Sarah Chen
Spain's Most Serious Espionage Case Ends in Impunity
Let me break this down: imagine someone breaks into your house, steals 2.5 gigabytes of personal information, and when you go to the police, they tell you the thief lives in another country that refuses to cooperate. That's exactly what happened to the Prime Minister of Spain.
On January 22, 2026, Judge José Luis Calama of Spain's National Court permanently closed the investigation into the Pegasus spying on Pedro Sánchez and several cabinet ministers. The reason: Israel, where NSO Group (creator of Pegasus) is headquartered, has ignored five legal requests sent by Spain since 2022.
What most guides won't tell you is that this case has all the makings of a geopolitical thriller: a spied-on prime minister, a foreign power as the prime suspect (Morocco), an Israeli company selling software to governments, and an international legal system that simply doesn't work when countries decide not to cooperate.
What is Pegasus and Why is it So Dangerous?
Pegasus isn't just any virus. It's considered the world's most sophisticated spyware, developed by NSO Group, an Israeli company that sells exclusively to governments and intelligence agencies.
How Pegasus Works
The trick is that Pegasus can infect your phone without you clicking anything. This is called a "zero-click attack." Once inside, it has total access:
- Reads all your messages (including WhatsApp and Signal)
- Listens to your calls in real-time
- Activates your microphone and camera without your knowledge
- Accesses your photos, contacts, and GPS location
- Reads your emails and documents
The price? According to leaks, a Pegasus license can cost between $7 and $8 million annually. It's not something just anyone can buy.
Who Can Buy It
NSO Group has always insisted they only sell to "responsible governments" to fight terrorism and organized crime. But reality is different: Pegasus has been used to spy on journalists, human rights activists, and as we now know, heads of government of allied countries.
Sánchez and His Ministers' Phones: What We Know
In May 2022, the Spanish government publicly revealed that the president's and several ministers' phones had been infected with Pegasus. The numbers are staggering.
Pedro Sánchez: 5 Infections, 2.5GB Stolen
The Prime Minister's phone was infected five times between October 2020 and December 2021:
| Date | Attack Type |
|---|---|
| October 13, 2020 | First confirmed infection |
| May 19, 2021 | Second infection |
| June 12, 2021 | Third infection |
| December 27, 2021 | Fourth and fifth infections |
In total, the attackers extracted more than 2.5 gigabytes of information from the president's device. To put this in perspective, that's equivalent to hundreds of thousands of documents, thousands of photos, and months of messages.
Margarita Robles: The Defense Minister
The Defense Minister's phone was spied on four times during 2021. Although the attackers only extracted 9 megabytes (she had reset the device in July 2021), access to communications from the Defense Minister of a NATO country is extremely serious.
Other Affected Ministers
- Fernando Grande-Marlaska (Interior): His phone was also attacked in June 2021
- Luis Planas (Agriculture): There were infection attempts, but no access was achieved
What's troubling is that Luis Planas had been Spain's ambassador to Morocco. This detail becomes relevant when analyzing who might be behind the spying.
The Elephant in the Room: Was it Morocco?
Although it has never been officially confirmed, all signs point to Morocco as responsible for spying on Spanish leaders.
The Diplomatic Context
In 2020 and 2021, when the infections occurred, relations between Spain and Morocco were going through an unprecedented diplomatic crisis:
- April 2021: Spain allows Polisario Front leader Brahim Ghali to be treated in a Spanish hospital
- May 2021: Morocco opens Ceuta's borders, causing more than 8,000 people to enter in 24 hours
- June 2021: Morocco recalls its ambassador from Madrid
Most of the infections happened precisely during these months.
The French Evidence
The case was reopened in April 2024 thanks to information provided by France, which was also investigating Pegasus attacks. French investigators discovered that the same email used to infect Spanish phones was also used in attacks in France where Morocco was the suspect.
Even President Emmanuel Macron was a Pegasus victim, and France also suspects Morocco.
The Official CNI Position
In 2024, Spain's National Intelligence Center (CNI) published a 286-page report that, surprisingly, exonerated Morocco of all accusations. However, many experts question this conclusion given the diplomatic context: Spain was in the process of normalizing relations with Rabat.
The Catalangate: When the Spy Was Spain's Own CNI
But there's a brutal irony in all of this. While Spain complained about being spied on by a foreign country, Spain's own intelligence service (CNI) was using Pegasus to spy on Spanish citizens.
