European Parliament calls for close scrutiny of spyware in Cyprus

President Nikos Christodoulides said on Tuesday the government will go over the findings of a special European Parliament committee which called on Cyprus to assess its export licence regime for spyware as well as declassify the dossier on the Israeli ‘spy van’.

“We will study the committee’s recommendations and act accordingly within the limits of the law,” the president said.

“Because this issue is related to the international image of the Republic of Cyprus, and indirectly touches on the issue of US and UK sanctions against Cypriots for matters relating to sanctions-busting, it is an issue we approach with the same seriousness.”

Christodoulides added: “We will do whatever possible in all areas, so as to safeguard our country’s reputation.”

On Monday evening, the European Parliament’s committee of inquiry investigating the use of Pegasus and equivalent surveillance spyware (Pega) issued its final report, covering several countries, including Cyprus.

In the accompanying Recommendation Compromises document, Pega concluded “there is evidence of maladministration in the implementation of the EU Dual-Use Regulation in Cyprus which requires close scrutiny.”

The wording is a thinned-down version of an earlier recommendation, which had read: “contraventions and maladministration in the implementation of Union law are likely to have taken place in Cyprus.”

Pega’s final report also calls on Cypriot authorities to “thoroughly assess all export licences issued for spyware and repeal them where appropriate,” and to “thoroughly assess the shipment of spyware material within the EU’s internal market between Member States and map the different Israeli companies or companies owned and run by Israeli citizens that are registered in Cyprus and that are involved in such activities.”

In addition, the committee asked Cyprus to “release the report of the special investigator on the ‘Spyware Van’ case,” as requested by Pega during their official mission to Cyprus.

Lastly, Pega calls on Cyprus to “fully investigate, with the assistance of Europol, all allegations of illegitimate use of and exports of spyware, notably on journalists, lawyers and civil society actors, and Cypriot citizens.”

MEPs said Cyprus “played a major role as an export hub for spyware, and should repeal all export licences it has issued that are not in line with EU legislation.”

On Monday evening Pega adopted the final report, detailing the findings of their year-long inquiry, as well as a text outlining recommendations for the future. The latter text is expected to be voted by the full Parliament during the plenary session starting June 12.

MEPs recommend EU-wide rules on the use of spyware by law enforcement, which should only be authorised in exceptional cases for a pre-defined purpose and a limited time.

They also call for a common legal definition of the use of national security as grounds for surveillance, in order to prevent attempts to justify manifest abuses.

In Nicosia, opposition party Akel used the Pega report as a springboard for revisiting the issue of eavesdropping.

“So it turns out,” read their statement, “that when the Pega committee was visiting Cyprus to investigate allegations about the presence and operation of companies manufacturing and exporting spyware, it was not in fact ‘chasing ghosts’, as [former president] Mr Anastasiades declared at the time.”

Akel insisted on resuming parliamentary discussions on the ‘spy van’.

In November, the attorney-general said the findings of independent criminal investigator Elias Stephanou on the ‘spy van’ case of 2019 would not be made public as they were part of a criminal investigation.

He made the comments while the Pega mission was on the island.

Three individuals were charged in connection with the ‘spy van’ case, but in November 2021 the attorney-general’s office dropped the prosecution.

In February 2022, a criminal court slapped a €76,000 fine on WiSpear – the company operating the van.

Effectively the company was accused of setting up an electronic device or system consisting of WiFi access points capable of intercepting private communications without permission.

The court cleared the company – which operates out of Larnaca – of 49 of the counts. The defendant pleaded guilty to the other 42 counts.

It also ordered that the police return to the company the ‘spy van’ as well as all electronic equipment seized by authorities during the course of their investigations.