Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability
November 12, 2026
Europe’s spyware victims face years of legal battles and few answers as governments shield surveillance behind national security.
Greek journalist Thanasis Koukakis waited almost five years for a court to confirm what happened to him. His phone was infected with the infaous spyware Predator that gave whoever was watching access to his contacts, documents and messages, and even let them switch on his camera and microphone. IrpiMedia’s journalist and researcher Rosita Rijtano interviewed him and four other victims in a long investigation, and the picture it paints is bleak.
On February 26, a court in Athens convicted four executives linked to Intellexa, the company behind the Predator spyware. They include its founder, Tal Dilian, a former Israeli military intelligence commander. They face prison sentences of up to eight years for illegally accessing computer systems, violating data protection rules and breaking telecommunications privacy laws. Their sentences are suspended while they appeal, and investigators have not identified who ordered the surveillance. This is the first conviction of its kind in Europe, highlighting how rare such cases are.
The scandal began in 2021, when an international investigation led by Forbidden Stories revealed that dozens of European activists, politicians and journalists had been targeted with Pegasus spyware, developed by NSO Group. The company says it sells its products only to government intelligence and law enforcement agencies. Other spyware companies later came under scrutiny. In 2025, Citizen Lab found Italian phone numbers among those targeted by Paragon Solutions, an Israeli company that was later acquired by a US investment fund. Except in Greece, none of these cases has led to a criminal conviction.
“Yet, with the exception of Greece, none of these cases has resulted in a criminal conviction. In Spain and Hungary, victims say they have been unable even to obtain basic information about the surveillance they were subjected to, with authorities citing “national security.”” reads the report published by IrpiMedia.
In Spain and Hungary, victims say they can’t even get basic information about the surveillance, because authorities cite national security. Rebecca White, a researcher at Amnesty International’s Security Lab, calls it double victimization: first you’re hit by one of the most invasive technologies in the world, then you find one dead end after another when you seek justice. Courts and bodies like the European Court of Human Rights take years and cost a lot, and the search wears people down psychologically.
Europe’s own recommendations haven’t helped. After the Pegasus scandal, the European Parliament’s PEGA inquiry committee adopted recommendations on June 15, 2023, including an EU fund for victims’ legal costs and an independent laboratory offering free legal and technical help and forensic analysis. Member states were asked to strengthen safeguards, notify people who were surveilled, guarantee effective remedies and let independent bodies access the data needed to investigate abuses. Three years later, Green MEP Saskia Bricmont says nothing has been done by the Commission or the member states, and that governments hide behind national security.
Sophie in ‘t Veld, the former PEGA rapporteur, says the situation has become worse. She argues that governments realised they would face no consequences and that more spyware cases have emerged since the inquiry, especially in Italy. She also criticises the European Commission for supporting national governments instead of protecting victims. Polish MEP Krzysztof Brejza says the system does not help victims because there is little transparency and no clear process for seeking justice.
Brejza was also a victim of spyware. His phone was infected with Pegasus while he was leading the election campaign against Poland’s then-ruling Law and Justice party. He says attackers accessed 85,000 messages covering ten years and changed some conversations.
“They gained access to 85,000 messages, covering the last ten years of my private and professional life. Because they found nothing against me, they went further and manipulated my conversations. Altered exchanges were broadcast by national television to discredit me. The aim was to interfere in the election by weakening democracy,” Brejza tells IrpiMedia.
National television later broadcast these messages to damage his reputation. Poland’s Central Anti-Corruption Bureau had requested the surveillance as part of an investigation into his father, a mayor. Prosecutors in Gdansk later found no grounds for that investigation.
In October 2026, a Polish parliamentary inquiry concluded that Pegasus had been purchased unlawfully and used against political opponents. So far, Brejza has won only civil cases: the broadcaster was forced to apologise and pay damages. Criminal investigations are still ongoing and progressing slowly.
“In October 2026, a parliamentary inquiry committee set up in Poland after Donald Tusk took office to investigate the use of Pegasus under the previous government concluded that the spyware had been purchased unlawfully and used against political opponents.” states the report.
Poland’s justice minister also serves as prosecutor general, while the former justice minister received asylum in Hungary before moving to the US.
Koukakis says they identified the Predator spyware and its operator but not who ordered the attacks. Court records show that nearly one-third of those targeted in 2020 and 2021 were also under Greek intelligence surveillance. He suspects a link. Fake appointment messages and article invitations were used to lure victims. He believes his reporting on legal changes that allegedly benefited people involved in financial crimes may have made him a target.
Greek authorities deny using Predator, arguing that no law regulated it at the time. Although an Athens court referred the case for further investigation, the Supreme Court prosecutor refused to reopen it on April 27. Koukakis challenged the decision and took his case against Greece to the European Court of Human Rights.
In Hungary, investigative journalist Szabolcs Panyi, who has covered Russian influence on the government of Viktor Orbán, learned from analyses by Amnesty’s Security Lab and Citizen Lab that he’d been spied on with Pegasus for seven months in 2019, with about 100 megabytes of data moving to and from his phone. All he’s found out since is that the civilian intelligence agency holds classified information about him, and every request has been blocked on national security grounds. He says Hungarian law lets anyone be spied on legally, because the justice minister, a member of the government, authorizes it.
Despite Spain’s stricter laws, spyware infected the phones of at least 65 people linked to the Catalan independence movement, mostly between 2017 and 2020, according to Citizen Lab. The victims included four members of Òmnium Cultural. The legal case was dismissed and later reopened on appeal, while the government was asked to declassify related documents.
In 2022, Spain’s ombudsman confirmed that intelligence services had legally monitored 18 independence movement members. However, Òmnium’s Elena Jiménez argues that judicial approval doesn’t automatically make surveillance lawful, warning that even progressive governments can spy on political opponents.
In Italy, Mediterranea Saving Humans founders Luca Casarini and Beppe Caccia, along with activist David Yambio, were targeted with Paragon’s Graphite spyware. The government cited suspected facilitation of irregular immigration, while Casarini believes the real motive was their evidence of abuses against migrants in Libya and Tunisia. Italy’s parliamentary oversight body ruled all three cases lawful.
Citizen Lab founder Ron Deibert warns that spyware creates a worldwide pattern of abuse, silencing victims and weakening democratic accountability. Experts argue that Europe still lacks effective safeguards and oversight. They call for greater transparency and a way to identify who orders and conducts surveillance. As Sophie in ‘t Veld puts it, “It is clear that they feel safe, untouchable.”
“Spyware can be useful in addressing real threats, such as terrorism or crime. But we need tools that allow us to identify the end user of the product, so that, when necessary, we can trace who ordered the surveillance and who carried it out, even in real time,” the journalist Koukakis told IrpiMedia.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Spyware )
