Greek court convicts four spyware executives, but European spyware cases lack convictions

A Greek court convicted four executives linked to Intellexa, including founder Tal Dilian, the company behind Predator spyware, on February 26, sentencing them to up to eight years in prison with terms suspended pending appeal.

The Athens convictions are the first of their kind in Europe for spyware executives. Except in Greece, none of the spyware cases documented by IrpiMedia has led to a criminal conviction. Investigators have not identified who ordered the surveillance against Greek journalist Koukakis and others.

Koukakis says investigators identified the Predator spyware and its operator without identifying who ordered the attacks. The Supreme Court prosecutor refused to reopen his case on April 27, after an Athens court referred it for further investigation. Koukakis challenged the decision and brought his case against Greece before the European Court of Human Rights.

Court records show about one-third of individuals targeted in 2020 and 2021 were also subject to Greek intelligence surveillance, a link suspected by Koukakis. Victims were lured using fake appointment messages and article invitations, according to Koukakis. He believes he may have become a target because of his reporting on legal changes that allegedly helped people tied to financial crimes. Greek authorities deny using Predator, arguing no law regulated it at the time.

Victims in Spain and Hungary say authorities have denied them basic information about surveillance by citing national security. Hungarian journalist Szabolcs Panyi was told by Amnesty’s Security Lab and Citizen Lab that Pegasus monitored him for seven months in 2019 while about 100 megabytes of data moved to and from his phone. Panyi says the civilian intelligence agency keeps classified information about him, and he says every request he has made was blocked on national security grounds. He argues that Hungarian law makes it legal to spy on anyone because the justice minister, a government member, authorizes it.

Polish MEP Krzysztof Brejza says his phone was infected with Pegasus while he led the election campaign against Poland’s then-ruling Law and Justice party. Brejza says attackers read 85,000 messages spanning 10 years and changed some conversations. “They gained access to 85,000 messages, covering the last ten years of my private and professional life,” Brejza says. National television broadcast altered exchanges to discredit him, which he says was aimed at interfering in the election by weakening democracy.

Poland’s anti-corruption bureau requested the surveillance to investigate Brejza’s father, a mayor, but prosecutors in Gdansk later found no grounds for that investigation. A Polish parliamentary inquiry concluded in October 2026 that the spyware purchase was unlawful and that it was used against political opponents. Brejza has won only civil cases so far, with a broadcaster forced to apologise and pay damages, while criminal investigations continue slowly. Brejza says the system offers little transparency and no clear process for victims seeking justice.

Citizen Lab reports that spyware infected phones belonging to at least 65 people connected to the Catalan independence movement, mainly from 2017 to 2020. The victims included four members of Òmnium Cultural, and the legal case was dismissed before being reopened on appeal. In 2022, Spain’s ombudsman confirmed that intelligence services lawfully monitored 18 independence movement members. Elena Jiménez of Òmnium argues that judicial approval does not automatically make surveillance lawful, and warns that even progressive governments are able to spy on political opponents.

Forbidden Stories led an international investigation in 2021 showing many European activists, politicians and journalists were targeted with Pegasus spyware developed by NSO Group. NSO Group says it sells Pegasus only to government intelligence and law enforcement agencies.

On June 15, 2023, the European Parliament’s PEGA inquiry committee backed recommendations that included an EU fund to cover victims’ legal costs and an independent lab offering free legal, technical and forensic support. Member states received a request to strengthen safeguards, tell surveilled people they were targeted, guarantee effective remedies and allow independent bodies to access data for abuse investigations. Green MEP Saskia Bricmont says three years after the recommendations, nothing has been done by the Commission or member states, and governments hide behind national security.

Sophie in ‘t Veld, the former PEGA rapporteur, says governments learned they would face no consequences and that additional spyware cases have appeared since the inquiry, particularly in Italy. She criticizes the European Commission for supporting national governments rather than protecting victims. Rebecca White, a researcher at Amnesty International’s Security Lab, describes the experience as double victimization, with invasive hacking followed by dead ends in the justice system.

Ron Deibert, the founder of Citizen Lab, warns that spyware fuels a worldwide pattern of abuse, silencing victims and undermining democratic accountability. Experts argue that effective safeguards and oversight still do not exist in Europe, and they call for greater transparency plus a method to identify who orders and conducts surveillance.