What Citizen Lab Revealed
In April 2022, the Citizen Lab cybersecurity laboratory at the University of Toronto published a devastating report: at least 65 Catalan pro-independence politicians, journalists, activists, and lawyers had been spied on with Pegasus.
Among the victims:
- Pere Aragonès: President of the Generalitat
- Carles Puigdemont: Former president (his inner circle)
- Roger Torrent: Former Parliament president
- Jordi Sànchez: General secretary of Junts
- Lawyers, journalists, and activists
The CNI Admits to Spying
Unlike the Sánchez case (where there's no culprit), here there is a clear responsible party. The government admitted that the CNI had spied on 18 pro-independence figures with judicial authorization. However, the European Parliament concluded that those spied on were many more than the 18 acknowledged.
The CNI Director, Dismissed
Paz Esteban, CNI director and the first woman to hold the position, was dismissed in May 2022 amid the scandal. She was the scapegoat, though spying decisions came from higher up.
Why Israel Doesn't Cooperate (And Never Will)
Judge Calama has been explicit: the case is being closed due to the "investigative impotence" caused by Israel's lack of cooperation.
The 5 Ignored Legal Requests
A rogatory commission is a formal request from a judge to another country to cooperate in an investigation. Spain sent:
- 2022: First request to Israel asking for NSO Group information
- 2023: Second request, no response
- 2024: Third, fourth, and fifth requests, asking at least for an explanation of why they wouldn't cooperate
Result: Complete silence. Israel didn't even respond to say they wouldn't cooperate.
Why Israel Protects NSO Group
NSO Group is not just any private company. It is closely linked to the State of Israel and its exports require approval from the Israeli Defense Ministry. Selling Pegasus is, in practice, a tool of Israeli foreign policy.
If Israel cooperated with Spain, it would set a precedent that would open the door to dozens of countries wanting to investigate NSO Group: Mexico, Poland, Hungary, Saudi Arabia... The list is long.
The Consequences (Or Lack Thereof)
Here's how things stand after the permanent closure:
For Those Responsible for the Spying
No one will face consequences. Without Israel's cooperation, it's impossible to identify who ordered and executed the espionage. The case will expire without culprits.
For the Victims
Pedro Sánchez, Margarita Robles, and the other ministers will receive no reparation. The damage is done: 2.5GB of classified information from the Prime Minister's office in the hands of an unknown actor.
For Spain-Morocco Relations
Curiously, relations have normalized. In 2022, Spain changed its historic position on Western Sahara, supporting Morocco's autonomy plan. Some see a connection; others deny it.
For Spain-Israel Relations
This case adds to tensions over Spain's position on Gaza. But in practical terms, there will be no formal diplomatic consequences.
What This Says About Cybersecurity in 2026
The Pegasus case reveals several uncomfortable truths:
1. World Leaders Are Vulnerable
If the Prime Minister of Spain can be spied on 5 times, anyone can be. Government security protocols are not sufficient against tools like Pegasus.
2. International Justice Doesn't Work
When a country decides not to cooperate, investigations die. There's no mechanism to force Israel (or any other country) to collaborate.
3. The Spyware Market is the Wild West
Companies like NSO Group operate in a legal limbo. They sell to governments that use their tools to spy on journalists, activists, and leaders of other countries. And there are no consequences.
4. Geopolitics Always Wins
Morocco (allegedly) spies on Spain, Spain normalizes relations with Morocco, Israel protects NSO Group, and the case is closed. Geopolitical interests prevail over justice.
What You Can Do to Protect Yourself
Although most of us aren't Pegasus targets (it's too expensive), there are security lessons we can apply:
- Always update your phone: Zero-click vulnerabilities are patched in updates
- Use two-factor authentication: Not for everything, but for critical services
- Be suspicious of suspicious links: Although Pegasus doesn't need them, other spyware does
- Restart your phone regularly: Some spyware doesn't survive a restart
- If you're a high-value target: Consider using a separate device for sensitive communications
Conclusion
The Pegasus case in Spain is being closed not for lack of evidence, but for the impossibility of investigating. Israel has shown it will protect NSO Group above any request for international judicial cooperation.
2.5 gigabytes of information from the Spanish Prime Minister are somewhere, in the hands of someone who is probably Morocco, and there will be no consequences.
Meanwhile, Pegasus software continues to be sold to governments worldwide. And companies like NSO Group continue to operate with impunity.
What most guides won't tell you is that this isn't just an espionage case. It's a demonstration of how power works in the 21st century: states spy, companies facilitate, and justice remains impotent.
Welcome to 2026.
