Spyware systematically used by some EU governments, MEPs find

Spyware is being systematically used as a tool of control in some EU countries and a “profound rethink” of European governance is required to protect democracy, according to the lawmaker leading the European Parliament’s committee investigating the Pegasus spyware scandal. 

Speaking at a press conference on Tuesday (8 November) to present the committee’s first report on its findings, MEP Sophie In ’t Veld accused the EU of shying away from the protection of democracy within its own countries and called for a discussion on “reform of the governance of the European Union, with or without treaty change”. 

The report is an initial review of the work undertaken by the Parliament’s Pegasus committee, established earlier this year to probe the purchase and deployment of surveillance technology by EU authorities. The committee’s mandate runs until March 2023 but might be renewed. 

The investigation’s launch followed revelations in 2021 that governments worldwide had used spyware produced by Israeli firm NSO Group to infiltrate the devices of politicians, journalists, activists and lawyers. 

Among those found to have been targeted were top EU officials, including Justice Commissioner Didier Reynders, and top politicians from European countries, such as French President Emmanuel Macron and Spain’s Prime Minister Pedro Sánchez.

The investigation has primarily focused on the role of national authorities, and the report features several country profiles looking at specifics of the tech’s deployment, but In ‘t Veld warned against regarding the matter as a purely domestic issue. 

“The spyware scandal is not a national scandal. It’s very much a European scandal,” she said.

“We tend to look at it through the keyhole of national politics. But if you connect the dots, suddenly another image emerges, and you see this is an entirely European matter…MEPs, Commissioners, and Commission officials have been targeted. On the other hand, perpetrators also sit on the European Council.” 

In ‘t Veld was particularly critical of the Commission for what she said were discrepancies in its efforts to strengthen democracy against internal and external threats.

“The Commission is very determined to fight attacks on democracy from the outside”, she said.

“But when the attacks on democracy come from within, the Commission is silent… Where the threat to democracy is not some faraway stranger, but the governments of EU member states, the Commission suddenly considered that the defence of European democracy is no longer a European matter, but a matter for the member states.”

Among the responses to the scandal suggested by the Committee is a moratorium on the use of spyware, to be lifted only when specific criteria are met, more precise and aligned definitions of national security to prevent it being used as a catch-all justification, vigorous enforcement of export laws and regulation of spyware in line with existing case law.

The report also singled out some member states where spyware technology has been found to be particularly egregious or widespread, many of which have been visited by the committee in recent months.

In Poland and Hungary, In ‘t Veld said, spyware is an “integral element” of a methodical system “designed to control and even oppress citizens”. A committee delegation visited Poland in September, but condemned authorities in Warsaw after representatives of the Ministries of Interior and Justice refused to meet with the MEPs. 

Obtaining information from governments has been a critical obstacle to the committee’s work so far, prompting a considerable reliance on publicly available sources of information, In ‘t Veld noted on Tuesday, likening the situation to having “900 pieces of a 1000-piece jigsaw puzzle… It’s not complete, but I think we can see the image very clearly.”

In Greece, she said, the situation is different, falling short of being a deliberately authoritarian system, but with evidence still pointing to spyware having been used “in a very systematic and large scale manner clearly as part of a political strategy”. 

Greece’s supreme court, it was revealed this week, has ordered an investigation into the use of surveillance technologies by the state, following months of revelations about the Greek intelligence agency’s use of spyware against journalists and politicians, including MEP and leader of socialist opposition party PASOK, Nikos Androulakis.  

Also singled out was Spain, where Pegasus spyware was found to have been targeted both at Prime Minister Pedro Sánchez and members of the Catalan independence movement.

However, questions have been raised about why the Parliament’s committee has so far failed to send a delegation to Spain to investigate the tech’s use in the same way it has done elsewhere. In ‘t Veld said she hoped there would soon be a majority amongst the group’s members to allow for such a trip.

Even though some states had received more attention than others, In ‘t Veld said, each country plays a role in its use, from manufacturing to exports. “We need to recognise that all member states have spyware at their disposal, even if they don’t admit it.”

[Edited by Luca Bertuzzi/Zoran Radosavljevic]