Opinion |

Why Every Democracy Should Fear Israeli Spyware

Democracies should not conduct cyber warfare against their own citizens without due process and due cause. But thanks to advanced Israeli spyware like Pegasus and Predator that’s exactly what’s going on, and it happened to me

Thanasis Koukakis
Thanasis Koukakis
Send in e-mailSend in e-mail
Citizens of European democracies need to wake up and challenge the rise and reach of advanced spyware like Predator or Pegasus, used by their own government against them
Citizens of European democracies need to wake up and challenge the rise and reach of advanced spyware like Predator or Pegasus, used by their own governments against themCredit: Darth_Vector/LEON_PHOTOGRAPHY/Casimiro PT/All Shutterstock.com. Artwork: Anastasia Shub
Thanasis Koukakis
Thanasis Koukakis

Two years ago, I found out that my own government had put me under surveillance, for "reasons of national security."

This year, I found out that I had been targeted again, this time by advanced surveillance technology, becoming the first confirmed European national whose mobile phone was deliberately infected by Predator, a spyware system developed by Cytrox, an Israeli firm based in North Macedonia. I don't yet know who gave the second order.

The first time I established I was under surveillance and went public with my case, Greece’s government went into crisis mode and promptly introduced new legislation to ensure Greek citizens like me would no longer have the right to be told the government was spying on them. The second time around, the Greek government has gone into full denial mode.

My case exposes how fragile the defense of civil rights in a European democracy can become – and how easily, thanks to hyper-sophisticated spyware, governments and other parties can breach those rights.

Within a period of 14 months, between June 2020 and September 2021, I was monitored twice, with two different systems. Fortunately, I was lucky enough to document both of these surveillance operations.

I found out about the first invasion of my privacy and of my professional life by the Greek government, thanks to sources I have developed in my work as a journalist. But I was lucky to be able to do it.

In one year alone, 2020, the Public Prosecutor's Office, based inside Greece’s domestic intelligence service ordered 13,751 acts of surveillance by the state, including my own, which extended from June to August 2020. But others placed under this surveillance did not have the same chance to find out.

I immediately complained to independent agency charged by the constitution to protect individuals' freedom of communication: the Hellenic Authority for Communication Security and Privacy. I am a journalist. Under what possible context could I have been flagged as a target for surveillance for threatening national security?

The same day I submitted my complaint, the Greek Intelligence Service's Public Prosecutor ordered the cessation of my surveillance. It is worth noting that the intelligence service acts under the direct supervision of the prime minister's office.

Pictured: Greek Prime Minister Mitsotakis. In 2020 alone, Greece's Public Prosecutor's Office, under the PM's direct supervision, gave 13,751 surveillance orders, including my ownCredit: AP Photo/Emrah Gurel

As an investigation by Reporters United (a network of reporters supporting investigative journalism in Greece) recently revealed, my complaint had triggered panic in the Greek government. A few months later, in March 2021, it amended the law so that I would no longer have the right to be officially notified that my own country's spies had been spying on me.

This ad hoc legislation, hastily conjured up to hide my surveillance, led to reactions inside and outside Greece: It constitutes an abuse of power and what is known as "disproportionate" legislation.

Greece is one of the rare legal systems where proportionality enjoys explicit constitutional status: Every law must be examined to establish whether its impact is, or is not, proportionate to the issue it seeks to resolve. In my case, Greek law was changed, for the worse, to target and circumscribe the rights of a single individual, and that is clearly disproportionate.

For the last 27 years, the independent communications authority was able to inform people placed under official surveillance for national security reasons, provided they had submitted a complaint and that a reasonable time had elapsed since the completion of their surveillance.

Thus, unsurprisingly, a year after my complaint, I received an official response from the authority that under "current legislation," there could be no confirmation that the confidentiality of my communications had been violated without due cause.

Irony then compounded irony. At exactly the time that Greece’s constitutionally-bound authority was telling me it couldn’t tell me about Greek government surveillance, my phone was under surveillance again – but in a different manner.

The logo of Predator creator Cytrox.

Thanks to the work of Toronto University's Citizen Lab, I discovered that my iPhone was infected with Predator spyware, a high-tech surveillance software developed by Cytrox, an Israeli firm based in North Macedonia, and reportedly sold in Greece by a company called Intellexa. This software had been actively monitoring me from July to September 2021.

Predator, as its name suggests, is a highly invasive and powerful form of spyware that provides its operators with full access to a cellphone, to its encrypted data, and even to direct its camera and microphone. Citizen Lab’s online scanning for Predator spyware servers has found likely Predator customers not only in Greece, but also in Armenia, Egypt, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.

As soon as the story of my second surveillance was broken by Greece-based reporters for Inside Story, the Greek government, before they’d had time for any investigation, claimed that far from being state-sanctioned, this monitoring had been ordered and conducted by unknown individuals.

