The organisation has also filed an appeal against the judge’s decision to reject the expansion of the lawsuit targeting three senior executives of NSO Group.

Irídia – Centre for the Defence of Human Rights has filed an appeal before the Provincial Court of Barcelona against the decision of Investigative Court No. 24 to reject the expansion of the lawsuit filed last November. That lawsuit identified three senior figures within the NSO Group corporate structure, which is primarily based in Luxembourg.

The expansion sought to have the legal representatives of these companies summoned to testify as part of the ongoing investigation into the use of Pegasus spyware against lawyer Andreu Van den Eynde. With this new appeal, Irídia reaffirms the need to investigate the individuals responsible for their role in the espionage network.

More than two years after the case began, the investigating judge has activated the European Investigation Order (EIO) in Luxembourg to move the case forward. While this is an important step, it is insufficient and inconsistent with the decision to reject the expansion of the lawsuit filed in November 2024.

In addition, the organisation points out that mounting evidence suggests the use of Pegasus was illegal. Since November, key documents have been added to the case, including the ruling in WhatsApp v. NSO Group in the United States, the Venice Commission’s Report on a Rule of Law and Human Rights-Compliant Regulation of Spyware, and the HBO Max documentary “Surveilled.”

Request for the Indictment of the CNI

In parallel, Irídia has requested the indictment of Paz Esteban, then director of the Centro Nacional de Inteligencia (CNI), as it considers the Spanish state to be a key actor in the use of this illegal surveillance software. It is not enough to investigate NSO Group; it is also essential to identify who used this software and under what conditions, in order to understand the full scope of the operation.

In light of the silence and lack of transparency from both the Spanish government and NSO Group, Irídia insists that the state must provide explanations and assume responsibility for this serious violation of fundamental rights.

A Serious Attack on the Rule of Law and Democracy

The use of Pegasus spyware against civil society representatives and other political and social actors — including three lawyers — constitutes a grave attack on the rule of law and democracy. Surveillance carried out without judicial oversight, in secrecy, and under a weak legal framework (such as the Spanish Intelligence Act), represents a serious violation of human rights, with both individual and collective consequences.

For this reason, Irídia demands a thorough, impartial, and effective investigation — one that addresses not only NSO Group’s involvement, but also the responsibilities of the Spanish state in this case of illegal surveillance. This investigation must include both the 18 cases where judicial authorisation was granted and the 47 where it was not.