‘Need to tighten up on spyware’

A European Parliament special committee stressed on Thursday the need to tighten up EU-wide rules governing the sale and use of spyware, following the eavesdropping affair in Greece.

The committee – known as Pega, Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware – discussed exclusively the scandal in Greece. But tangential references were also made to Cyprus, since some of the involved companies previously operated on the island.

A type of spyware called Predator was deployed against Nikos Androulakis, the leader of Greece’s opposition socialist Pasok party, and journalist Thanasis Koukakis, according to a forensic analysis by digital rights group Citizen Lab and the European Parliament produced earlier this year.

It subsequently emerged that Greece’s National Intelligence Service had Androulakis under surveillance, with Prime Minister Kyriakos Mitsotakis saying the secret service’s action was wrong but legal.

The European Parliament’s committee was established back in March, following the alleged use of surveillance spyware against both those in public office and private citizens.

The connecting thread between Greece and Cyprus is said to be the use of Predator software, given that the spyware is owned by a company formerly incorporated in Cyprus.

A December 2021 report by Citizen Lab said Predator was developed by a company called Cytrox.

The report quoted a 2019 article in Forbes, which stated that “Cytrox was ‘rescued’ by Tal Dilian, a former Israel Defence Forces Unit 81 commander, whose company WiSpear (which appears to have been renamed Passitora Ltd.) is based in Limassol, Cyprus and reportedly acquired Cytrox in 2018.”

According to the same report, “Dilian is also the founder and CEO of Intellexa.”

“Cytrox is part of the so-called ‘Intellexa alliance’, a marketing label for a range of mercenary surveillance vendors that emerged in 2019. The consortium of companies includes Nexa Technologies (formerly Amesys), WiSpear/Passitora Ltd., Cytrox, and Senpai…”

Citizen Lab added: “Originally based in Cyprus, a recent report indicates that Intellexa now operates from Greece, which is also listed as the LinkedIn location of its founder, Dilian. A preliminary review of corporate registry documentation suggests that the alliance has a corporate presence in not only Greece (Intellexa SA), but also in Ireland (Intellexa Limited).”

Dilian is the same individual implicated in the late 2019 ‘spy van’ affair here in Cyprus. He and two others were charged in connection with the case, but the attorney-general subsequently dropped the prosecution.

Koukakis, the Greek journalist on whose mobile an attempt was made to install Predator software by sending him a link, was among the persons testifying at Thursday’s hearing of the European parliament special committee.

“We are defenceless across Europe, not just in Greece or Cyprus,” he reportedly told MEPs.

Koukakis noted that if a company plans to sell such software within the EU, the relevant industry regulator should be informed as to the end-user.

In this hypothetical scenario, in Greece’s case, the company Intellexa ought to have informed the relevant regulator/agency whether it sold its software to the secret service or to a private user.

In this way, Koukakis commented, the paper trail would be readily available, instead of investigators being forced to hunt for sales invoices or scour through bank accounts in tax havens.

Koukakis also took questions from Cypriot MEP Georgios Georgiou, vice-chair of the committee.

Responding, Koukakis referred to the case of the ‘spy van’ in Cyprus. Had Cypriot authorities prosecuted individuals there, he argued, these same individuals might not have later set up shop in Greece.

Another witness – Greek investigative journalist Eliza Triantafillou – told the committee that Israeli national Tal Dilian started his operations in Cyprus, subsequently relocating his business to Greece.

According to the Cyprus News Agency, which covered the European Parliament committee hearing, a team of MEPs may visit Cyprus in early November – their first destination in a two-part mission that will next take them to Greece.