The judge of the National Court José Luis Calama has reopened the case for the Pegasus virus infection of the mobile devices of the President of the Central Government, Pedro Sánchez, and of the Ministers of Defense, Interior and Agriculture, Margarita Robles, Fernando Grande-Marlaska and Luis Planas, respectively.
Calama filed it because it ran into an impasse, as Israeli authorities did not cooperate in obtaining information from the company NSO, which markets the software. However, the judge has found another line of inquiry thanks to the French authorities.
The Gallic country has sent the instructor an investigation carried out in 2021 for multiple infections of the phones of journalists, lawyers, ministers and deputies with the Pegasus software.
In the documentation provided by France, the authorities explain that they have addressed the commercial group NSO, a venture capital company whose registered office is in Israel, and which has developed and marketed the spy software, in principle for exclusive sale to state organizations to monitor people suspected of terrorism or other serious crimes.
In the same way, the French authorities state that their investigations aim to find out who is behind these mass infections and that their investigation has led them to request judicial assistance from the United States and Israel, given that the company NSO denied that it was responsible for infecting the phones and stated that any additional information should be requested through judicial cooperation tools.
The document sent by France includes the “indicators of compromise” (IOC), which are a series of data that can indicate that a system has been compromised by an attacker. These indicators may include IP addresses, domain names, malicious files, network traffic patterns, and anomalous user behavior, among others. IOCs are used in the detection and response to computer security incidents.
In his interlocutory speech, Judge Calama explains that the provisional dismissal allows a case to be reopened when new information appears. In this sense, he considers that the comparison of the technical elements collected in the French investigation with those obtained by the National Cryptologic Center in the expert analyzes of the infected devices of the president of the central government and the three ministers may allow progress in the investigations.
The magistrate explains that the investigations in France determined that each service used by Pegasus created an infrastructure that could be used to trap several numbers: “Therefore, it is possible to establish comparisons between the tracks found on the different infested phones to identify a single source of infestation”, he points out.
As the main task, the judge of the National Court agrees to the practice of an expert report that will be drawn up by the Cryptological Center to compare the technical elements collected in the French and Spanish investigations and determine the authorship of the cyber attacks.
Calama explains that when the result of this new examination is obtained, a wider exchange of information can be carried out with the French and thus find out the content of the information that NSO provided to them about the internal control process of the Pegasus software and to have a more complete view on the French investigations carried out.
