Sources and business records detail how Barcelona has emerged as an unlikely hub for spyware companies, raising concerns from digital rights groups
Toward the end of 2023, an Israeli security researcher from Tel Aviv said that he was approached on LinkedIn with an opportunity to work abroad with “good pay.” Bluesky: @zackwhittaker , @rondeibert , and @vaspanagiotopoulos.com . Mastodon: @lorenzofb@infosec.exchange Bluesky: Zack Whittaker / @zackwhittaker : Incredible reporting from @lorenzofb.bsky.social on how Barcelona became an unlikely hub for spyware startups and exploit makers. Critics say spyware makers on Europe's front door is a problem, given human rights abuses involving spyware deployed against EU citizens. — techcrunch.com/2025/01/13/h... Ron Deibert / @rondeibert : Only two and half years ago, we @citizenlab.ca uncovered a massive domestic surveillance operation in Spain 🇪🇸 — catalonia.citizenlab.ca — Now, perhaps ironically, Barcelona has become home to a thriving spyware industry. @lorenzofb.bsky.social investigates: … Vas Panagiotopoulos / @vaspanagiotopoulos.com : Having 🇪🇸Barcelona become a crucial regional outpost for offensive cybersecurity companies puts the #spyware problem squarely on the doorstep of 🇪🇺Europe, writes @lorenzofb.bsky.social. — techcrunch.com/2025/01/13/h... Mastodon: Lorenzo Franceschi-Bicchierai / @lorenzofb@infosec … : NEW: I looked into how Barcelona became an unexpected hotbed for spyware startups in recent years. — There are now companies led by Israelis, French, and Italian security researchers. We name some in the article. — Some people in civil society see this as a concerning development. …
Context & Ripple Effects
Commercial spyware has been documented as a dispersed market rather than a single-company problem: Google's TAG identified roughly 40 vendors in a survey of commercial spyware vendors, while Citizen Lab and Microsoft tied Tel Aviv-based QuaDream to iPhone targeting of journalists, politicians and an NGO worker in an earlier mercenary-spyware investigation.
The reporting makes Barcelona a new geographic focal point in that broader ecosystem. It matters particularly because civil-society groups already connect the sector's proximity to European institutions and users with risks of rights abuses inside the EU.
First-order effects
- Barcelona-based spyware firms and their leadership teams face greater public scrutiny as business records and sources bring their local concentration into view.
- Digital-rights groups gain a clearer basis to press Spanish and EU authorities on the presence of companies whose tools can be used to target citizens and civil society.
Second-order effects
- Recruitment of security researchers across Israel, France, Italy and Spain may receive more scrutiny, since the reporting points to cross-border talent flows supporting Barcelona-based operations.
- The disclosures can increase pressure on European policymakers to distinguish legitimate defensive-security work from the sale and operation of intrusive commercial surveillance capabilities.
Third-order effects
- If more spyware vendors establish operations inside EU jurisdictions, oversight debates may shift from controlling exports by foreign suppliers to governing a locally embedded surveillance-software industry.
- The pattern reinforces that sanctions or attention directed at individual vendors may not constrain the broader market when expertise, corporate structures and buyers can reorganize across borders.
The trend: Commercial spyware is becoming a geographically distributed, cross-border security industry, making accountability harder to achieve through company-by-company enforcement alone.