Spied on by governments with Israeli spyware: in Europe, no one pays the price

It took almost five years for Thanasis Koukakis, a Greek journalist, to obtain a ruling acknowledging what had happened. He had been spied on using Predator, spyware that, once installed on his phone, gave whoever was monitoring him access to his contacts, documents and messages, and even allowed them to activate his camera and microphone.

A first victory came on February 26, when four executives linked to Intellexa, the company that sold the spyware, were convicted. Among them was its founder, Tal Dilian, a former commander in Israeli military intelligence. They face up to eight years in prison for illegal access to computer systems, violations of personal data and breaches of the secrecy of telecommunications.

It is the first criminal conviction of its kind in Europe. But it remains an exception, as interviews conducted by IrpiMedia with five spyware victims in five European countries — Greece, Spain, Poland, Hungary and Italy — show.

The first scandal emerged in 2021, when an international investigation coordinated by Forbidden Stories revealed that the devices of dozens of European activists, politicians and journalists had been targeted with Pegasus, spyware developed by Israeli giant NSO Group, which says it sells only to government intelligence agencies and law enforcement. Then other spyware companies came to light. And new cases followed.

One of the latest abuses emerged in 2025, when analyses by Citizen Lab, a research laboratory at the University of Toronto, revealed that Italian phone numbers were among the targets of software developed by Paragon Solutions, an Israeli company later acquired by a US investment fund.

Yet, with the exception of Greece, none of these cases has resulted in a criminal conviction. In Spain and Hungary, victims say they have been unable even to obtain basic information about the surveillance they were subjected to, with authorities citing “national security.”

Rebecca White, a researcher at Amnesty International’s Security Lab, which works to protect civil society from emerging forms of surveillance, describes this as “double victimization.”

“First, you are targeted with one of the most invasive technologies in the world, suffering a massive violation of your privacy and your rights. Then you are victimized again when, in seeking justice and redress, you find one dead end after another” White tells IrpiMedia.

“We keep talking about rules and safeguards, which are obviously essential. But by focusing on prevention, we forget the many victims who have no access to adequate remedies. There is very little available to them: they can turn to courts in their own countries or to bodies established under international treaties, such as the European Court of Human Rights. But proceedings like these take years and require significant resources. Even when money is not an issue, and it almost always is, there is still the psychological burden of an exhausting search for any form of redress, while access to justice continues to be obstructed”, she adds.

The failure of the PEGA committee

Yet the recommendations of the European Parliament inquiry committee set up after the Pegasus scandal, adopted on June 15, 2023, also included measures for victims of this kind of surveillance. The European Commission was urged to propose legislation and create support mechanisms, including an EU fund to cover legal costs and an independent laboratory able to provide free legal and technical assistance, examine phones and produce forensic analyses for judicial investigations.

Member states were asked to strengthen safeguards, investigate abuses and ensure access to justice. Parliament also recommended notifying people who had been placed under surveillance, guaranteeing effective remedies and allowing independent bodies access to the data needed to investigate abuses.

Three years later, “nothing has been done. There has still been no follow-up from either the European Commission or the member states. That has been the biggest failure,” says Saskia Bricmont, a Green member of the European Parliament who served on the PEGA committee.

“By hiding behind national security, member states do not want to comply with transparency rules or introduce additional safeguards or restrictions on the use of such invasive commercial spyware.”

For Sophie in ’t Veld, the former PEGA rapporteur, the situation has actually worsened.

“When national governments realized there would be no consequences for spyware abuses or illegal exports, why would they worry?” she says. “There have been more cases since the PEGA inquiry, particularly in Italy. It is clear that they feel safe, untouchable.”

For her, this comes as no surprise. “Even during the European Parliament inquiry, national governments refused to cooperate. Their position was: this is a matter of national security, it has nothing to do with the European Union, let alone the European Parliament. All governments defended what they see as their prerogative: whether or not to use spyware.” Her assessment of the European Commission is blunt: “It was weak and cowardly. It sided with national governments and refused to act.”

Half-victories

“The system is not designed to help victims: there is no transparency and there are no clear procedures,” says Krzysztof Brejza, a Polish member of the European Parliament from the European People’s Party group.

Brejza experienced this himself. When his phone was infected with Pegasus, he was running the election campaign against Law and Justice, then Poland’s ruling party.

“They gained access to 85,000 messages, covering the last ten years of my private and professional life. Because they found nothing against me, they went further and manipulated my conversations. Altered exchanges were broadcast by national television to discredit me. The aim was to interfere in the election by weakening democracy,” Brejza tells IrpiMedia.

The surveillance had been requested by Poland’s Central Anti-Corruption Bureau. For years, the operation was presented as legitimate because it was linked to an investigation into Brejza’s father over alleged irregularities in the administration of the municipality where he was mayor. However, an audit by prosecutors in Danzica later found the allegations to be unfounded and the investigation was dropped. “It was just a pretext to justify the surveillance,” Brejza says.

