Citizen Lab Confirms the Use of Spyware on European Journalists

Research group Citizen Lab confirmed the use of Paragon spyware to target two European journalists, according to a June 12 report. At least seven prominent Italian journalists and activists had already received notifications of suspected use of the US-backed Israeli spyware on their devices.

Spyware is a type of malware that allows third parties to access a device’s contents or activity without the user’s knowledge or consent. Paragon spyware is commonly employed by governments across the world, reportedly for counterterrorism efforts. However, similar tools have been used to surveil activists, journalists, and political dissidents.

In February, the Italian government confirmed that the Paragon spyware had been used on at least seven Italian citizens. This followed a report from WhatsApp, which had detected the spyware on at least 90 devices worldwide. At the moment, the Italian government denies the illegal use of Paragon to spy on any Italians.

Among the suspected targets of this attack were journalists Francesco Cancellato and Ciro Pellegrino, along with migration-rights activists Luca Casarini and Giuseppe Caccia. Earlier this month, an Italian official admitted to using the spyware on Casarini and Caccia, but still denied that the government had used the malware to spy on journalists.

The investigation by Citizen Lab confirmed that Ciro Pellegrino, head of the Naples newsroom at fanpage.it, and another anonymous European journalist have been targeted. The group found no conclusive evidence that Cancellato’s device has been compromised, though the investigation is ongoing.

In a June 11 statement, the European Union’s executive branch declared: “Any attempts to illegally access data of citizens, including journalists and political opponents, is unacceptable, if confirmed,” and that it will “use all the tools at its disposal to ensure the effective application of EU law.”

“A week ago it seemed like Italy was putting this scandal to bed. Now they’ll have to reckon with new forensic evidence,” said John Scott-Railton, a senior researcher at The Citizen Lab, to tech news site TechCrunch. “Ciro’s case adds to the big and politically tricky question: Who has been hacking Italian journalists with Paragon spyware? This mystery needs an answer.”

The Italian government has denied issuing any official comments regarding the attacks at the time of writing.