Ronald Deibert, founder of Citizen Lab: "Governments use Pegasus because they have an appetite to spy"

Ronald Deibert is a 57-year-old Canadian, founder and director of the Citizen Lab, who never abandons the airs of university professor of Political Science.

He uses metaphors to explain the techniques of his organization, attached to the University of Toronto.

Citizen Lab, a laboratory that has some 40 collaborators to investigate the intersection between new technologies, human rights and global security, published the

a list with 65 independentist leaders allegedly cyber-spied on with Pegasus, a tool that the Israeli company NSO provides to states and official agencies.

The report has shaken the foundations of Spanish politics and led the government to announce that President Pedro Sánchez and several of his ministers have also been attacked with the same technology.

The following week, the director of the National Intelligence Center (CNI) has been dismissed.

On Thursday, hours after Paz Esteban was replaced by Esperanza Casteleiro at the head of the secret services, Deibert spoke with EL PAÍS in a Madrid hotel.

He declines any invitation and goes to the bar to pay for his bottle of sparkling water.

Today he flies back to his country after several days in Spain.

“It's not a club or a volunteer group,” he says of Citizen Lab. “We're not a company.

Not an NGO.

We do impartial, evidence-based investigations in the public interest.

We do not act in favor of any cause in Spain.

We have done research in many countries and, for us, this is one more.

We are independent of all governments.

We do not carry out paid research.

We finance ourselves with grants.”

Ask.

Where do those subsidies come from?

Response.

Mainly foundations.

Many of them tend to renew grants because our work seems relevant to them.

Q.

The suspicion that

is a party report weighs on you.

A.

It is not.

Those mentioned in that study have not had and do not have any influence on what we have written, when and how we build it.

Q. Has the

report

been commissioned by ERC or Junts or their environments?

A.

Absolutely false.

Q.

What is your relationship with those parties, many of whose members appear in the report?

R.

The same relationship as a doctor with his patient.

We are scientists, we study them to determine their diagnosis and we transmit it to them verbally before publishing anything.

Q.

Don't you decide when you publish your research?

A.

We never publish anything until you are ready for it.

P.

But when you work with parties there may be political motivations in choosing the time to publish them.

It is absolutely false that the

report has been commissioned by parties and circles of ERC or Junts Per Catalunya

R.

For us it is not relevant.

P.

It has been in this case.

R.

When would something like this not be relevant for this country?

P.

At this time it has been a political tsunami.

R.

Wouldn't it have been in December 2017?

We had no evidence then to publish them.

Wouldn't it have been a year ago?

This report is not just about espionage on Catalan politicians.

It is a story about the extensive and disproportionate use of surveillance technologies, presumably by one or more agencies of the Spanish government.

It is a crisis of democracy in this country.

Q.

Who do you point to as responsible for this espionage?

R.

We only have evidence that points to one or a few agencies of the Spanish State.

One: NSO argues that it only sells Pegasus to governments.

Two: Who else would spy on Catalan society in this way?

Presidents, vice-presidents, parliamentarians… Would another government do it?

Highly unlikely.

And three: in the trail of those spied on there is information, such as social security numbers, that could only come from some agency of the Spanish government.

Espionage on Catalan politicians comes from one or several agencies of the Spanish State

Q.

The CNI has only acknowledged having spied on 18 of the 65 cases you mention.

A.

How can we verify that?

What have they taught in the commission of official secrets?

Do you believe it?

P.

The director of the secret services has been dismissed after acknowledging 18 cases.

She could have admitted the rest for the same cost that she has paid.

R.

The only thing I can confirm is the reliability of 100% of the attacks that we have registered [Citizen Lab detected infections in 51 of the 65 investigated, according to the

the rest were also considered Pegasus attacks without assuming infections].

Q.

Could there be false positives?

A.

No. Our methods are very precise, developed over years.

Ronald Deibert, during the interview.Claudio Álvarez

P.

In the case of the President of the Government, the theft of information has been certified through a forensic analysis of his own telephone.

But you never physically had in your possession the cell phones of those supposedly spied on.

A.

You don't need it.

We have a spectrum of data from multiple sources.

We have explored the infrastructure used by companies like NSO, which is provided by Pegasus.

Everyone leaves digital background.

If I access your mobile and the Government is the client, NSO has a server here to send instructions that go from computer to computer and whose trace we can access with great caution.

We have access to quite a bit of visibility into the NSO infrastructure.

Receiving the mobile might not be that useful for us.

Companies make mistakes and leave traces.

P.

EL PAÍS has published that at least a dozen Junts politicians are in contact with you to find out if they have been spied on before 1-O.

How many Catalan pro-independence politicians are you tracking right now?

R.

We do not talk about our research or with whom we do it because of our ethical protocols.

P.

You say you have proof that the current president of the Generalitat, Pere Aragonès, was spied on through Pegasus —something that was confirmed by the dismissed director of the CNI—, but you cannot determine the date.

How can they know that he was spied on if they don't know when it happened?

A.

We were able to conclude that Pegasus was active on your device from the trace that can only come from said technology, but we did not have access to other indicators that confirm the exact time.

P.

Who do you think may be responsible for espionage through Pegasus to members of the Government, including the president?

A.

We know that governments use Pegasus to spy on each other.

The unregulated espionage market is a matter of national security.

When I saw the news of the espionage of members of the Spanish government, I thought that perhaps people would realize that this is not a matter of Catalan politicians, but a much bigger problem.

Could it be a foreign nation?

Yes. Could it be an internal intelligence agency?

Also.

These revelations, combined with

give reason for an independent investigation into what is happening in this country.

Q.

Could the Catalan government have spied on itself through Pegasus?

R.

I have no evidence on that.

The best way to answer that question would be with an independent public investigation.

Governments have an appetite for spying.

This problem must be faced if we believe in democracy and human rights.

P.

Elies Campo, one of the

is at the same time a victim of the reported espionage.

Is there no lack of neutrality?

A.

There is no conflict of interest.

Having been victims of this type of attack is something that happens in our community of researchers.

It is also a common thing to kill the messenger.

Q.

Are you willing to provide the Spanish justice system with all the information about

A.

If there is an official request to cooperate, we will subject it to our ethical protocols and cooperate as we have done in other cases.

Q.

Has any Spanish authority demanded information from you?

A.

No.

Ronald Deibert, in Madrid.Claudio Álvarez

Exclusive content for subscribers

read without limits

subscribe

I'm already a subscriber