The judge of the National Court José Luis Calama has agreed to reopen the case opened for the infection carried out with the Pegasus computer program on the mobile devices of the President of the Government, Pedro Sánchez, and the Ministers of Defense, Interior and Agriculture , Margarita Robles, Fernando Grande-Marlaska and Luis Planas, respectively.
The magistrate agrees to the reopening after having received a European Investigation Order (OEI) issued by the judicial authorities of France that incorporates an investigation carried out in the neighboring country in 2021 for multiple infections of phones of journalists, lawyers, public figures and associations governmental and non-governmental, as well as members of the French government, ministers and deputies, with the Pegasus software.
In the documentation provided by France, the authorities of that country explain that they have approached the company Grupo NSO, a venture capital company whose registered office is in Israel, and which has developed and marketed the PEGASUS software, in principle for exclusive sale. to state organizations in order to monitor people suspected of terrorism or other serious crimes.
Likewise, the French authorities state that their investigations aim to find out who is behind these massive infestations and that their investigation has led them to request judicial assistance from the United States and Israel, since the company NSO denied being responsible for the infection. of the phones and stated that any additional information should be requested through the judicial cooperation tools.
The document sent by France includes “compromise indicators”, which are a series of data that can indicate that a system has been compromised by an attacker. These indicators may include IP addresses, domain names, malicious files, network traffic patterns, and anomalous user behavior, among others. IOCs are used in the detection and response to computer security incidents.
In his order, Judge Calama explains that the provisional dismissal allows a case to be reopened when new data appears. In this sense, it considers that the comparison of the technical elements collected in the French investigation with those obtained by the National Cryptological Center in the expert analyzes of the infected devices of the President of the Government and the three ministers may allow progress in the investigations carried out in one country and another in order to determine the authorship of these infestations.
The magistrate explains that investigations in France determined that each service that used Pegasus software created an infrastructure that could be used to trap multiple numbers. “Therefore, it is possible to establish comparisons between the clues found on the different infested phones to identify a single source of infestation,” he concludes.
As the main procedure, the judge of the National Court agrees to the preparation of an expert report to be prepared by the National Cryptological Center in order to compare the technical elements collected in the French and Spanish investigations and to determine the authorship of the computer attacks.
Calama explains that when the result of this new expert examination is obtained, a broader exchange of information can be carried out with the French authorities and thus know the content of the information that the company NSO Group provided them about the internal control process of the software. Pegasus and a more complete detail on the technical investigations carried out by the French National Agency for the Security of Information Systems (ANSSI).
“All of this will allow joint and coordinated action by the French and Spanish judicial authorities in order to determine who is responsible for the infestation carried out through the Pegasus spy program in both France and Spain,” the judge concludes.