Spanish court to question witnesses over ‘illegal surveillance’ of WikiLeaks founder Julian Assange

A Spanish court investigating allegations that a security company illegally spied on visitors to WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London will hear evidence from lawyers and a computer security specialist.

Andy Müller-Maguhn, a computer security expert and former spokesman for hacking organisation the Chaos Computer Club, is due to give evidence by video-link on 26 October as part of an investigation into illegal surveillance at the embassy.

The court will also question lawyer Renata Ávila from Guatemala and Juan Branco, a French lawyer, on 26 and 27 October. They are two of at least 15 lawyers who are said to have assisted Assange.

Müller-Maguhn, who runs a company that develops cryptophones, is a personal friend of Assange, and visited the WikiLeaks founder regularly during his time at the Ecuadorian Embassy.

He is vice-president of the Wau Holland Foundation, which has supported journalistic activities connected to WikiLeaks since 2019.

In 2012, he appeared on Assange’s television show on RT, discussing the future of the internet and digital privacy, and was a contributor to Assange’s book Cypherpunks: Freedom and the future of the internet.

The Spanish National Court in Madrid is investigating allegations that UC Global, a company that provided security services to the Ecuadorian Embassy in London, illegally monitored Assange’s visitors, including lawyers, journalists and celebrities.

A criminal complaint filed by Assange’s lawyers on 29 July 2019 alleged that UC Global and its founder, David Morales, a former mercenary, committed crimes against privacy and breached attorney-client communications. Morales faces further allegations of bribery and money laundering.

Müller-Maguhn was priority target

According to court documents, Morales identified Müller-Maguhn as a priority target.

An email sent by Morales to UC Global workers on 10 December 2017 described Müller-Maguhn as one of “three profiles that must be controlled at all times”.

The other targets were German hacker Bernd Fix, also a board member of the Wau Holland Foundation, and “Russian citizens”.

“It is necessary that the operators who are there pay attention to them, that they warn us in advance if they pass through the embassy and when they schedule a visit,” said Morales’ email.

“You must also pay attention if they carry mobile phones, pen drives, computers or any electronic equipment. I understand that the protocol is that they leave their electronic equipment at the entrance,” he wrote.

Müller-Maguhn gave a presentation at the Chaos Computer Club on 30 December 2019, giving technical details of the surveillance in and around the Ecuadorian Embassy, largely based on the same evidence being examined by the Madrid court.

Judge José de la Mata, who is leading the investigation, will hear evidence from Renata Ávila, a lawyer from Guatemala, on 26 October.

UC Global’s workers at the embassy opened Ávila’s briefcase and photographed her electronic devices during visits to Assange, according to a criminal complaint filed by Assange’s lawyers.

Ávila was mentioned in an email sent by Morales to several UC Global workers on 21 September 2017.

In instructions to three of his staff, Morales warned that the Ecuadorian intelligence service, Senain, was investigating UC Global.

He asked them to be careful about sharing information about their trips to the US and to establish a secure communications system.

He also asked them to work to get information about the embassy’s Wi-Fi data and telephone list.

Morales, who had the contract to provide security services for the embassy – known as the “hotel” – asked for information about Assange, who was given the codename “Guest”.

Morales asked for details about the material used in the walls of Assange’s room in the embassy, and for photos of its interior to see the arrangement of the furniture.

“I need to see what composition the walls that surround the room of the Guest (brick, masonry, cement). Also, if it were possible, photos of the interior,” he said.

The email instructed UC Global to create profiles of people who regularly visited Assange at the embassy, or collaborated with him, including their personal data, their relationship with Assange, their telephone numbers, emails and number of visits.

List of targets

The list of targets included Ávila and other lawyers who visited Assange, the Pasarelli brothers – referring to the Guatemalan documentary maker Juan Passarelli, WikiLeaks editor Sarah Harrison and philosopher Srećko Horvat.

Morales showed a particular interest in Stella Moris, a member of Assange’s legal team. Her relationship with Assange became public in April 2020, when she disclosed that she was the mother of two of his children, conceived while Assange was confined to the embassy.

Morales requested: “Special attention on STELLA MORRIS... we believe that it is a false name.”

