Activists from Mediterranea Saving Humans were subjected to years of digital monitoring by Italian officials who alleged their humanitarian work facilitated irregular immigration into the country. This specific instance of state-sponsored surveillance highlights a broader, more alarming trend across the European continent, where the boundary between legitimate law enforcement and the suppression of civil dissent has become increasingly blurred. The rapid proliferation of sophisticated, Israeli-made spyware tools has fundamentally shifted the power dynamic between sovereign states and their citizens, granting governments unprecedented access to the private lives of individuals without traditional oversight. These digital weapons, including the notorious Pegasus and Predator systems, allow for the total compromise of a target’s digital existence, including encrypted communications, real-time location tracking, and the surreptitious activation of microphones and cameras. As these technologies become more accessible to various intelligence services, the protection of democratic norms and the fundamental right to privacy are facing their most significant challenge in the digital age.
The systematic deployment of these tools against journalists, activists, and political figures marks a troubling departure from established democratic standards within the European Union. While national authorities consistently cite “national security” as the primary justification for deploying such invasive measures, recent investigative findings suggest a more calculated and political motive: the intimidation of civil society and the silencing of investigative journalism. This friction between state power and the fundamental human rights of individuals reveals a growing crisis of accountability that transcends national borders. The lack of a unified European response has allowed a lucrative market for commercial spyware to flourish, where technology firms provide the weapons and governments provide the targets, often with zero public debate or legislative authorization. This shift has essentially transformed the modern smartphone into a ubiquitous surveillance device, capable of harvesting a decade’s worth of personal history in a single infection, thereby creating an environment of permanent digital vulnerability.
The Greek Precedent and the Mechanics of Deception
Legal Milestones: Accountability in the Athenian Courts
Greece provides a landmark case study in the fight for legal accountability, featuring the first criminal conviction related to commercial spyware misuse within the European Union. In early 2026, a court in Athens sentenced four executives associated with Intellexa, the company responsible for the Predator spyware, to prison for their roles in illegal computer access and the violation of telecommunications secrecy. This judicial milestone was primarily driven by the persistence of Thanasis Koukakis, a financial journalist who discovered his device had been compromised after investigating government corruption and banking scandals. The ruling sent a clear signal that the commercial sale and deployment of invasive surveillance tools could indeed carry criminal consequences, challenging the perceived invincibility of the private intelligence sector. It demonstrated that when forensic evidence is presented effectively, the legal system can occasionally pierce the veil of secrecy surrounding high-tech espionage operations.
However, despite these historic convictions, many observers viewed the victory as incomplete because the most critical layers of political and institutional responsibility remained shielded from public view. The court’s ruling successfully penalized the corporate suppliers but did not identify the specific government officials or intelligence agents who authorized the targeting of Koukakis and other high-profile individuals. Furthermore, because the sentences were suspended pending appeal, the immediate practical consequences for the convicted executives remained minimal, leading to concerns that the judicial response was more symbolic than transformative. This gap in institutional accountability highlights the difficulty of prosecuting the state when the state itself is the client of the surveillance firm. Until the chain of command leading from the intelligence services to the political executive is fully exposed, the “national security” loophole will continue to provide a safe harbor for those who orchestrate the illegal monitoring of domestic critics.
TechnicalWarfareTheStrategicDeploymentandSophisticatedPrecisionofModernMaliciousLureswithinDigitalEnvironments
The Greek investigation also shed light on the highly personalized and sophisticated “lure” systems used to infect target devices with Predator malware. Unlike broad, indiscriminate phishing campaigns, these attacks were meticulously tailored to the victims’ specific professional interests and personal routines. For instance, investigative journalists received text messages containing links to fake news articles that mirrored the specific beats they were covering at the time. In one particularly chilling example, a former Meta manager received a spoofed text message regarding a COVID-19 vaccination appointment she had actually booked just days prior. This level of precision indicates that the spyware operators were not acting in a vacuum; they already possessed significant information about the victims’ lives, which they used to craft the perfect digital bait. This methodology exploits the inherent trust individuals place in their daily digital interactions, making the malware nearly impossible to detect without advanced forensic capabilities.
The synergy between traditional state surveillance and these new digital tools makes the technology particularly dangerous for civil society. To create a convincing lure, attackers must first monitor the victim’s daily habits, communications, and schedules through other, perhaps more conventional, surveillance methods. This suggests a deep level of coordination between spyware vendors and the state’s intelligence infrastructure, where traditional data points are used to facilitate the final, total compromise of the victim’s device. This hybrid approach to espionage ensures a high infection rate and demonstrates that commercial spyware is rarely used as a standalone tool, but rather as the final stage of a broader campaign of intimidation. The psychological impact on the victims is profound, as they realize that the very devices they rely on for work and family connections have been weaponized against them through a calculated exploitation of their personal habits and professional responsibilities.
