Question 1

What is Sentinel Alliance?

Accepted Answer

Sentinel Alliance (CHE-380.634.236) is a Swiss non-profit association (Verein) based in Zug, Switzerland. It is a collective of spyware victims and cybersecurity experts fighting against mercenary surveillance abuse worldwide. Founded by five technologists who were illegally targeted with military-grade spyware (Pegasus and Candiru), the organization pursues legal accountability, supports victims, and campaigns for systemic change in the surveillance industry.

Question 2

Who founded Sentinel Alliance?

Accepted Answer

Sentinel Alliance was co-founded by five opensource developers: Joan Arus San Segundo (President), Jordi Baylina, Pau Escrich, Joan Matamala, and Xavier Vives. All five were targeted by state-sponsored surveillance using Pegasus and Candiru spyware between 2019 and 2021 while building privacy-preserving technology such as the Vocdoni universally verifiable voting protocol.

Question 3

Where is Sentinel Alliance based?

Accepted Answer

Sentinel Alliance is registered as a Swiss non-profit association (Verein) at Bahnhofstrasse 20, 6300 Zug, Switzerland, under registration number CHE-380.634.236.

Question 4

What is mercenary spyware?

Accepted Answer

Mercenary spyware refers to commercially developed surveillance software sold by private companies to government clients. Unlike traditional intelligence tools developed in-house by agencies, mercenary spyware is manufactured and marketed for profit. Products like Pegasus (by NSO Group) and Candiru (by Saito Tech/Candiru Ltd.) can silently infiltrate smartphones, access messages, emails, photos, and activate cameras and microphones without the target's knowledge.

Question 5

What is Pegasus spyware?

Accepted Answer

Pegasus is a military-grade surveillance tool developed by Israeli company NSO Group. It exploits zero-day vulnerabilities to silently infiltrate smartphones (both iOS and Android) without any user interaction — known as a 'zero-click' attack. Once installed, Pegasus can access all data on the device, including messages, emails, photos, GPS location, and can activate the camera and microphone. The Sentinel Alliance founders suffered a combined 78+ documented Pegasus and Candiru attacks.

Question 6

What is Candiru spyware?

Accepted Answer

Candiru (also known as Saito Tech Ltd.) is an Israeli spyware vendor that develops surveillance software targeting computers and mobile devices. Joan Matamala, a Sentinel Alliance co-founder, was the first person worldwide to have a live Candiru infection discovered on his device — making him 'patient zero' for Candiru detection. Microsoft's subsequent investigation led to patches protecting 1.3 billion devices worldwide.

Question 7

What is CatalanGate?

Accepted Answer

CatalanGate is the name given to the largest documented case of mercenary spyware abuse in European history. Revealed in April 2022 by The Citizen Lab at the University of Toronto, the investigation identified at least 65 individuals targeted or infected with Pegasus and Candiru spyware, including politicians, lawyers, journalists, and activists. The Sentinel Alliance founders are among the documented victims of this surveillance operation.

Question 8

What legal action has Sentinel Alliance taken?

Accepted Answer

On April 30, 2025, Sentinel Alliance filed a criminal complaint in Barcelona courts against CNI (Centro Nacional de Inteligencia), Guardia Civil, NSO Group, and Candiru Ltd. under Articles 197.2, 197 bis, and 197 ter of the Spanish Penal Code. The complaint was accepted by Barcelona courts on September 15, 2025, marking the first criminal prosecution of intelligence agencies and spyware vendors in Europe.

Question 9

What did the Barcelona court rule?

Accepted Answer

On January 27, 2026, Judge Julia Tortosa Garcia-Vaso of Barcelona Court of Instruction No. 2 placed eight persons under formal investigation: former Guardia Civil directors Felix Vicente Azon Vilas (2018-2020) and Maria Gamez Gamez (2020-2023), former CNI director Paz Esteban Lopez, NSO Group executives Shalev Hulio and Yuval Somekh, and Candiru/Saito Tech executives Eran Shorer, Ya'akov Weizman, and Eitan Achlow. International letters rogatory were issued to Israel and Luxembourg.