Italian journalist and activist Luca Casarini was targeted with Paragon’s Graphite spyware. Citizen Lab found Italian phone numbers among targets of Paragon Solutions, an Israeli company later acquired by a US investment fund, in 2025. Graphite is commercial spyware from Paragon Solutions that can infect a phone without the owner clicking a link, opening a file or downloading anything on purpose.

Paragon was established in Israel in 2019 with backing from former Israeli Prime Minister Ehud Barak and founders including Ehud Schneorson, a former commander of Israel’s Unit 8200. In December 2024, Florida-based private equity firm AE Industrial Partners reportedly agreed to acquire Paragon for at least $500 million. Citizen Lab examined corporate records showing Paragon’s shares transferred to a US parent company on Dec. 13, 2024. Graphite belongs to the same mercenary spyware category as Pegasus, with private companies selling tools to government intelligence and law enforcement agencies.

Paragon reportedly built Graphite mainly to gather information from messaging apps instead of taking full control of every phone function. Once installed, Graphite can potentially collect information from apps such as WhatsApp and Signal, which use end-to-end encryption, by reading messages after the apps decrypt them. Since phones automatically check incoming messages and files prior to display, zero-click attacks require no mistake by the target.

An attacker sends specially designed data that exploits a hidden flaw in that inspection process, allowing spyware to run inside legitimate applications. The operator can receive messages and other private information from Graphite while the owner neither sees nor opens anything. Researchers have confirmed that Graphite attacks work through WhatsApp and iMessage, but the full method is still secret.

In late 2024, Citizen Lab assisted WhatsApp in identifying and blocking an active Graphite zero-click exploit. WhatsApp notified roughly 90 users in January 2025 that their accounts were targeted by Paragon’s spyware, and said recipients were journalists and civil society figures across more than 20 countries.

A technical report reviewed by prosecutors in Rome and Naples in March 2026 found spyware traces on phones belonging to Francesco Cancellato, Luca Casarini and Giuseppe Caccia, dating to the early hours of Dec. 14, 2024. Investigators found no corresponding record for Cancellato, but they found operations against Casarini and Caccia on a Paragon server linked to Italy’s domestic intelligence agency.

Italy’s parliamentary intelligence committee confirmed that Italian agencies deployed Graphite against Casarini, Caccia and other immigration activists, calling the surveillance legally authorized and connected to immigration and national security. The committee concluded Italian intelligence agencies had not used Graphite against Cancellato. The Italian government pointed to suspected help with irregular immigration, while Casarini says the real reason was their evidence of migrant abuses in Libya and Tunisia. All three cases were ruled lawful by Italy’s parliamentary oversight body.

Paragon said authorities declined an offer to check whether Graphite had been used illegally against Cancellato, so it ended its Italian contracts. Italian officials said the termination had been agreed by both sides, adding that a foreign private company inspecting intelligence records would expose classified information. In February 2026, a Paragon lawyer shared a LinkedIn photo showing Graphite’s control panel on a big screen, with a Czech number labeled Valentina and interception records from Feb. 10.

The dashboard appeared to show categories for applications, accounts and media, with icons or interfaces associated with WhatsApp, Signal, Telegram and LINE. Paragon says it sells Graphite only to screened state bodies in democratic countries and bars customers from going after journalists or civil society figures illegally. The Italian cases exposed the limits of contractual restrictions, since the public usually cannot see warrants, target lists, audit records or evidence justifying individual surveillance. Graphite can let investigators reach communications unavailable through conventional searches, and it can put a political opponent, activist or journalist under surveillance with no obvious warning.

In September 2024, US Immigration and Customs Enforcement entered a $2 million agreement with Paragon. The public contract summary did not name Graphite or reveal the surveillance capabilities ICE intended to acquire. The government first put a stop-work order in place as officials checked whether the deal met the terms of a 2023 executive order on commercial spyware linked to security or human rights risks.

In August 2025, the government lifted the stop-work order so the ICE contract could proceed. Neither ICE nor Paragon publicly explained the governing safeguards, who might be targeted or whether it would be used inside the United States.