In October 2026, a parliamentary inquiry committee set up in Poland after Donald Tusk took office to investigate the use of Pegasus under the previous government concluded that the spyware had been purchased unlawfully and used against political opponents.

Yet Brejza’s only victories have come in civil court. The television broadcaster that aired the manipulated messages was ordered to apologize and pay him damages. The criminal investigations are still ongoing.

“In Poland, the justice minister is also the prosecutor general. Under the previous government, nothing moved. Now things are moving forward very slowly,” Brejza says.

Meanwhile, the former justice minister first obtained political asylum in Hungary and later moved to the United States.

In fact Koukakis, too, has achieved only partial justice since the court did not establish who ordered the surveillance.

“We documented the use of the weapon and identified the killer, but we still have not established who gave the order,” Koukakis says.

According to transcripts of the trial hearings reviewed by IrpiMedia, nearly one-third of the people targeted with Predator between 2020 and 2021 had also been subjected to traditional phone surveillance by the Greek intelligence services.

Koukakis does not believe the overlap was coincidental. “It was the same operation. To install the spyware on the phone, the victim had to click on a fake link. First they monitored us to understand our habits, and then they sent the lure messages,” he explains. 

One former Facebook manager, for example, had booked a Covid-19 vaccination when she received a fake text message about the appointment. Koukakis, meanwhile, received messages inviting him to read articles.

According to Koukakis, an economic affairs journalist, the motive behind his surveillance may lie in investigations he carried out in 2020 for CNN Greece and the Financial Times into changes introduced by the Greek government to the criminal code and tax legislation that allegedly benefited people involved in financial crimes.

Yet Greek authorities continue to deny using Predator. “They do not want to admit it because at the time there was no law regulating its use, so it was illegal,” Koukakis says.

In its February 26 ruling, the Athens court of first instance referred the case files to prosecutors to investigate further responsibility and possible more serious offences, including espionage. But on April 27, the Supreme Court prosecutor decided not to reopen the investigation.

Koukakis challenged the decision and, last August, filed an application against Greece with the European Court of Human Rights, arguing that the country’s judicial authorities had failed to investigate the case thoroughly and impartially.

“This legal battle requires an enormous investment of energy, time and money, including your own. You have to keep dealing with everyday life while also being present in court. It is like having to work 24 hours a day, seven days a week. That has been my reality for the past few years,” Koukakis says.

Information denied

For spyware victims, one of the main obstacles to seeking justice is the use of national security by state authorities to impose secrecy and avoid accountability. The European Parliament had recommended setting EU-wide limits on what can be justified on national security grounds. 

State authorities should be required to demonstrate that surveillance is necessary, proportionate and lawful, and disclose their reasoning to a national oversight body. But the victims’ stories suggest otherwise.

“In 2021, analyses of my phone by Amnesty Security Lab and Citizen Lab proved that I had been spied on with Pegasus for seven months, between April and November 2019. The software downloaded and uploaded about 100 megabytes of data from and to my device. That is all I know,” says Szabolcs Panyi, a Hungarian investigative journalist who has long investigated Russian influence on the government of Viktor Orbán, the nationalist right-wing leader who governed Hungary from 2010 until May 2026.

The discovery had a profound impact on Panyi’s personal and professional life. Since then, with the support of the Hungarian Civil Liberties Union, he has been trying to get answers to some basic questions.

“All we have managed to find out is that the government’s civilian intelligence agency holds classified information about me. But we do not know what kind of data it is, when it was collected or how. Every request has been blocked on national security grounds,” Panyi explains.

“It is a terrible feeling to know that your own state considers you a national security risk and uses such an invasive tool against you.”

According to Panyi, Hungarian law is so permissive that “anyone can be spied on legally. Surveillance justified on national security grounds is authorized by the justice minister, who is a member of the government. Anyone targeted without justification has no remedy: precisely because everything is legal, we have very few ways to challenge what happened.”

Yet the same problem has also emerged in Spain and Italy.

Elena Jiménez, head of international and legal affairs at Òmnium Cultural, an organization that promotes Catalan language and culture and Catalonia’s right to self-determination, is unequivocal: “The problem in Spain was not the lack of an adequate legal framework. The laws are quite restrictive. To intercept communications, the Spanish intelligence service must obtain prior authorization from a Supreme Court judge.”

Those safeguards did not protect the phones of people linked to Òmnium Cultural from Pegasus. A Citizen Lab report published on April 18, 2022, documented spyware attacks against at least 65 people connected to the Catalan independence movement, almost all of them between 2017 and 2020. They included four members of Òmnium Cultural, including Jiménez.

The surveillance took place at a particularly sensitive moment. The organization’s then-president, Jordi Cuixart, had been placed in pre-trial detention on October 16, 2017, two weeks after Catalonia’s independence referendum, in which more than two million people took part despite its suspension by Spain’s Constitutional Court.

