In spring last year, Sergi Miquel Gutiérrez realised something odd was going on with his mobile.

“I remember some issues, for example losing some information on WhatsApp, and losing emails and having them appear in places I didn’t put them,” he said.

The glitches upset Gutiérrez but, given his day job, they also made him suspicious.

Gutiérrez works for the Council for the Republic, the Waterloo-based organisation set up by the former Catalan regional president Carles Puigdemont, who fled Spain to avoid arrest after staging a unilateral and illegal independence referendum in October 2017.

Fairly certain that the mobile was being monitored, Gutiérrez changed his phone.

He was not the only one to sense something was amiss at the time. In Barcelona, the pro-independence speaker of the Catalan regional parliament was also having technical difficulties.

“I noticed some strange things – especially with WhatsApp; messages and conversation histories were deleted,” Roger Torrent recalled earlier this week. “The same thing wasn’t happening to the mobiles of those around me, so it seemed to be an issue that only affected me.”

Neither man could have known that there was evidence that they, and at least three other people in the Catalan independence movement, were in fact being targeted with spyware so powerful it can infiltrate a mobile phone without a target clicking on an infected link.

Once a mobile has been infected, the Pegasus spyware, which was developed by the Israeli NSO Group and is the spyware believed to have been used against the Catalans, can give operators access to encrypted messages, emails and conversations.

Five days after a joint investigation by the Guardian and El País revealed the use of Pegasus in Spain and beyond, the obvious question lingers: who had been using it to target Catalan independence campaigners?

Torrent and another prominent target – the former Catalan foreign minister Ernest Maragall – quickly reached a conclusion. On Thursday, the pair announced legal action against Félix Sanz Roldán, who was the head of Spain’s National Intelligence Centre (CNI) at the time of the targeting in April and May last year.

Torrent has claimed the revelations are proof of the Spanish state’s “dirty war” on political opponents, while Maragall has invoked Watergate, calling the matter “an absolutely definitive Catalangate”.

Roldán told the Guardian the CNI “always acts with the most scrupulous regard for the law”, saying he had nothing more to add.

The interior ministry also said the actions of state security forces were always conducted “with the utmost respect for the law”.

It added: “Neither the interior ministry, nor the national police, nor the Guardia Civil have ever had any relationship with the company that developed this program, and, as such, have never contracted its services.”

Speculation that the Pegasus software may have been purchased via a third party has mounted, as have calls for a thorough investigation.

According to a report by El País, the interior ministry spends €15m a year on its Legal Telecommunications Interception System, knows as Sitel. The system allows the police and Guardia Civil to access thousands of calls and messages once judicial permission has been obtained.

In an interview with the Guardian on Thursday, the Podemos leader and deputy prime minister, Pablo Iglesias, said the use of spyware to target opponents was “unacceptable in a democracy”. Iglesias said a parliamentary commission needed to “investigate all the instances of spying that have taken place in our country because it’s part of the job of cleansing and democratic regeneration”.

The justice minister, Juan Carlos Campo, has also said that any possible breach of the law will need to be “looked into and investigated”.

However, it remains to be seen how much weight the Socialist-led coalition government will give the matter at a difficult and delicate time. The day after the story broke, the weekly post-cabinet government press conference was dominated not by questions about Pegasus, but by queries about Covid-19 and the ongoing scandal surrounding the finances of the former king Juan Carlos.

The week has also seen Spain mourn its 28,000 coronavirus dead amid continuing outbreaks of the disease and growing fears about its economic impact.

News of the targeting comes at a crucial time for the independence movement, which has lost momentum and descended into squabbles and splits over the best way forward.

With Catalonia set for a possible regional election this autumn, its pro-independence government will be looking to mobilise the separatist vote and put the issue of sovereignty back on the European agenda.

Many would question the democratic credentials of a movement whose leadership ignored the Spanish constitution to press ahead with an illegal vote – not least because polls suggest the project has never attracted majority support in the region.

But the claims over the use of Pegasus raise inescapable questions about the rule of law and fundamental democratic precepts.

As the journalist Neus Tomàs wrote in the online paper elDiario.es: “Officially, the use of this highly controversial software is restricted to investigations into organised crime and terrorism. But its use has been documented against journalists, activists and NGO workers in countries such as Saudi Arabia, Mexico and Morocco. Now it would appear that whoever has used it here has also crossed a red line.”

Torrent has said that while people may think the independence movement “exaggerates or that it wants to play the victim … Spanish democrats need to ask themselves if they feel comfortable with all this”.

Gutiérrez is also seething, if not altogether surprised, over what has happened.

“It’s incredible because I am a normal citizen, not even a politician,” he said. “Working with Mr Puigdemont, who is the most wanted person by the Spanish state, puts you at some risk. Because you are in a war without guns.”

Despite recent landmark trials over political corruption on both the left and right, the conviction of Juan Carlos’s son-in-law on charges of fraud and tax evasion and the recently announced supreme court investigation into the former king, Gutiérrez does not expect a proper inquiry into Pegasus.

“There will be no investigation for sure,” he said. “You will see.”

Inquiry or not, it may turn out that one of the buckets used to try to extinguish the flames of the Catalan independence movement was filled with petrol rather than water.