw it coming. We just counted the days until it happened.” He and others at the company said the next exploit is an inevitability. “There might be some gaps. It could take two weeks to come up with a mitigation on our side, some work-around.”

During interviews in NSO’s offices last month, employees exchanged nervous glances with hovering public-relations staffers as they answered questions about morale in the midst of the scandals, lawsuits, and blacklisting. “To be honest, not every time the mood is actually good,” Omer said. Others claimed loyalty to the company and belief in the power of its tools to catch criminals. “The company has a very strong narrative that it tries to sell internally to the employees,” the former employee told me. “You’re either with them or against them.”

Israel has become the world’s most significant source of private surveillance technology in part because of the quality of talent and expertise produced by its military. “Because of the compulsory service, we can recruit the best of the best,” the former senior intelligence official told me. “The American dream is going from M.I.T. to Google. The Israeli dream is to go to 8200,” the Israeli military-intelligence unit from which spyware venders often recruit. (Hulio, who describes himself as a mediocre student whose upbringing was “nothing fancy,” often emphasizes that he did not serve in Unit 8200.) NSO has historically been regarded as an appealing job prospect for young veterans. But the former NSO employee, who quit after becoming concerned that Pegasus had facilitated Jamal Khashoggi’s murder, told me that others had become disillusioned, too. “Many of my colleagues decided to leave the company at that stage,” the former employee said. “This was one of the major events that I think caused many of the employees to, like, wake up and understand what’s going on.” In the past few years, the departures have been “like a snowball.” Hulio, in response to questions about the company’s problems, said, “What worries me is the vibes of the employees.”


In 2019, NSO was saddled with hundreds of millions of dollars in debt as part of a leveraged-buyout deal in which a London-based private-equity firm, Novalpina, acquired a seventy-per-cent stake. Recently, Moody’s, the financial-services firm, downgraded NSO’s credit rating to “poor,” and Bloomberg described it as a distressed asset, shunned by Wall Street traders. Two top NSO executives have left, and relations between the company and its backers have deteriorated. Infighting among Novalpina’s partners led to the transfer of control of its assets, including NSO, to a consulting firm, Berkeley Research Group, which pledged to increase oversight. But a BRG executive recently claimed that coöperation with Hulio had become “virtually non-existent.” Agence France-Presse has reported that tensions emerged because NSO’s creditors have pressed for continued sales to countries with dubious human-rights records, while BRG has sought to pause them. “We indeed have some disputes with them,” Hulio said, of BRG. “It’s about how to run the business.”

NSO’s troubles have complicated its close alliance with the Israeli state. The former senior intelligence official recalled that, in the past, when his unit turned down European countries seeking intelligence collaboration, “Mossad said, Here’s the next best thing, NSO Group.” Several people familiar with those deals said that Israeli authorities provided little ethical guidance or restraint. The former official added, “Israeli export control was not dealing with ethics. It was dealing with two things. One, Israeli national interest. Two, reputation.” The former NSO employee said that the state “was well aware of the misuse, and even using it as part of its own diplomatic relationships.” (Israel’s Ministry of Defense said in a statement that “each licensing assessment is made in light of various considerations including the security clearance of the product and assessment of the country toward which the product will be marketed. Human rights, policy, and security issues are all taken into consideration.”) After the blacklisting of NSO, Hulio sought to enlist Israeli officials, including Prime Minister Naftali Bennett and Defense Minister Benny Gantz. “I sent a letter,” he told me. “I said that as a regulated company, you know, everything that we have ever asked was with the permission, and with the authority, of the government of Israel.” But a senior Biden Administration official said that the Israelis raised only “pretty mild complaints” about the blacklisting. “They didn’t like it, but we didn’t have a standoff.”


