Catalan court orders former NSO Group executives be indicted for spyware abuses
A provincial court in Barcelona has ordered that three former senior executives at NSO Group, a prominent spyware manufacturer, be indicted for their alleged role in a high-profile hacking scandal in which at least 63 Catalan civil society members were targeted with the company’s surveillance technology.
The executives will be investigated under Barcelona’s “discovery and disclosure of secrets” statute, according to Iridia, a Catalan human rights organization.
“This sets an important precedent in the fight against spyware espionage in Europe and represents a significant step forward in the investigation,” an Iridia press release said. “Individuals involved will have to answer personally before the courts.”
When issuing the order to indict, the court asserted that it is “absolutely appropriate” to question the men as suspects.
The executives — Shalev Hulio, Omri Lavie and Yuval Somekh — did not respond to messages via LinkedIn seeking comment. A spokesperson for NSO Group also did not respond to a request for comment.
Phones belonging to the 63 victims — all of whom were connected to the Catalonia independence movement — were allegedly targeted and in some cases infected with NSO’s powerful zero-click Pegasus spyware.
The three executives were senior leaders at NSO Group and its parent company Q Cyber Technologies when the targeting is believed to have occurred.
Most of the incidents took place between 2017 and 2020, according to a report from Citizen Lab, a University of Toronto-based group known for researching and diagnosing spyware affecting members of civil society.
Catalan government and elected officials were “extensively targeted,” including members of European Parliament, according to the 2022 Citizen Lab report. While Citizen Lab said it could not “conclusively attribute” the targeting to a specific government, “extensive circumstantial evidence points to the Spanish government.”
Catalonia, situated in northeast Spain, operates as an autonomous community and has long sought independence from the country.
Suzanne Smalley
is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.