Despite Spyware Attacks on Its Own Officials, EU Response Falls Short

Vas Panagiotopoulos is a fellow at Tech Policy Press.

“It is completely unacceptable if this [hacking] were to be the case.” Those were European Commission President Ursula von der Leyen’s only public remarks on the abuse of spyware in the European Union, made in July 2021 following the Pegasus revelations.

Five years on, Stelios Kouloglou has become the latest Member of the European Parliament known to have been targeted with commercial spyware. The now-retired lawmaker was hacked with Pegasus spyware, ironically, while serving on the European Parliament’s Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware (PEGA). A forensic analysis of his device by Citizen Lab in July found that the attackers could potentially have gained access to confidential documents and committee deliberations.

Despite evidence of widespread targeting within EU institutions, the bloc has yet to take its own security problem seriously, let alone introduce EU-wide legislation specifically addressing spyware misuse.

Spyware victims within EU Institutions may far exceed 60

Kouloglou is the latest addition to a growing list of at least 18 EU officials and 10 MEPs targeted with the technology. Even that figure may be a significant underestimate.

A 2022 draft report by the European Parliament’s PEGA committee cited “some sixty detected infections” within the European Commission, while a Commission letter to PEGA rapporteur Sophie in ’t Veld acknowledged that Commission staff had received Apple notifications in November 2021 and that “several device checks led to the discovery of indicators of compromise.”

Confirmed targets from that list include some of the EU’s most senior political figures. Roberta Metsola, President of the European Parliament, was targeted with Predator, while former European Commissioner Didier Reynders was targeted with Pegasus. At least four other European Commission staff members were also targeted with Pegasus, including a member of then-Commission Vice-President Věra Jourová’s cabinet. Among MEPs, those targeted or infected include Diana Riba, Jordi Solé, Nathalie Loiseau, Elena Yoncheva, Daniel Freund,Pierre Karleskind, Louis Michel, and Nikos Androulakis; as well as Clara Ponsatí and Carles Puigdemont, who were targeted through their family members or staff. A Parliament staff member serving on the Security and Defense Subcommittee was also targeted.

This significant breach of the European Union’s own security poses severe risks for compromise of sensitive EU information, counterintelligence, proliferation of offensive capabilities, and strategic and democratic destabilization.

“This is particularly concerning given the number and seniority of EU officials who have reportedly been targeted,” said Aljosa Ajanovic, a policy advisor at European Digital Rights (EDRi), an association of civil and human rights groups.

“The European institutions should be treating this as a serious institutional security problem, not simply as a collection of isolated incidents,” he told Tech Policy Press.

It’s worth pointing out that Google’s Threat Analysis Group (TAG) has evidence from 2024 that Russian state hackers are deploying exploits “identical or strikingly similar” to those developed by spyware firms Intellexa and NSO Group.

“In the current geopolitical scenario, in which the EU is facing pressures from both its West and its East, a compromised device can definitely pose a major threat to its own security, with unknown consequences,” added Ajanovic.

In an email to Tech Policy Press, a Commission spokesperson neither commented on the “sixty detected infections” nor on potential policy or legislative measures related to spyware. They limited themselves to saying that the Commission “proactively implement[s] measures to protect [its] staff from cybersecurity threats, investing heavily in state-of-the-art tools for monitoring, detection and incident response. Such measures include the ongoing development of means to detect mobile device compromise at scale, in collaboration with other entities in the EU.”

The European Parliament established the PEGA inquiry in 2022 to investigate the abuse of spyware in Europe, following scandals in Spain, Greece, Hungary and Poland. The committee, among other recommendations, called for adopting EU-wide legislation to prevent the misuse of spyware, strengthening independent oversight, ensuring victims have access to effective legal remedies, and enforcing export controls

The inquiry was meant to address a broader gap in Europe’s response to spyware abuse. Yet, the European Commission has yet to propose such legislation, despite the European Parliament adopting a resolution criticizing the lack of a legislative follow-up and holding several debates on the status of the PEGA recommendations.

The European Commission has repeatedly maintained that the existing legal framework — referring to the GDPR, ePrivacy Directive, Cyber Resilience Act, European Media Freedom Act and Law Enforcement Directive — is sufficient to tackle spyware abuse, instead of introducing new legislation that would address the specificities of commercial spyware directly and set EU-wide standards.

“There is clearly a political decision somewhere in the higher echelons of the Commission not to make spyware a major EU policy priority,” said EDRi’s Ajanovic, adding that “the disappearance of a planned communication, the lack of implementation of any PEGA recommendations and the shift towards saying that existing legislation is already sufficient all point in that same direction.”

Spyware makers’ access to sensitive data is facing increased scrutiny

The Commission’s and national governments’ persistent failure to act has left victims like Kouloglou with few options other than litigation to investigate, seek remedies and accountability.

In late September, Kouloglou filed charges against NSO Group over his Pegasus surveillance and Athens prosecutors have ordered a preliminary investigation.

“The particular significance of the case is that the complaint does not stop at establishing that Stelios Kouloglou was targeted with Pegasus. It names specific executives of NSO Group and calls for their possible involvement and responsibility to be investigated,” said Zacharias Kesses, a lawyer representing Kouloglou as well as several other spyware victims in Greece.

“Companies that develop or supply such tools cannot distance themselves from their use when there are serious indications of abuse,” he told Tech Policy Press.

Indeed, spyware manufacturers’ access to sensitive data with implications for national security — or, in this case, EU security — is facing increased scrutiny.

In November 2024, court documents released in the US litigation between NSO Group and WhatsApp revealed that NSO, rather than its customers, “installs and extracts” information from mobile devices targeted by Pegasus.

Similarly, an inquiry revealed on October 12 that Poland’s Central Anti-Corruption Bureau, which used Pegasus, lacked full control over the system operated by NSO Group. The server module responsible for infecting mobile devices remained exclusively under the manufacturer’s control.

Prosecutors also said that data collected by the spyware was routed outside Poland through an anonymizing network using servers abroad. The Polish investigation found that the data was transmitted via foreign IP addresses.

Intellexa’s access to customer data is being scrutinized too. In September, a high-ranking Greek spy agency officer filed criminal charges against four executives linked to the firm, stating that “due to his job and official duties he manages sensitive, highly classified information, whose leakage to third parties, and even private individuals, threatens national security and constitutes espionage.”

Litigation offers a path to investigation and accountability

Victims of commercial spyware face multiple barriers to obtaining remedies, including difficulties proving that they were targeted and obtaining forensic evidence, lack of notification, limited access to information held by authorities, inadequate or politically compromised investigations, jurisdictional obstacles, and difficulties securing effective redress.

Litigation – both through national courts and through the European Convention on Human Rights (ECHR) – is now the most important and viable route for accountability and justice for the many spyware victims – EU officials or not.

“Strategic litigation is essential for holding those responsible to account and obtaining justice for human rights violations when institutional mechanisms fail, or there is no political will to address them,” said Cèlia Carbonell, from Catalan human rights NGO Irídia, who is part of a Europe-wide litigation coalition against spyware currently involved in nine cases across three countries.

“The coalition is a space to share knowledge, strategies and ideas that can support ongoing and new litigation against spyware, with the aim of setting positive legal precedents that benefit everyone and bring about change,” she explained.

Zacharias Kesses agrees that legal action is absolutely necessary at this stage for Kouloglou’s case. “What is now expected is a substantive investigation into those responsible and the extent of the breach. At the same time, the European Court of Human Rights in Strasbourg may examine the state’s responsibility, provided the admissibility requirements are met,” he said.

“Judicial proceedings do not absolve the European Union and governments of their obligation to act,” he added.