In Israel’s legislature, Arab politicians are leading a modest movement to examine the state’s relationship with NSO. The Arab party leader Sami Abou Shahadeh told me, “We tried to discuss this in the Knesset twice . . . to tell the Israeli politicians, You are selling death to very weak societies that are in conflict, and you’ve been doing this for too long.” He added, “It never worked, because, first and morally, they don’t see any problem with that.” Last fall, an investigation by the watchdog group Front Line Defenders identified Pegasus infections on the phones of six Palestinian activists—including one whose Jerusalem residency status had been revoked. Abou Shahadeh argued that the history of Israel’s spyware technology is tied to the surveillance of Palestinian communities in the West Bank, East Jerusalem, and Gaza. “They have a huge laboratory,” he told me. “When they were using all the same tools for a long time to spy on Palestinian citizens, nobody cared.” Asked about the targeting of Palestinians, Hulio said, “If Israel is using our tools to fight crime and terror, I would be very proud of it.”

“Iknow there have been misuses,” Hulio said. “It’s hard for me to live with that. And I obviously feel sorry for that. Really, I’m not just saying that. I never said it, but I’m saying it now.” Hulio said that the company has turned down ninety customers and hundreds of millions of dollars of business out of concern about the potential for abuse. But such claims are difficult to verify. “NSO wanted Western Europe mainly so they can tell guys like you, Here’s a European example,” the former Israeli intelligence official, who now works in the spyware sector, said. “But most of their business is sub­sidized by the Saudi Arabias of the world.” The former employee, who had knowledge of NSO’s sales efforts, said, “For a European country, they would charge ten million dollars. And for a country in the Middle East they could charge, like, two hundred and fifty million for the same product.” This seemed to create perverse incentives: “When they understood that they had misuse in those countries that they sold to for enormous amounts of money, then the decision to shut down the service for that specific country became much, much harder.”

Asked about the extreme abuses ascribed to his technology, Hulio invoked an argument that is at the heart of his company’s defense against WhatsApp and Apple. “We have no access to the data on the system,” he told me. “We don’t take part in the operation, we don’t see what the customers are doing. We have no way of monitoring it.” When a client buys Pegasus, company officials said, an NSO team travels to install two racks, one devoted to storage and another for operating the software. The system then runs with only limited connection to NSO in Israel.

But NSO engineers concede that there is some real-time monitoring of systems to prevent unauthorized tampering with or theft of their technology. And the former employee said, of Hulio’s assurances that NSO is technically prevented from overseeing the system, “That’s a lie.” The former employee recalled support and maintenance efforts that involved remote access by NSO, with the customer’s permission and live oversight. “There is remote access,” the former employee added. “They can see everything that goes on. They have access to the database, they have access to all of the data.” The senior European law-enforcement official told me, “They can have remote access to the system when we authorize them to access the system.”

NSO executives argue that, in an unregulated field, they are attempting to construct guardrails. They have touted their appointment of a compliance committee, and told me that they now maintain a list of countries ranked by risk of misuse, based on human-rights indicators from Freedom House and other groups. (They declined to share the list.) NSO also says that customers’ Pegasus systems maintain a file that records which numbers were targeted; customers are contractually obligated to surrender the file if NSO starts an investigation. “We have never had a customer say no,” Hulio told me. The company says that it can terminate systems remotely, and has done so seven times in the past few years.

The competition, Hulio argued, is far more frightening. “Companies found themselves in Singapore, in Cyprus, in other places that don’t have real regulation,” he told me. “And they can sell to whoever they want.” The spyware industry is also full of rogue hackers willing to crack devices for anyone who will pay. “They will take your computers, they will take your phone, your Gmail,” Hulio said. “It’s obviously illegal. But it’s very common now. It’s not that expensive.” Some of the technology that NSO competes with, he says, comes from state actors, including China and Russia. “I can tell you that today in China, today in Africa, you see the Chinese government giving capabilities almost similar to NSO.” According to a report from the Carnegie Endowment for International Peace, China supplies surveillance tools to sixty-three countries, often through private firms enmeshed with the Chinese state. “NSO will not exist tomorrow, let’s say,” Hulio told me. “There’s not going to be a vacuum. What do you think will happen?”

NSO is also competing with Israeli firms. Large-scale hacking campaigns, like the one in Catalonia, often use tools from a number of companies, several founded by NSO alumni. Candiru was started in 2014, by the former NSO employees Eran Shorer and Yaakov Weizman. It was allegedly linked to recent attacks on Web sites in the U.K. and the Middle East (Candiru denies the connection), and its software has been identified on the devices of Turkish and Palestinian citizens. Candiru has no Web site. The firm shares its name with a parasitic fish, native to the Amazon River basin, that drains the blood of larger fish.