Political Weaponization and Institutional Barriers
Electoral Interference: The Case of the Polish Opposition
In Poland, the use of Pegasus spyware took on a clearly partisan character, serving as a tool for direct political interference during national election cycles. The surveillance of Krzysztof Brejza, a prominent member of the European Parliament who was managing an opposition campaign at the time, resulted in the theft of nearly 85,000 private messages spanning over a decade. When the state failed to find evidence of any criminal activity within this massive cache of data, the stolen information was allegedly manipulated and leaked to state-controlled media outlets. Altered versions of his private conversations were broadcast nationally to discredit him and his party during the height of the campaign, illustrating how digital espionage can be used to sway public opinion and undermine the fairness of democratic competition. This weaponization of personal data represents a fundamental threat to the integrity of the electoral process, as it allows the ruling party to use state resources to sabotage political rivals.
Even following shifts in the political landscape, the pursuit of justice in Poland has remained a slow and grueling process due to structural barriers within the judiciary. For years, the fusion of the roles of Minister of Justice and Prosecutor General allowed for the suppression of investigations into state-sponsored surveillance, as the individuals responsible for oversight often had a political interest in maintaining the status quo. This institutional capture has made it nearly impossible for victims like Brejza to obtain a swift, transparent accounting of who authorized the spying and how the stolen data was processed. While a parliamentary inquiry eventually concluded that the purchase and use of the spyware were unlawful, the transition from legislative findings to criminal prosecutions has been hindered by the continued influence of previous administrative structures. This highlights the reality that even in a democracy, the legal system can be strategically slowed down to protect powerful interests from the consequences of their actions.
Sovereign Immunity: The National Security Defense in Spain and Hungary
In Spain and Hungary, the primary obstacle to transparency and judicial redress is the frequent and often indiscriminate invocation of the “national security” defense. This legal mechanism acts as an impenetrable shield, preventing both courts and victims from accessing the essential information required to hold government entities accountable. In Hungary, under the administration of Viktor Orbán, the legal framework has been adjusted to allow political appointees, such as the Justice Minister, to authorize invasive surveillance without any form of independent judicial oversight. This has created an environment where investigative journalists like Szabolcs Panyi can be labeled as security risks simply for performing their professional duties. When forensic evidence proved his device was infected with Pegasus, the Hungarian government refused to provide any justification, effectively ending the possibility of a domestic legal remedy and leaving journalists in a state of permanent uncertainty regarding their safety.
Spain’s “CatalanGate” scandal revealed that dozens of individuals associated with the Catalan independence movement were targeted with Pegasus, yet the state has consistently refused to declassify the documents that would explain the rationale behind these actions. Victims in Spain face a legal “Catch-22” that further complicates their pursuit of justice. Courts have often demanded that victims hand over their original devices to the national police—the very entity suspected of carrying out the surveillance—for new forensic examinations. The victims argue that surrendering their entire digital lives to the suspected perpetrators constitutes a second violation of their privacy and a compromise of their legal defense. Consequently, many cases have been dismissed or stalled, as there is no provision for an independent, third-party laboratory to handle the forensic evidence. This highlights a critical flaw in the European legal landscape: the lack of a neutral technical infrastructure to investigate crimes committed by the state itself.
Expanding Surveillance and the Failure of Oversight
Monitoring Civil Society: This report provides a comprehensive analysis of the Italian non-governmental organization experience
The Italian experience demonstrates that the use of highly invasive spyware is not a phenomenon confined to “illiberal” regimes, but is also being deployed by established democracies to monitor humanitarian activities. In 2025, reports emerged detailing how activists and co-founders of Mediterranea Saving Humans were placed under digital surveillance for several years using Graphite spyware, a tool developed by Paragon Solutions. The official justification for this monitoring was the suspicion that their migrant rescue operations in the Mediterranean were facilitating illegal immigration. However, the activists contended that the true motive was to suppress their documentation of human rights abuses and potential war crimes committed against migrants in North Africa. By reframing humanitarian work as a threat to border security, the state effectively granted itself the authority to dismantle the digital privacy of those who challenge its migration policies.
This expansion of surveillance into the non-governmental organization sector suggests a growing normalization of mass monitoring for anyone who publicly dissents from state policy. The Italian parliamentary oversight committee, Copasir, ultimately deemed the surveillance of the activists to be lawful, noting that it had been authorized by the Prosecutor General. This validation highlights a trend where existing legal frameworks are being stretched to their absolute limits to include political activism and humanitarianism under the broad umbrella of security threats. This normalization narrows the safe space for civil society to operate, as activists must now assume that their private communications and strategic planning are being vacuumed up by the state. When the very institutions designed to provide oversight—such as parliamentary committees—begin to rubber-stamp these invasive practices, the concept of a “necessary and proportionate” response to security threats becomes increasingly meaningless in the face of executive overreach.
