The Provincial Court has ruled in favour of Irídia and ordered the indictment of three NSO Group executives. They will be investigated for the alleged crime of discovery and disclosure of secrets. This follows the judge’s refusal to charge them, limiting the investigation to production and commercialisation companies.

This sets an important precedent in the fight against spyware espionage in Europe and represents a significant step forward in the investigation. Individuals involved will have to answer personally before the courts. This comes at a time when there is increasing evidence of the company’s responsibility in the infection process.

Who are the Defendants?

With regards to the indictment of the three executives, the court’s sentence clearly states that “it is absolutely appropriate to summon them for questioning as persons under investigation in the manner requested”.

The indicted individuals, Shalev Hulio, Omri Lavie, and Yuval Somekh, held positions of responsibility in NSO Group Technologies Limited, OSY Technologies, and Q Cyber Technologies (operating within the European Union in Luxembourg) during the period under investigation (2019 and 2020), when lawyer Andreu Van Den Eynde was allegedly spied on using Pegasus spyware.

This is the first indictment relating to executives of the NSO Group, confirming their involvement in the operational decisions of these companies, which are based in Luxembourg and Israel. The indictment was made possible thanks to an economic corporate forensic report on the corporate structure of the NSO Group, which was submitted to the proceedings by Irídia.

• Omri Lavie: Founder of the NSO Group and board member of the Israeli company. He was on the board of OSY Technologies from 2019 to 2023.
• Shalev Hulio: Founder and CEO of NSO Group until 2022. He was a board member of Q Cyber Technologies (2019-2022) and OSY Technologies until 2023.
• Yuval Somekh: Managing director of Q Cyber Technologies from 2016 to 2021 and board member of OSY Technologies between 2019 and 2020.

With this order, the criminal proceedings will be extended to these three executives, followed by their statements and the request for additional documents.

The role of the prosecution in obstructing the investigation

The court ruling also highlights the role of the Public Prosecutor’s Office, which repeatedly tried to block the expansion of the complaint. The Cybercrime Prosecutor had opposed the extension of the complaint, despite the PEGA Committee and PACE (Parliamentary Assembly of the Council of Europe) had emphasised the need for an in-depth investigation into these cases of espionage using Pegasus.

The court states that the attitude of both the investigating judge and the prosecutor in refusing to allow the extension of the complaint was “inconsistent with the current state of the proceedings” and that “it seems entirely logical to extend the indictment to the individuals who have been identified as being behind the decisions taken by these [companies].” This attitude on the part of the Public Prosecutor’s Office adds to the silence and lack of cooperation on the part of the Spanish state in this case.

What’s Next?

This is the first time that NSO Group executives have been formally notified that they are under criminal investigation. From this point on, Irídia urges the authorities in Luxembourg to cooperate actively in the investigation and to issue a European Investigation Order (EIO) to clarify the reported facts.

In addition, it is still awaiting the judge’s decision on the request to charge Paz Esteban, former director of the Spanish National Intelligence Centre (CNI), for her possible responsibility in espionage using Pegasus in this case as well.

Moreover, a parliamentary hearing of the PACE (Parliamentary Assembly of the Council of Europe) will take place on Monday 3 March: “Pegasus and similar spyware and secret state surveillance”.

• Time: 14:30h
• Live Link:https://youtube.com/live/x0T9q4U4KaM?feature=share

The session will focus on the alleged use of spyware in Serbia and Spain and will include a statement by Andreu Van Den Eynde, representing Irídia.