Italian Lawmakers: Spyware Targeted Immigration Activists, Journalist Untouched

An Italian parliamentary committee, COPASIR, has released a report confirming that the Italian government utilized spyware developed by Israeli firm Paragon to target the mobile devices of several activists involved in rescuing immigrants at sea. The committee’s investigation, however, stated that a prominent Italian journalist was not among those targeted, leaving unanswered questions regarding the extent and motives behind the spyware attacks. The report, published on Thursday, concludes a months-long inquiry into the use of Paragon’s Graphite spyware within Italy, following initial reports by Israeli newspaper Haaretz.

The investigation was initiated after WhatsApp sent notifications to approximately 90 users in January, alerting them to potential targeting by Paragon’s spyware. Several individuals in Italy came forward, sparking a scandal given Italy’s history with spyware companies and governmental use of such technologies. COPASIR then launched an investigation to clarify the details surrounding these allegations.

COPASIR specifically investigated the cases of Luca Casarini and Giuseppe Caccia, both affiliated with Mediterranea Saving Humans, an Italian non-profit dedicated to rescuing immigrants in the Mediterranean. The committee concluded that Italian intelligence agencies lawfully targeted Casarini and Caccia as part of investigations into alleged facilitation of illegal immigration.

Conversely, COPASIR found no evidence to suggest that Francesco Cancellato, a journalist who received a WhatsApp notification about potential targeting by Paragon’s spyware, was targeted by Italian intelligence agencies. The committee stated that database and audit logs for Cancellato’s phone number showed no relevant records. They also found no legal requests to surveil Cancellato from the country’s top prosecutor’s office or the Department of Information for Security (DIS).

The report suggests that foreign governments with access to Paragon’s spyware could potentially have targeted Italians, offering a possible explanation for Cancellato’s case. However, COPASIR provided no evidence to support this theory.

Cancellato, the director of Fanpage.it, an Italian news website known for its investigative journalism, has publicly questioned COPASIR’s conclusions and called for further clarification. John Scott-Railton, a senior researcher at The Citizen Lab, emphasizes that identifying who targeted Cancellato remains a crucial unanswered question. Citizen Lab continues to investigate Cancellato’s case, analyzing his phone and data.

COPASIR also investigated the cases of Mattia Ferrari and David Yambio. The committee did not find evidence that Ferrari was targeted, but confirmed there was evidence Yambio had been a lawful target of surveillance, although not with Paragon’s spyware.

The investigation also uncovered new details about the use of Paragon spyware in Italy. The national anti-mafia prosecutor told COPASIR that no prosecutor’s office in Italy had acquired or used Paragon’s spyware. The Carabinieri military police, the national Polizia di Stato, and the financial crimes agency Guardia di Finanza gave the committee the same answer.

Paragon informed COPASIR of its contracts with Italy’s intelligence agencies, AISE and AISI. COPASIR representatives examined the agencies’ spyware database and audit logs, concluding that there were no abuses related to the surveillance of individuals who came forward as spyware targets.

COPASIR’s report revealed that using Paragon’s spyware requires operator login credentials and generates detailed logs stored on a customer-controlled server. While customers cannot delete data from the audit logs, the report also highlighted that AISE and AISI have since rescinded their contracts with Paragon.

AISE used Graphite from January 2024 to investigate illegal immigration, search for fugitives, counterintelligence, and counter-terrorism. AISI, which began using Graphite earlier in 2023, utilized it in a small number of cases to acquire real-time communications and exfiltrate stored chat messages. Both agencies claimed to have obtained appropriate legal approval for each spyware deployment.

COPASIR confirmed that Paragon’s contracts with Italian customers included clauses prohibiting the use of spyware against journalists and human rights activists.

In March, Citizen Lab identified Australia, Canada, Cyprus, Denmark, Israel, and Singapore as potential customers of Paragon. In late 2024, AE Industrial reportedly purchased Paragon for a deal potentially reaching $900 million.