Institutional Paralysis: The European Union Response
A recurring theme across all cases is the perceived weakness and paralysis of European Union institutions when confronted with systemic spyware abuse by member states. Although the European Parliament established the PEGA committee to investigate these revelations and issued a series of robust recommendations, the European Commission has largely failed to implement any meaningful safeguards. These recommendations included creating an EU-funded legal fund to help victims manage the massive costs of litigating cases involving state secrets and establishing independent technical laboratories to provide free forensic analysis for judicial investigations. However, years after these proposals were first introduced, very little progress has been made, leaving victims to navigate complex and expensive legal systems entirely on their own. This institutional inaction has created a vacuum where national governments feel emboldened to continue their surveillance programs without fear of professional or political blowback from Brussels.
Observers and former members of the European Parliament have criticized the Commission for prioritizing the prerogatives of member states over the fundamental rights of EU citizens. By accepting the argument that national security is an exclusive matter for individual nations, the Commission has effectively waived its authority to regulate the misuse of spyware within its borders. This hands-off approach has profound implications for the rule of law across the continent, as it signals that there are no pan-European consequences for governments that use digital tools to intimidate journalists or interfere in elections. This failure of oversight has led to a fragmented legal landscape where the level of protection an individual enjoys depends entirely on the political climate of their specific country. Without a centralized, mandatory regulatory framework that includes strict notification requirements and independent judicial authorization, the commercial spyware industry will continue to operate with relative impunity across the European market.
The Human Cost of State Intrusion
Double Victimization: The Psychological and Financial Toll
The impact of being targeted by state-sponsored spyware extends far beyond the technical loss of digital privacy, creating a devastating cycle of “double victimization” for the individuals involved. The first violation occurs during the initial intrusion—the profound shock of realizing that one’s private life, family secrets, and professional sources have been exposed to the state. Victims often report a lasting sense of psychological exhaustion and paranoia, knowing that their most intimate conversations were monitored and potentially recorded. This intrusion disrupts personal relationships and creates a permanent “chilling effect” on professional work, as journalists and activists struggle to regain the trust of sources who may have been compromised by the breach. The awareness that the state has “vacuumed up” a decade’s worth of personal history creates a unique form of digital trauma that lingers long after the infection has been removed.
The second violation happens during the grueling and often fruitless pursuit of justice, where victims must contend with institutional gaslighting and financial exhaustion. Governments consistently deny the use of these tools even when forensic experts from organizations like Amnesty International have provided irrefutable proof of their presence. Fighting these cases in court requires immense financial resources, as victims must hire international legal experts and forensic technicians to challenge state apparatuses with unlimited budgets and legal protections. For many, the path to redress becomes an uphill battle designed to discourage them from continuing their quest for accountability. This systematic obstruction by the state is often as damaging as the initial surveillance, as it leaves victims feeling abandoned by the very legal systems that are supposed to protect them. The combination of psychological strain and financial burden serves as a powerful deterrent, signaling to others that the cost of challenging state surveillance is prohibitively high.
Restoring Democratic Integrity: Pathways Toward Accountability
The investigation into the misuse of spyware across Europe demonstrated that the unchecked deployment of these technologies represented a fundamental threat to the integrity of democratic institutions. When investigative journalists were spied on without consequence, the rule of law became a hollow concept, and the ability of the press to hold power accountable was severely compromised. The Greek convictions of Intellexa executives, while historic, highlighted the glaring absence of similar actions in other jurisdictions, revealing a lack of a coordinated European response to a cross-border problem. It became clear that without a moratorium on the use of these tools until strict, transparent safeguards were in place, the digital landscape would continue to serve as a tool for state control rather than a platform for democratic engagement. The erosion of privacy has led to a culture of self-censorship, where citizens have become hesitant to discuss sensitive topics or organize political dissent, fearing the digital repercussions.
To address these systemic failures, experts and victims advocated for the creation of independent, EU-wide forensic bodies that could provide neutral evidence for national courts, bypassing the conflict of interest inherent in state-run laboratories. They also called for a mandatory notification duty, requiring states to inform individuals if they had been placed under surveillance once a legitimate investigation had concluded. These measures aimed to make the use of spyware traceable and accountable, removing the shield of “national security” when it was used to cover up political misconduct. In the past, the lack of such protections allowed the commercial spyware industry to flourish in the shadows, but the push for transparency sought to bring these operations into the light of public and judicial scrutiny. Ultimately, the fight against spyware misuse was not just about protecting individual devices, but about preserving the very foundations of a free and open society in an increasingly digitized Europe.
