WhatsApp has confirmed that the mobile phone of a leading pro-independence politician in Catalonia was targeted over its messaging app in a 2019 attack that has been condemned as a possible case of domestic espionage in Europe.
In a letter to Roger Torrent, the speaker of the Catalan parliament, and obtained by the Guardian and El Pais, the company confirmed that his personal WhatsApp account was “targeted in an attempt to gain unauthorised access to data and communications on the device”.
The letter also confirmed that the targeting was part of an attack against WhatsApp’s users by operators of spyware made by NSO Group.
“By ‘targeted’ we are referring to the fact that the attackers attempted to inject malicious code into Mr Torrent’s WhatsApp application,” said Niamh Sweeney, director of public policy, for Europe, the Middle East and Asia at WhatsApp.
“Based on the information available to us, we are not in a position to confirm whether Mr Torrent’s device was compromised as this could only be achieved through an exhaustive forensic analysis of the device,” she said.
WhatsApp also offered Torrent “an open communication channel” and assistance with any other requests he may have and said WhatsApp Ireland would respond to “any judicial production order” for its data and logs in according to its terms and applicable law.
“We advocate for strong legal oversight of cyber weapons like the ones used in this cyberattack to ensure they are not used to violate individual rights and the freedoms people deserve, wherever they are in the world,” Sweeney said.
The confirmation letter from WhatsApp, which is owned by Facebook, comes two weeks after the Guardian and El Pais first revealed that Torrent and other politicians and activists who support the Catalan independence movement were targeted over a two week period in 2019. WhatsApp has said that the attack targeted 1,400 of its users, including 100 members of civil society, including journalists, diplomats, politicians, and human rights activists.
Spain’s socialist-led coalition government has denied “spying” on the Catalan politicians and activists but has so far resisted demands by some MPs for a parliamentary inquiry.
NSO Group declined to comment on the WhatsApp letter. The company, which only sells its hacking software to government clients, has denied it has any role in operating the spyware and has said it has no knowledge of who its government clients target.
WhatsApp has sued NSO Group in the US and alleged the company played a role in the 2019 attack. NSO strenuously denies the allegation and has appealed a recent court ruling that would allow WhatsApp’s case against it to proceed.
Torrent and the former regional foreign minister, Ernest Maragall, have said they plan to pursue legal action against Félix Sanz Roldán, who was the head of Spain’s National Intelligence Centre (CNI) at the time of the targeting in April and May last year.
Roldán told the Guardian the CNI “always acts with the most scrupulous regard for the law”, saying he had nothing more to add.