This was somewhat difficult to digest, not least when just as I found out about the second surveillance operation against me, I had received documented confirmation from Reporters United that my first surveillance had been greenlighted by the Public Prosecutor within the Greek Intelligence Service. To me it now seems obvious that the burden of proving that the first surveillance efforts and the second are not linked falls solely on the Greek government, which we already know was responsible for initiating that first monitoring of my mobile phone.

I cannot yet answer the question why my work as a journalist specializing in finance and banking could be considered a "matter of national security."

Pegasus spyware sold by Israel’s NSO, or Cytrox's Predator, can be used by governments to track and monitor their own citizens, without cause, almost invisibly and with deniability, if not impunityCredit: Artwork: Anastasia Shub. Photos: Sebastian Scheiner, AP / Andrei Minsk / Shutterstock

I hope that at some point the Public Prosecutor will indeed answer this. She herself signed 13,751 surveillance orders approved by the Greek state in 2020 that breached individuals’ secure and private communications for "national security reasons." Why was I targeted? Why did the Greek state go to such lengths – actually changing the law – to prevent me finding out why?

I am still fighting my legal case to get a full explanation and transparency from my government. But what has become clear to me, and what should be a warning to everyone in Europe, and every citizen of a democracy, is how arbitrary and inadequate the protection of citizens is against improper surveillance, whether in Greece or anywhere else.

The vulnerability of individuals to breaches of their private and professional lives has spiraled exponentially thanks to advanced espionage software such as Predator or Pegasus, the spyware sold by Israel’s NSO, technological capacities acquired by governments that enable them to track and monitor their own citizens, without cause, almost invisibly and with deniability, if not impunity.

What is so worrying is that our legal, civic and institutional counterweights to this unprecedented technological capacity for unjustified and undemocratic state surveillance not only lag far behind but are insufficient to protect us.

In contrast to surveillance systems’ rapid technological advances, the counterweights that will prevent the "invasion" of state intelligent services into the lives of unsuspecting citizens – in an entirely disproportionate way to any danger, real or spurious, the individuals pose to national security – have not progressed likewise.

Simply put, civil rights legislation is like an analog telephone connection when spyware threatens at 5G speeds.

In the case of Greece especially, but also in other European countries, it is more essential today than ever before that independent agencies and parliamentary oversight over how national security services use these advanced citizen surveillance systems be strengthened. Accountability to a pan-European body may be also required for this.

Only then will we know for sure if there really are national security reasons that put anyone – journalist or non-journalist – under surveillance, only then can we be assured that this state-owned surveillance is not being illegally weaponized for political reasons or even business interests.

On this basis, the cost of procuring high-tech surveillance software, whether from opaque Israeli firms or elsewhere, should no longer be considered confidential, but should fall into the category of defense expenditure, so that those procurement procedures can be supervised, transparently, by the respective parliaments. The relevant contracts should contain end-user clauses of the software, in order to discourage the use by third parties who may be allied, politically or economically, to the government buying the systems.

The position of international organizations and courts on these issues is well known. The United Nations has condemned unlawful and arbitrary surveillance as an infringement of fundamental human rights.

The European Court of Human Rights has ruled that when the domestic legal provisions governing the interception of communications did not provide adequate and effective guarantees against arbitrary use and the risk of abuse, then it does not meet the "quality of law" requirement and is incompatible with a free, democratic society.

Democratic states do not have the right to cut and sew laws governing the surveillance of citizens to what suits them in every situation, especially since the means of monitoring are now so advanced that they can penetrate into the core of the individual's personality, career and their family life.

There must be the right to free, open criticism of those in the highest echelons of power who choose to exploit their position for these nefarious ends, and clear, due process for their exemplary punishment.

Thanasis Koukakis is a Greek journalist with 25 years of experience covering financial and banking issues. He has worked in major Greek newspapers such as Estia, Ta Nea and To Vima, and in recent years has been working for CNN Greece. He is a contributor to CNBC.com and the Financial Times and collaborates with international media. He has studied Theology, Political Science and Economics. Twitter: @nasoskook

Click the alert icon to follow topics:

Comments

SUBSCRIBERS JOIN THE CONVERSATION FASTER

Automatic approval of subscriber comments.

Subscribe today and save 40%

Already signed up? LOG IN

ICYMI

בן גוריון

'Strangers in My House': Letters Expelled Palestinian Sent Ben-Gurion in 1948, Revealed

The Orion nebula, photographed in 2009 by the Spitzer Telescope.

What if the Big Bang Never Actually Happened?

AIPAC

AIPAC vs. American Jews: The Toxic Victories of the 'pro-Israel' Lobby

Bosnian Foreign Minister Bisera Turkovic speaks during a press conference in Sarajevo, Bosnia in May.

‘This Is Crazy’: Israeli Embassy Memo Stirs Political Storm in the Balkans

Hamas militants take part in a military parade in Gaza.

Israel Rewards Hamas for Its Restraint During Gaza Op

Palestinians search through the rubble of a building in which Khaled Mansour, a top Islamic Jihad militant was killed following an Israeli airstrike in Rafah, southern Gaza strip, on Sunday.

Gazans Are Tired of Pointless Wars and Destruction, and Hamas Listens to Them