Englische Originalausgabe. Die Übersetzung dieser neuen Analyse steht noch aus.

Policy & leadership

Pegasus and Spain’s Government: Executive Security Beyond Diplomatic Trust

What the Spanish Pegasus case establishes, what remains unproven, and how a CISO should protect senior officials before, during and after travel.

Published: 9 October 2026

The case begins with evidence, not a destination

In May 2022, Spain’s government publicly confirmed Pegasus infections affecting the phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles, subsequently identifying Interior Minister Fernando Grande-Marlaska as another affected official. The 10 May briefing placed the Defence and Interior infections in June 2021. [1] These are documented compromises. The stronger assertion that the officials were infected while visiting Morocco is not established by these sources. Nor do they establish Moroccan responsibility. Travel risk is a valid policy question, but it must not be used to turn an unproven explanation into the historical record.

Chronology and attribution are different questions

The government’s 3 May 2022 briefing described an unlawful intrusion outside the authorised mechanisms of the Spanish state and declined to establish who was responsible. [2] External in that statement is not a technical identification of a foreign operator. In January 2026, EFE reported a second provisional closure of the investigation because cooperation requested from Israel had not enabled it to advance. [3] That procedural outcome does not establish innocence, culpability or the route of compromise. A responsible assessment keeps the detection date, estimated infection period, possible access method and attribution confidence in separate fields.

What zero-click spyware changes

Citizen Lab’s September 2023 BLASTPASS investigation documented a Pegasus delivery chain that could compromise an iPhone without victim interaction. [4] This was a different investigation, not evidence of the exploit used against Spanish officials. It nevertheless demonstrates why executive protection cannot depend entirely on teaching people not to click links. Our policy conclusion is to combine attack-surface reduction with limits on what a compromised device can expose. Awareness remains useful against social engineering, but blaming an individual’s supposed carelessness without forensic evidence obscures the design problem.

The asset is the decision-making environment

Our assessment treats the executive phone as a concentration of relationships and authority. Even without classified documents, a calendar, contact list, draft negotiation position or message from an adviser may reveal priorities. Compromise can also undermine confidence in an instruction that appears to come from the principal. The assessment should therefore cover confidentiality, authenticity and continuity together. Inventory the information actually accessible through the device, including cloud sessions and delegated mailboxes. A travel phone containing no local files may still open an entire organisation through persistent authenticated applications.

Diplomatic cooperation does not settle technical trust

A friendly bilateral relationship is not a security certification for a hotel, network operator, conference supplier or mobile application. Equally, an unfamiliar country is not proof that an incident has occurred. We recommend assessing the person, mission, information, services and exposure separately. Consider who administers each service and which assurances can be independently checked. Use diplomatic relationships to coordinate legitimate protection and support, while retaining the organisation’s own approval rules for sensitive communications. The same method should apply consistently across destinations rather than becoming a political label attached to one country.

Before departure: reduce authority as well as data

For a high-consequence trip, our recommended design is a managed travel device with only the applications, documents and accounts needed for the mission. Give travel accounts an expiry and a named owner. Remove standing administrative access, restrict bulk downloads and avoid automatically restoring years of chat history. Test the actual workflow with the official and the support team before departure. If an essential briefing cannot be reached through the approved arrangement, somebody will be tempted to forward it elsewhere. A workable alternative is a security requirement, not an optional convenience.

Hardening needs a usability rehearsal

Apple documents Lockdown Mode as an optional protection for highly targeted users which restricts functionality; it does not promise immunity. Its current guidance says administrators cannot configure the mode through MDM, although already managed devices remain managed. [5] For an eligible executive, the support team should help enable and verify the setting with the user, then test required services. Record any exception and its expiry. Do not claim that an MDM compliance tick proves the setting was enforced, or disable protection permanently because one nonessential website behaves differently.

A managed device is not a clean bill of health

NIST SP 800-124 Rev. 2 addresses mobile security across the device lifecycle and includes central management and endpoint protection. [6] Our implementation recommendation is to use management telemetry to establish configuration and access eligibility, while explicitly recording what it cannot observe. A device can be fully patched and still face an unknown exploit. Mobile threat detection can contribute useful signals, but the absence of an alert is not proof of absence of spyware. High-risk support contracts should identify who can perform specialist examination and how a device can reach them without disrupting essential duties.

During the trip: protect the whole delegation

An executive may be well protected while an assistant receives the same agenda on an unmanaged phone. Map the circle of people who can retrieve, modify or forward sensitive material: advisers, interpreters, drivers, administrative staff and remote support. Apply proportionate controls to their roles. Separate public logistics from restricted policy discussions, and establish an independent way to verify a surprising request. In our proposed model, an urgent change to payment, access or document distribution receives a callback through a previously established contact, not the number supplied in the suspicious message.

Respond without destroying the evidence

A credible spyware warning should trigger a prepared process. Move sensitive communication to an independently trusted replacement, contact the designated response lead and preserve the original device under specialist direction. Do not automatically erase it or ask the user to experiment with cleanup applications. The team should decide isolation and collection steps according to the device, safety needs and evidence requirements. From a separate trusted system, assess exposed identities, revoke relevant sessions and rotate affected credentials. Replacing hardware alone does not terminate stolen cloud sessions or undo information already disclosed.

Assess the consequences beyond the handset

Our proposed impact review asks which conversations, contacts, documents and authentication capabilities may have been accessible during the credible exposure window. Distinguish confirmed collection from possible exposure. Consider whether negotiating positions, personnel safety, partner confidence or future appointments require action. A technically small data set can carry strategic value. Record who makes those decisions and who receives a restricted briefing. The public communication should state what is established and what remains uncertain without publishing operational details that would expose other officials or compromise an investigation.

Measure preparedness, not the number of security products

A CISO can demonstrate progress through evidence: the proportion of high-risk travellers with a tested replacement channel, time needed to revoke a travel identity, completion of a specialist escalation exercise and closure of expired exceptions. Track whether assistants receive the same support as principals. These are proposed management measures, not claims about Spain’s internal controls. The central lesson is that seniority increases the consequences of compromise while often reducing tolerance for inconvenience. Security must accommodate the job, limit the authority carried in one device and preserve a credible response when prevention fails.

References

1. La Moncloa · Government press conference, 10 May 2022
2. La Moncloa · Questions and answers, 3 May 2022
3. EFE · Second provisional closure of the Pegasus investigation, 22 January 2026
4. Citizen Lab · BLASTPASS technical findings, 7 September 2023
5. Apple · About Lockdown Mode
6. NIST · SP 800-124 Rev. 2: Enterprise mobile device security

Original editorial analysis and paraphrases. Recommendations are distinguished from documented facts; references do not imply institutional endorsement.

Francisco Javier Jurado Alonso