The Spanish government sacked Paz Esteban, the director of its intelligence agency (CNI), on Tuesday, following the hacking of politicians’ mobile phones, including the devices of Prime Minister Pedro Sánchez and several Catalan pro-independence politicians and officials.
Defence Minister Margarita Robles, who was also among the hacking targets and whose ministry oversees the CNI, announced after a cabinet meeting that Esteban would be ‘replaced’ as the intelligence agency’s director.
‘That (the hacking of Spanish government phones) took a year to discover, well, it is clear there are things that we need to improve,’ Robles said. ‘We are going to try to ensure that these attacks don’t happen again, even though there is no way to be completely safe.’
Esteban is to be replaced by Esperanza Casteleiro as the head of CNI. During the press conference following the cabinet meeting, Robles – who has also been facing calls to resign – stressed that the appointment will see things ‘continue as normal’ at the CNI, as Casteleiro brings ‘almost 40 years’ of experience.
Robles neglected to share what motivated Esteban’s removal and thanked her for her work as director of the intelligence services.
Esteban, 64, had appeared before a parliamentary committee for questioning last week over the phone hacking scandal. She became the first woman to head the CNI in July 2019, initially on an interim basis. Her appointment was made permanent in February 2020.
At the hearing last week, she confirmed that Catalan officials had been spied on by the CNI but always with court approval, several participants at the meeting told Spanish media at the time. Reports stated that Esteban had admitted the phones of at least 18 Catalan officials, including president Pere Aragonès, were hacked. Government sources, also cited by the media, said the government had not been informed of the spying.
The previous CNI director had received criticism for failing in 2017 to stop preparations by Catalan politicians to hold an independence referendum that had been deemed illegal by Spain’s top courts.
Since the ‘CatalanGate’ scandal broke last month, Spain’s socialist-led government has been under pressure to explain why the phones of dozens of people connected to the Catalan independence movement were infected with Pegasus spyware between 2017 and 2020, according to Citizen Lab, a cybersecurity group of experts affiliated with the University of Toronto.
The revelations involved at least 65 people, including elected Catalan officials, lawyers and activists, who had been targeted with the software of two Israeli companies, Candiru and NSO Group, the developer of Pegasus. NSO has repeatedly stressed that Pegasus is only sold to government organisations.
Catalan officials immediately pointed the finger at the CNI and threatened to withdraw their support for Sánchez’s minority government unless heads roll. The affair has sparked an on-going crisis between the Spanish government and Catalan pro-independence party Esquerra Republicana (ERC). Sánchez’s fragile coalition relies on the ERC to pass legislation in parliament.
The crisis with the CNI deepened after the Spanish government announced on 2 May that the phones of Sánchez and Robles had also been hacked by the same spyware, in May and June 2021.
Later it was also revealed that the phone of Interior Minister Fernando Grande-Marlaska, the head of Spain’s police and border control agencies, also was infected with the spyware at the same time as the defence minister’s phone.
Some Spanish media pointed the finger at Morocco, which was in a diplomatic spat with Spain at the time, but the government has said it was no evidence of who may be responsible.
The CNI quickly came under further fire for its role not only in spying on Catalan politicians, but for taking a full year to discover that the handsets of the prime minister and leading defence and security officials were also infiltrated, possibly by a foreign power.
Alberto Núñez Feijóo, the leader of Spain’s main opposition group, the right-wing People’s Party (PP), slammed the decision to remove Esteban. He said the government had sacrificed her to the Catalan separatists.
‘It is a monstrosity that Sánchez offers the head of the CNI director to the separatists, once again weakening the state to assure his survival,’ Feijóo wrote on Twitter.
Pegasus spyware infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners. The Israel-based NSO Group, which owns Pegasus, claims the software is only sold to government agencies to target criminals and terrorists, with the green light of Israeli authorities.
The NSO Group has been criticised by global rights groups for violating users’ privacy around the world and it faces lawsuits from major tech firms such as Apple and Microsoft.
Citizen Lab’s full report: CatalanGate: Extensive Mercenary Spyware Operation against Catalans Using Pegasus and Candiru.
Click here for all our reports related to Catalan independence.