QuaDream was founded two years later, by a group including two other former NSO employees, Guy Geva and Nimrod Reznik. Like NSO, it focusses on smartphones. Earlier this year, Reuters reported that QuaDream had exploited the same vulnerability that NSO used to gain access to Apple’s iMessage. QuaDream, whose offices are behind an unmarked door in the Tel Aviv suburb of Ramat Gan, appears to share with many of its competitors a reliance on regulation havens: its flagship malware, Reign, is reportedly owned by a Cyprus-based entity, InReach. According to Haaretz, the firm is among those now employed by Saudi Arabia. (QuaDream could not be reached for comment.)

Other Israeli firms pitch themselves as less reputationally fraught. Paragon, which was founded in 2018 by former Israeli intelligence officials and includes former Prime Minister Ehud Barak on its board, markets its technology to offices within the U.S. government. Paragon’s core technology focusses not on seizing complete control of phones but on hacking encrypted messaging systems like Telegram and Signal. An executive told me that it has committed to sell only to a narrow list of countries with relatively uncontroversial human-­rights records: “Our strategy is to have values, which is interesting to the American market.”



“If you win, the game is rigged, but if I win it’s flawless and beyond critique.”
Cartoon by Suerynn Lee

In Catalonia, Gonzalo Boye, an attorney representing nineteen people targeted by Pegasus, is preparing criminal complaints to courts in Spain and other European countries, accusing NSO, as well as Hulio and his co-founders, of breaking national and E.U. laws. Boye has represented Catalan politicians in exile, including the former President Carles Puigdemont. Between March and October of 2020, analysis by the Citizen Lab found, Boye was targeted eighteen times with text messages masquerading as updates from Twitter and news sites. At least one attempt resulted in a successful Pegasus infection. Boye says that he now spends as much time as possible outside Spain. In a recent interview, he wondered, “How can I defend someone, if the other side knows exactly everything I’ve said to my client?” Hulio declined to identify specific customers but suggested that Spain’s use of the technology was legitimate. “Spain definitely has a rule of law,” he told me. “And if everything was legal, with the approval of the Supreme Court, or with the approval of all the lawful mechanisms, then it can’t be misused.” Pere Aragonès, the current President of Catalonia, told me, “We are not criminals.” He is one of three people who have served in that role whose phones have been infected with Pegasus. “What we want from the Spanish authorities is transparency.”

Last month, the European Parliament formed a committee to look into the use of Pegasus in Europe. Last week, Reuters reported that senior officials at the European Commission had been targeted by NSO spyware. The investigative committee, whose members include Puigdemont, will convene for its first session on April 19th. Puigdemont called NSO’s activities “a threat not only for the credibility of Spanish democracy, but for the credibility of European democracy itself.”

NSO Group also faces legal consequences in the U.K.: three activists recently notified the company, as well as the governments of Saudi Arabia and the U.A.E., that they plan to sue over alleged abuses of Pegasus. (The company responded that there was “no basis” for their claims.)

NSO continues to defend itself in the WhatsApp suit. This month, it filed an appeal to the U.S. Supreme Court. “If we need to go and fight, we will,” Shmuel Sunray, NSO’s general counsel, told me. Lawyers for WhatsApp said that, in their fight with NSO, they have encountered underhanded tactics, including an apparent campaign of private espionage.

On December 20, 2019, Joe Mornin, an associate at Cooley L.L.P., a Palo Alto law firm that was representing WhatsApp in its suit against NSO, received an e-mail from a woman who identified herself as Linnea Nilsson, a producer at a Stockholm-based company developing a documentary series on cybersecurity. Nilsson was cagey about her identity but so eager to meet Mornin that she bought him a first-class plane ticket from San Francisco to New York. The ticket was paid for in cash, through World Express Travel, an agency that specialized in trips to Israel. Mornin never used the ticket. A Web site for the documentary company, populated with photos from elsewhere on the Internet, soon disappeared. So did a LinkedIn profile for Nilsson.