Question 10

Who are the defendants in the case?

Accepted Answer

The defendants include Spanish intelligence agency CNI (Centro Nacional de Inteligencia), the Guardia Civil, Israeli spyware company NSO Group (manufacturer of Pegasus), and Candiru Ltd./Saito Tech (manufacturer of Candiru spyware), along with their respective executives. This is the first time former heads of Spanish security services and spyware company executives have been formally investigated for illegal surveillance in Europe.

Question 11

What charges were filed?

Accepted Answer

The criminal complaint was filed under Articles 197.2, 197 bis, and 197 ter of the Spanish Penal Code. These articles cover Discovery of Informatics Secrets (unauthorized access to personal data), Illegal Computer Access (unauthorized interception of communications), and Aggravating Factors for Public Officials (enhanced penalties when offenses are committed by government agents).

Question 12

Who are the targeted developers?

Accepted Answer

The five targeted developers are: Jordi Baylina (creator of Circom, founder of Hermez, suffered 34 Pegasus attacks), Joan Arus San Segundo (co-founder of Vocdoni, targeted by Guardia Civil phone tapping and physical surveillance), Pau Escrich (mesh networking expert, 4 Candiru and 1 Pegasus attacks), Joan Matamala (discovered first live Candiru infection, 17 Pegasus attacks and 1 Candiru infection), and Xavier Vives (co-founded Vocdoni, 17 Pegasus and 6 Candiru attacks). Elies Campo, a Fellow at The Citizen Lab, was also targeted along with his family members.

Question 13

Why were the developers targeted?

Accepted Answer

Spanish authorities cited the developers' creation of open-source digital voting tools — specifically the Vocdoni universally verifiable voting protocol — as justification for surveillance. The developers were building privacy-preserving technology for democratic participation, including decentralized governance tools. Their work on blockchain privacy, zero-knowledge proofs, and censorship-resistant infrastructure was treated as a threat by intelligence agencies.

Question 14

How many attacks were documented?

Accepted Answer

A total of 78+ spyware attacks were documented against the five Sentinel Alliance founders between 2019 and 2021. Jordi Baylina alone suffered 34 Pegasus attacks. Additionally, Elies Campo's family was targeted with 13 Pegasus infections (8 on his mother, 4 on his sister, 1 on his father) — none of whom were under any judicial investigation.

Question 15

How does this affect open-source developers?

Accepted Answer

The Sentinel Alliance case demonstrates that developers building privacy-preserving open-source tools can be subjected to illegal state surveillance. This creates a chilling effect on the entire open-source community: if governments can deploy military-grade spyware against developers for writing code, it threatens the foundations of open-source software development and digital rights worldwide. The legal precedent being established in Barcelona aims to protect developers from such persecution.

Question 16

What legal precedent does this set?

Accepted Answer

This is the first criminal prosecution of intelligence agencies and spyware vendors in Europe. The Barcelona court's acceptance of the complaint and formal investigation of former security directors and spyware executives establishes that state actors and private spyware companies can be held criminally accountable for illegal surveillance. It sets a precedent for other victims to pursue legal action against mercenary spyware operators.

Question 17

How can I support Sentinel Alliance?

Accepted Answer

You can support Sentinel Alliance in several ways: donate to fund legal proceedings and victim support through the website at sentinelalliance.org/contribute, share information about the case and mercenary spyware abuse on social media, contact your representatives about surveillance regulation, and stay informed about developments in the fight against mercenary spyware through the Sentinel Alliance website and resources.

Question 18

How can developers protect themselves from spyware?

Accepted Answer

Developers should keep all software and operating systems updated to patch known vulnerabilities, use hardware security keys for authentication, enable Lockdown Mode on Apple devices, be cautious with links and attachments even from known contacts, use secure communication tools with end-to-end encryption, regularly audit device security, and stay informed about emerging threats. Organizations like The Citizen Lab and Amnesty International's Security Lab offer resources for at-risk individuals.

Frequently Asked Questions

About the Organization

The Case

Spyware

Developer Impact

Get Involved