A lawyer who was allegedly hacked with government-grade spyware made by popular surveillance technology maker NSO Group has filed a lawsuit in court against two of the company’s founders and an executive. This appears to be the first attempt to hold the people behind a spyware company responsible for hacking crimes, rather than the company itself.

On Wednesday, the Barcelona-based human rights nonprofit Iridie announced it had filed a complaint with a Catalan court earlier this week, accusing NSO founders Omri Lavie and Shalev Hulio, as well as Yuval Somekh, head of two affiliated companies, of computer hacking crimes.

Iridia represents lawyer Andreu Van den Eynde, lawyer and university professor specializing in cybersecurity. According to a survey conducted in 2022 by Citizen Laba nonprofit that has been investigating government spyware for more than a decade, Van den Eynde was among the victims of a massive hacking campaign against at least 65 Catalans linked to the region’s attempts to become independent of Spain, carried out using NSO’s Pegasus software. Amnesty International has independently confirmed the Citizen Lab’s findings.

Van den Eynde and Iridia filed a lawsuit against NSO in a Barcelona court in 2022. Until this week, the lawsuit named NSO as well as Osy Technologies and Q Cyber ​​Technologies, two Luxembourg subsidiaries of NSO, as defendants. Today, the nonprofit and attorney asked the judge presiding over the trial to expand the trial to include Lavie, Hulio and Somekh.

“Those responsible for the NSO group must explain their concrete activities,” wrote a legal representative of Iridia and Van den Eynde in the complaint, written in Catalan.

“Van Den Eynde was spied on to gain access to his clients and the legal strategy of the cases he was handling, creating a chain effect of rights violations: by spying on him, all his contacts were indirectly spied on,” he said. writes Iridia in a press release. press release. “What’s more, this surveillance is carried out without any criminal proceedings being initiated against him and therefore without any judicial control.

The complaint alleges that three executives were responsible for “selling illegal software” and participating and cooperating in the illegal use of the software.

Gil Lainer, NSO’s vice president of global communications, told TechCrunch the company had no comment.

Shalev did not respond to messages seeking comment. Lavie referred questions to his representative Hedan Orenstein.

“I understand that the plaintiffs are requesting to include Omri’s name as a defendant. But is there a specific allegation regarding an act attributed to Omri? They could theoretically ask to include both your name and mine,” Orenstein told TechCrunch.

Van den Eynde told TechCrunch that he is not happy being a victim because he prefers to focus on his own work and technological interests.

“The truth is that with all of this Pikachu (I never mention the name of the spyware to make things more difficult when they leak my emails, lol) being a victim of the acts, I try not to amplify this situation,” he said in an email. .

Other victims of the alleged hacking campaign have pressured the Spanish government to release details of the alleged surveillance against them. In 2020, Motherboard reported for the first time that the Spanish intelligence agency Centro de Inteligencia Nacional (National Intelligence Center, or CNI) had purchased the NSO spyware. The Spanish government initially denied the accusation that he was responsible for alleged hacks against Catalan politicians, saying he “does not spy on his political opponents.”

The CNI said its work was supervised by the Spanish Supreme Court and “in full compliance with the legal system and in absolute compliance with applicable laws.” Its former director, Paz Esteban, later testified before the Spanish Congress and said that 18 members of the independence movement had been spied on with judicial authorization.

At the time he was allegedly hacked, Van den Eynde represented several politicians in the Republican Esquerra of Catalonia (Republican Left of Catalonia), involved in what Catalan politicians called “el procés”, a catch-all expression for the independence movement as well as the steps taken to attempt to secede Catalonia from Spain. The most controversial of these measures was the independence referendum organized by the Catalan government on October 1, 2017, which the Spanish Constitutional Court subsequently declared illegal.

There are several legal cases against NSO around the world, including lawsuits in the United States launched by Apple and WhatsApp. Both cases are ongoing.