Matthias Monroy

Spain’s secret service is probably also spying abroad with „Pegasus“. Attacks may have been made in Germany on the former regional president of Catalonia and his Chilean-German lawyer.

On 25 March 2018, former regional president of Catalonia Carles Puigdemont was arrested by the highway police in the German state of Schleswig-Holstein and temporarily detained. Due to persecution by the Spanish state, Puigdemont lives in exile in Belgium. With four companions, the politician therefore wanted to continue his journey from Finland via Germany to Brussels.

Apparently, secret services were also involved in the arrest. Ten agents of the National Intelligence Centre (CNI) from Spain had informed the German Office for the Protection of the Constitution (the domestic secret service) about Puigdemont’s imminent border crossing, Spanish media reported at the time. The Spanish CNI had tapped his phones and used a tracking device to determine the vehicle’s position.

Such digital surveillance would be illegal in Germany. This is the conclusion of a study by the Scientific Services in the Bundestag, commissioned by Andrej Hunko, a member of the Left Party. „Intelligence activities of foreign intelligence services in Germany are fundamentally inadmissible as an exercise of foreign state power, unless the Federal Republic permits them,“ the experts write. However, there is no legal basis for such permission. This also applies to the surveillance of telecommunications.

This is also the view of intelligence services expert Thorsten Wetzling, who heads the „Surveillance, Fundamental Rights and Democracy“ department at the Berlin-based Stiftung Neue Verantwortung. He further refers to the case law of the Federal Constitutional Court on foreign telecommunications surveillance by the Federal Intelligence Service (BND), according to which independent surveillance measures by foreign services in Germany should not depend on simple tolerance on the part of the federal government in Berlin.

Whether the Spanish secret service actually tapped Puigdemont’s phones on German territory can hardly be proven. The governing coalition of Christian and Social Democrats, which was in office at the time, claims to have had no knowledge of this, it said in response to questions from the Bundestag.

Such a measure would also require the assistance of a German authority that has access to the wiretapping interfaces of the telephone providers operating here. The Federal Office for the Protection of the Constitution could, for example, have passed on the contents of conversations and connection data to the CNI.

However, according to the expert opinion, this would be a „ring exchange“, which the Constitutional Court also set narrow limits to in its BND ruling. Accordingly, the protection against domestic surveillance may not be deprived of its effect by a „free exchange“ with foreign services.

Such a service on behalf of a Spanish intelligence unit would require a legal basis. However, neither the Federal Law on the Protection of the Constitution nor the G 10 Law on intrusion into the secrecy of telecommunications contain norms for an activity of the domestic secret service on behalf of foreign states, explains lawyer David Werdermann of the Society for Civil Liberties (GFF). „For this reason alone, the involvement of German secret services in the surveillance of Carles Puigdemont should be inadmissible,“ Werdermann told „nd“. According to the case law from the German Federal Constitutional Court, no data on dissidents may be transmitted.

In addition to direct tapping of phones in Germany, however, there are other ways to use the devices for wiretapping from abroad. These include the use of spy software, with which the Spanish secret service can turn the phones of targeted persons into listening and locating bugs.

Spain is one of the countries whose police and secret services use the „Pegasus“ spyware. The phones of at least 63 politicians, lawyers and activists have been infiltrated with it. This was revealed by the Canadian laboratory of the civil rights organisation Citizen Lab a year ago as „CatalanGate“. According to the report, Carles Puigdemont is also one of the victims of „Pegasus“, albeit indirectly through spouses and close confidants. The Citizen Lab report calls this „relational targeting“.

In contrast, Puigdemont’s lawyer, Gonzalo Boye, was attacked directly. In a decision of 28 June available to „nd“, the Spanish Supreme Court discloses Boye’s „interception of communications“. „Pegasus“ was used in the process, the former head of the CNI also confirmed in a secret meeting last May.

Citizen Lab researchers were able to reconstruct that Boye’s phone received at least 18 messages with links to websites infected with „Pegasus“ between January and May 2020. Around 30 October 2020, the attack finally succeeded, Citizen Lab reports.

The lawyer believes that by placing the Trojan on his phone, the Spanish intelligence service violated the ban on wiretapping foreign services in Germany. „Some periods of time for which Citizen Lab documented my surveillance coincide with my trips abroad to Belgium and Germany,“ Boye confirms to „nd“.

According to research by journalist Adrienne Fichter, there is evidence that the CNI also uses the spy software on the phones of its targets abroad, for example in Switzerland. According to this, blockchain entrepreneur Jordi Baylina, who comes from Catalonia, was spied on with „Pegasus“ at his place of residence in Zug.

Boye was born in Chile and holds both Chilean and German citizenship. This makes his fundamental rights in Germany particularly worthy of protection. Ultimately, however, nationality is not the issue, according to the expert opinion of the Bundestag’s Scientific Services. The German state is obliged to protect the personal data of all people who reside on its territory.

It is now questionable how ex-president Puigedemont and his lawyer Boye can shed light on their possible persecution by the CNI in Germany. „It would be possible for Boye to apply to the Federal Intelligence Service and the Office for the Protection of the Constitution for information on his data stored there,“ explains Wetzling. In addition, Boye and Puigedemont could turn to the Federal Commissioner for Data Protection. However, if the wiretapping was done with „Pegasus“ from Spain and the German services were therefore not involved, the requests come to nothing.

„The case law of the Federal Constitutional Court obliges the state to protect people living here from attacks on their information technology systems. This also includes following up on indications of espionage activities by foreign intelligence services and, if necessary, initiating criminal proceedings,“ says lawyer David Werdermann, who also brings cases against intelligence services in the GFF.

The Federal Office for the Protection of the Constitution „basically follows up on all indications of illegitimate activities of foreign states“, it says on request. However, it does not comment on the operational facts of possible Spanish espionage in Germany. The Federal Intelligence Service and the Federal Criminal Police Office also do not answer questions on the content. The extent to which the German government protects fundamental rights in Germany against spying by other EU states, as required, is therefore difficult to ascertain.

Published in German in „nd“.

Image: Carles Puigdemont with his lawyer Gonzalo Boye in Sardinia in September 2021 (Medol, Carles Puigdemont i Gonzalo Boye en un pla general durant una roda de premsa a l’Alguer, CC BY-SA 4.0).