EU Parliament calls on Cyprus to curb spyware licenses

In a resolution adopted Thursday, the European Parliament called on Cyprus to repeal all spyware export licenses as well as to declassify a report on the Israeli ‘spy van’.

The resolution outlined recommended reforms pertaining to EU member states – Cyprus, Poland, Hungary, Greece, and Spain – to curb spyware abuse, after a year-long investigation into the use of Pegasus and equivalent surveillance spyware.

MEPs said the illicit use of spyware has put “democracy itself at stake” and called for credible investigations, legislative changes and better enforcement of existing rules to tackle abuse. The resolution was adopted with 411 votes in favour, 97 against, and 37 abstentions.

Referring to Cyprus as an export hub for spyware, MEPs said the country should repeal all export licences not aligned with EU legislation.

They also called on Cypriot authorities to “thoroughly assess the shipment of spyware material within the EU’s internal market between Member States and map the different Israeli companies or companies owned and run by Israeli citizens that are registered in Cyprus and that are involved in such activities.”

In addition, Cyprus was urged to “fully investigate, with the assistance of Europol, all allegations of illegitimate use of and exports of spyware, notably on journalists, lawyers and civil society actors, and Cypriot citizens.”

The resolution also asked Cyprus to “release the report of the special investigator on the ‘Spyware Van’ case,” as requested by Pega – the special European Parliament investigating the use of spyware – during their official mission to Cyprus.

In November last year, the attorney-general here said the findings of an independent criminal investigator on the ‘spy van’ case of 2019 would not be made public as they were part of a criminal probe.

He made the comments while the Pega mission was on the island.

Three individuals were charged in connection with the ‘spy van’ case, but in November 2021 the attorney-general’s office dropped the prosecution.

In February 2022, a criminal court slapped a €76,000 fine on WiSpear – the company operating the van.

Effectively the company was accused of setting up an electronic device or system consisting of WiFi access points capable of intercepting private communications without permission.

The court cleared the company – which operates out of Larnaca – of 49 of the counts. The defendant pleaded guilty to the other 42 counts.

It also ordered that the police return to the company the ‘spy van’ as well as all electronic equipment seized by authorities during the course of their investigations.

In other recommendations, the European Parliament resolution said the use of spyware should only be allowed in exceptional cases and for a limited time and proposed the creation of an EU Tech Lab to help with research, investigations and forensic analysis.

To stop illicit spyware practices immediately, MEPs argue that spyware should only be used in member states where allegations of spyware abuse have been thoroughly investigated, where national legislation is in line with the recommendations of the Venice Commission and case-law of the EU Court of Justice, and where export control rules have been enforced.