State Espionage in the EU: journalists targeted by Paragon spyware in 14 EU Member States

Journalists and civil society representatives in 14 EU member states have been spied on via mobile phones by their respective governments, according to information presented two days ago by John Scott-Railton, a senior researcher at Citizen Lab, who presented forensic evidence of the illegal use of Paragon spyware in Europe, which highlighted the need for strict regulation at EU level to prevent such abuses. The journalists were spied on using Graphite software, developed by Israeli company Paragon Solutions. According to Citizen Lab, more than 90 civil society members were targeted by this sophisticated software, capable of intercepting encrypted messages and phone calls without the users being aware of it.

The countries affected include Italy, Germany, Spain, Greece, Belgium, Austria, Denmark, the Netherlands, Portugal, Sweden, Cyprus, Latvia, Lithuania and the Czech Republic.

In Italy, the cases were particularly serious: Luca Casarini, co-founder of the migrant rescue organization Mediterranea Saving Humans, and journalist Francesco Cancellato of the publication Fanpage were notified by WhatsApp that their devices had been compromised by Graphite. Fanpage is known for its investigations into far-right politicians, and Casarini's work has often been criticized by the Italian government for its migrant rescue operations in the Mediterranean. Among those spied on by the government led by Giorgia Meloni are Beppe Caccia, co-founder of the NGO Mediterranea Saving Humans, who has strongly criticized Italy's alleged complicity in migrant abuses in Libya; Father Mattia Ferrari, a chaplain on board one of the NGO's migrant rescue ships and known for his close ties to the late Pope Francis; and David Yambio, a human rights activist based in Italy.

While the Italian government acknowledged a contract with Paragon for national security purposes, it denied using the software to spy on journalists or activists. However, Paragon suspended the contract with Italy, citing non-compliance with clauses prohibiting the product from being used against civil society.

The information on the spying on journalists was presented by the Citizen Lab representative at the meeting of the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE), at the beginning of which Hannah Neumann, a German MEP from the Greens political group, distributed photos of Italian journalists to members in protest at the fact that MEPs from the European People's Party (EPP) and the European Conservatives and Reformists (ECR) group - which includes Giorgia Meloni's far-right party, Brothers of Italy - blocked efforts to hear victims of illegal spying in the Commission.

"Before the meeting began, some materials were distributed - I think by a colleague from the Green Group - regarding the Paragon spyware case. I don't think it's particularly appropriate, especially since this distribution did not respect the rules of procedure of this committee," protested Italian MEP Alessandro Ciriani, from Giorgia Meloni's Brothers of Italy party, and the chairman of the meeting immediately ordered the Quaestors to collect the leaflets from the meeting room.

"I am the person responsible for distributing these leaflets. These leaflets present victims of the Paragon spyware scandal in Italy. For reasons I don't understand, I cannot be present at the meeting," said Hannah Neumann.

"If we brought photos today (of the victims), it is because the victims are real. They exist and they must testify about the consequences on their lives of being spied on. The fact that you refused to hear them is a real shame for the European Parliament," added Saskia Bricmont, a Belgian Green MEP.

Representatives of the Alliance of Socialists and Democrats criticized the spying on journalists and said that there was no legal basis for the spy programs to be used against them, because "journalists are not terrorists." Moreover, S&D MEPs stated that the Paragon program was used in 115 countries around the world.

The move comes after it was revealed earlier this month that an Italian journalist - whose news organization uncovered young fascists in Italian Prime Minister Giorgia Meloni's far-right party - had been targeted by sophisticated "mercenary spyware", according to a notification from Apple. Ciro Pellegrino is believed to be the sixth person in Italy who have been targeted by spyware, implemented by state actors, according to its editor-in-chief, Francesco Cancellato, and four other members of civil society and activists.

Furthermore, John Scott-Railton stated in the LIBE Committee that at least 10 MEPs had been targeted by spyware, but noted that the number of MEPs involved would be much higher.

"We also don't know the real number of member state officials who have been spied on, only a fraction of these places are public," said John Scott-Railton, who added: "European governments are of course paying the price for this inaction in the eroding of their own national security and, to make matters worse, many of the official targets were never notified and have no idea that they have been targeted. The technology is sold to states, and they decide who gets spied on. Paragon told us that it sells the software to governments that request it, but I don't know what those governments do with it."

Speaking at the LIBE hearing, Helen Charles, WhatsApp's director of public policy, stressed that the EU has yet to take decisive regulatory action, despite consistently stressing the importance of data privacy.

"This has allowed spyware companies to operate in a grey area, with minimal safeguards - often insufficient to prevent human rights abuses, let alone comply with data protection law. We believe it is essential that EU data protection standards are applied and that an appropriate legal basis is required before companies can collect, store or transfer data of EU citizens," said the WhatsApp spokesperson. She added that the EU should require transparency regarding spyware clients - including requiring spyware companies to keep information about their customers and to audit and provide records of targeting carried out through their products.

International human rights organisations such as Amnesty International have strongly condemned the widespread use of Graphite spyware against journalists and human rights defenders in Europe, calling for urgent action to protect civil liberties.

These revelations highlight a growing crisis over the use of surveillance technologies in Europe - the Paragon case is the second after Pegassus - and the need for decisive measures to protect citizens' fundamental rights.