“The people who were spied on were part of Cuixart’s inner circle and were working on his case. I was in contact with his lawyers and was responsible for international relations: I spoke with representatives of the Council of Europe, the United Nations and international human rights organizations. One was the organization’s vice president, Marcel Mauri. Another was the secretary of the board, also a lawyer, who visited Cuixart in prison. Then there was Cuixart’s wife, who is also a journalist,” says Jiménez.

For a long time, the legal proceedings stalled over a request for a new forensic examination of the victims’ devices, even though the infections had already been confirmed by an international team of researchers.

“They asked us to hand over our phones, but that would have been like handing our lives over to the police a second time. It was a paradox. We asked Citizen Lab for help and prepared copies containing only part of the data, but they refused them.”

According to Òmnium, the failure to hand over the devices led to the case being dismissed last February. That decision was later overturned after the organization appealed. A new step forward was announced only last October, when the Spanish government was asked to declassify documents that could shed light on the surveillance.

“So far, there has been almost no investigation. On the one hand, there is a lack of willingness from prosecutors, who have a duty to investigate. On the other hand, when they do try, they get no answers because everything is blocked by the state secrets law.”, Jiménez adds.

National security threats

In May 2022, the Defensor del Pueblo, Spain’s independent public authority responsible for protecting fundamental rights, found that Spanish intelligence services had placed 18 members of the Catalan independence movement under surveillance with judicial authorization. The list included Mauri and one other person from Òmnium Cultural.

But for Jiménez, surveillance is not necessarily legitimate simply because it has been authorized. “We are talking about spying on the vice president of a cultural organization. Simply invoking national security is not enough to make it lawful under international standards.”

“This is a serious case and it should make us all aware of one thing: not only right-wing governments, but progressive governments too can spy on citizens when they challenge their power. The surveillance exposed the legal strategy and the work of a civil society organization. It was an attack on our ability to exercise fundamental rights,” Jiménez concludes.

Across the Mediterranean, it was the Italian intelligence services carrying out the surveillance.

“I was classified as a national security threat. But why, and on the basis of what evidence?” asks Luca Casarini. An activist and co-founder of Mediterranea Saving Humans, an NGO involved in rescuing migrants in the Mediterranean, Casarini was placed under surveillance starting in 2019, along with Beppe Caccia, another founder of the organization.

Giorgia Meloni’s government later authorized the use of Graphite, Paragon’s spyware, against both of them. They discovered they had been targeted in January 2025 after receiving a notification from WhatsApp.

Intelligence activities targeting them had already begun under the second Conte government, backed by the Five Star Movement, the Democratic Party, Italia Viva and Free and Equal. They continued under Mario Draghi’s government and later under Meloni’s.

The official justification was suspected facilitation of irregular immigration into Italy.

Casarini, however, believes the real target was their collection of testimony and documents on crimes against migrants committed in Libya and Tunisia, and in particular abuses at Mitiga prison at the center of the allegations against Osama Almasri, a Libyan official wanted by the International Criminal Court for war crimes and crimes against humanity.

Almasri was arrested in Turin in January 2025, then released and flown back to Libya on an Italian state aircraft without being handed over to the Court.

Among those who have denounced his alleged responsibility is David Yambio, a Sudanese refugee and president of the Ngo Refugees in Libya, who was also targeted by Italian intelligence services.

Copasir, the parliamentary body that oversees Italy’s intelligence services, nevertheless concluded that the surveillance of Casarini, Caccia and Yambio was lawful and had been authorized by the Prosecutor General at the Rome Court of Appeal, as required by law.

“If spying on political activists for five years is lawful, then we are living in a police state,” Casarini counters, warning of “mass surveillance.”

In his office in Brussels, Wojciech Wiewiórowski, the European Data Protection Supervisor, keeps a book on his table: Ethics and the Future of Spying.

“As things stand, Europe still lacks the safeguards needed to ensure that spyware is used in a way that respects the privacy rights of those placed under surveillance, especially products like Pegasus, which are designed to exploit every technical possibility and collect as much information as possible,” Wiewiórowski tells IrpiMedia.

But he does not believe a moratorium would work. “EU member states will never give up these capabilities. We need to find a solution that combines European law with the decisions of member states.”

Koukakis is equally pragmatic.

“Spyware can be useful in addressing real threats, such as terrorism or crime. But we need tools that allow us to identify the end user of the product, so that, when necessary, we can trace who ordered the surveillance and who carried it out, even in real time,” the journalist tells IrpiMedia.

For Koukakis, that traceability should be “imposed at the European level.”

Rosita Rijtano is a 2026 Bertha Challenge Fellow. This investigation was carried out with the support of the Bertha Challenge Fellowship

Le inchieste e gli eventi di IrpiMedia sono anche su WhatsApp. Clicca qui per iscriverti e restare sempre aggiornat*. Ricordati di scegliere “Iscriviti” e di attivare le notifiche.