There was a rumour, he wrote in the email, that Morris had had a baby with Assange. 

“If necessary, I want a person dedicated to this activity fully, so if you have to hire someone for it, tell me,” he wrote.

Former head of UC Global operations to be questioned

Michel Wallemacq, former head of operations at UC Global, is also due to give a statement to the court.

Initially, the Spanish judge summoned Wallemacq to testify as a witness, in an order dated 18 June.

Two months later, the judge decided to charge him with crimes against privacy and against the secrecy of communications between Assange and his lawyers.

Wallemacq was responsible for UC Global’s staff at the Ecuadorian Embassy in London, under the direction of Morales.

According to the order, seen by Computer Weekly, during Wallemacq’s testimony as a witness, “it was revealed the possibility that Wallemacq, a close collaborator of  David Morales, had participated directly in the execution of the events [at the embassy]”.

He is alleged to have passed on orders to the rest of the workers to retain and photograph the documentation and electronic devices of people who visited Assange.

Wallemacq is also accused of giving instructions to UC Global staff to record and prepare reports on meetings that Assange held at the embassy.

Wallemacq received an 1.1MB encrypted email on 8 January 2017 with the subject line “Aitor Martínez Documents”, according to court filings.

The file is alleged to contain documents relating to Aitor Martínez, a lawyer representing Assange in Spain.

Wallemacq was initially summoned to testify as a defendant on 9 September, but the hearing was postponed.

UC Global ‘collected 500 identity documents’

French lawyer Juan Branco will testify before the judge on 27 October.

Scanned passports belonging to Branco are included in a file of about 500 identification documents of people who visited Assange between 2015 and 2018 collected by UC Global, along with scanned documents belonging to Ávila and Müller-Maguhn.

Photographs of Müller-Maguhn’s cryptophone mobile phones were among the documentation taken from the company’s server.

The three will testify before the judge as witnesses, but also as possible victims of the espionage carried out by UC Global.

“There are elements that allow us to affirm that these people may have been harmed by these events, having been the targets of Morales Guillén’s practices,” a court order from judge De la Mata states.

Journalist and former diplomat Craig Murray is waiting for a new date to testify in person at the Spanish National Court.

Murray, who was British ambassador to Uzbekistan between 2002 and 2004, when he was put under pressure to stand down after denouncing the widespread practice of torture in that country.

Murray’s passport was scanned and stored by UC Global staff five times between June 2016 and December 2017.

The judge originally ordered a statement from Murray in late July, along with WikiLeaks spokesperson Kristinn Hrafnsson and former Greek economy minister Yanis Varoufakis.

Aitor Martínez, who represents Assange in Spain, said the court had agreed to hear statements from about 30 people requested by Assange’s lawyers.

These included US Congressman Dana Rohrabacher, and Assange’s friends Pamela Anderson and Stephen Hoo, an actor.

Zohar Lahav, head of security at casino group Las Vegas Sands, run by Sheldon Adelson, has also been asked to give evidence.

Two former employees of UC Global gave anonymous witness statements to the Spanish court and to Assange’s extradition trial at the Old Bailey in September.

They claim that Morales had a side deal to supply “American friends” with surveillance footage from the Ecuadorian Embassy, through an arrangement with Las Vegas Sands.

The former employees have suggested that surveillance material was ultimately passed on to US intelligence – a claim the Spanish court is investigating.

However, the National Court judge has not agreed to a request to hear evidence from Adelson, owner of Las Vegas Sands, and its head of security, Brian Nagel.

Two other people of interest to the Spanish investigation have not been identified – Eddy “El Moro” and Matthew.

Spain asks for US co-operation

The Spanish judge agreed to issue a request for assistance to the US in an order dated 18 June 2020.

The court is seeking information on the ownership and location of a series of IP addresses that accessed the UC Global FTP server between 16 and 18 January 2018.

A trial attorney at the US Department of Justice’s Office of International Affairs has asked judge María de las Heras for information to demonstrate how the IP addresses are relevant to the Spanish court’s investigation.

In a letter sent on 17 July, the US presented the judge of the Spanish National High Court with a detailed list of questions about the investigation (see box below).

The US Justice Department gave the Spanish judge until 16 October to respond.