Several months later, a woman claiming to be Anastasia Chistyakova, a Moscow-based trustee for a wealthy individual, contacted Travis LeBlanc, a Cooley partner working on the WhatsApp case, seeking legal advice. The woman sent voice-mail, e-mail, Facebook, and LinkedIn messages. Mornin identified her voice as belonging to Nilsson, and the law firm later concluded that her e-mail had come from the same block of I.P. addresses as those sent by Nilsson. The lawyers reported the incidents to the Department of Justice.

The tactics were similar to those used by the private intelligence company Black Cube, which is run largely by former officers of Mossad and other Israeli intelligence agencies, and is known for using operatives with false identities. The firm worked on behalf of the producer Harvey Weinstein to track women who had accused him of sexual abuse, and last month three of its officials received suspended prison sentences for hacking and intimidating Romania’s chief anti-­corruption prosecutor.


Black Cube has been linked to at least one other case involving NSO Group. In February, 2019, the A.P. reported that Black Cube agents had targeted three attorneys involved in another suit against NSO Group, as well as a London-­based journalist covering the case. The lawyers—Mazen Masri, Alaa Mahajna, and Christiana Markou—who represented hacked journalists and activists, had sued NSO and an affiliated entity in Israel and Cyprus. In late 2018, all three received messages from people who claimed to be associated with a rich firm or individual, repeatedly suggesting meetings in London. NSO Group has denied hiring Black Cube to target opponents. However, Hulio acknowledged the connection to me, saying, “For the lawsuit in Cyprus, there was one involvement of Black Cube,” because the lawsuit “came from nowhere, and I want to understand.” He said that he had not hired Black Cube for other lawsuits. Black Cube said that it would not comment on the cases, though a source familiar with the company denied that it had targeted Cooley lawyers.

“People can survive and can adapt to almost any situation,” Hulio once told me. NSO Group must now adapt to a situation in which its flagship product has become a symbol of oppression. “I don’t know if we’ll win, but we will fight,” he said. One solution was to expand the product line. The company demonstrated for me an artificial-intelligence tool, called Maestro, that scrutinizes surveillance data, builds models of individuals’ relationships and schedules, and alerts law enforcement to variations of routine that might be harbingers of crime. “I’m sure this will be the next big thing coming out of NSO,” Leoz Michaelson, one of its designers, told me. “Turning every life pattern into a mathematical vector.”

The product is already used by a handful of countries, and Hulio said that it had contributed to an arrest, after a suspect in a terrorism investigation subtly altered his routine. The company seemed to have given little consideration to the idea that this tool, too, might spur controversy. When I asked what would happen if law enforcement arrested someone based on, say, an innocent trip to the store in the middle of the night, Michaelson said, “There could be false positives.” But, he added, “this guy that is going to buy milk in the middle of the night is in the system for a reason.”

Yet the risk to bystanders is not an abstraction. Last week, Elies Campo decided to check the phones of his parents, scientists who are not involved in political activities, for spyware. He found that both had been infected with Pegasus when he visited them during the Christmas holiday in 2019. Campo told me, “The idea that anyone could be at risk from Pegasus wasn’t just a concept anymore—it was my parents sitting across the table from me.” On his mother’s phone, which had been hacked eight times, the researchers found a new kind of zero-click exploit, which attacked iMessage and iOS’s Web-browsing engine. There is no evidence that iPhones are still vulnerable to the exploit, which the Citizen Lab has given the working name Homage. When the evidence was found, Scott-Railton told Campo, “You’re not going to believe this, but your mother is patient zero for a previously undiscovered exploit.”

During a recent visit to NSO’s offices, windows and whiteboards across the space were dense with flowcharts and graphics, in Hebrew and English text, chronicling ideas for products and exploits. On one whiteboard, scrawled in large red Hebrew characters and firmly underlined, was a single word: “War!” ♦

Georgia Gee conducted additional research for this piece.


Published in the print edition of the April 25 & May 2, 2022, issue, with the headline “The Surveillance States.”