Guardia Civil Buys €2.5M System to Remotely Access Phones

Only one bid was submitted. The Guardia Civil used a negotiated procedure without publicity, justified by the manufacturer granting exclusive supply and distribution rights. The notice names the supplier but not the manufacturer, and it does not say which Android and iOS versions are supported or whether installation is always possible remotely, without physical access. The same company was awarded maintenance of the EGOBOX platform in April 2020 for €99,130. The system cannot be identified as Pegasus: both work on Android and iOS, but that does not make them the same product.

Legal limits

Under Spain's Criminal Procedure Law, examining a device remotely without the owner's knowledge requires judicial authorisation. It applies to crimes committed within criminal organisations, crimes against minors or people with judicially modified capacity, national defence offences, and crimes committed through computer or communication technologies.

The judge's order must specify the type of devices, the scope of access, the software to be used and the authorised officers, plus guarantees of data integrity. The maximum period is one month, extendable in equal periods up to three months. If investigators believe data sits in another system, they must inform the judge, who can extend the search.

What users can do

Apple's optional Lockdown Mode, found under Settings > Privacy & Security, reduces the attack surface for spyware by blocking most message attachment types and some web technologies. Android 16 offers an advanced protection mode, under Settings > Security and privacy, that bundles measures against malicious apps and targeted attacks. It is not known how this particular system works, so it cannot be said whether either protection would block it.