After a Supreme Court prosecutor found no evidence to incriminate the Greek intelligence service in the use of malicious spyware, those targeted are considering taking their fight to the European rights court.
“We hoped that the Greek judiciary would possibly do its job,” Triantafillou said. “However, the prosecutorial investigation carried out by the Supreme Court did not include important journalistic findings.”
But while the government of conservative Prime Minister Kyriakos Mitsotakis wants to a draw a line under the scandal, those targeted by the Predator spyware say they have identified serious flaws in the investigation and are considering appealing the case at the level of the European Union.
“There is a debate about whether the investigation was sufficient, substantial and accurate as required by the EU human rights treaty, the European Court of Human Rights,” said Zacharias Kesses, a lawyer representing seven Predator victims, including the first identified target, journalist Thanasis Koukakis.
“There is no fair trial when there is no adequate investigation of a crime.”
Misdemeanour charges
What came to be known as ‘Predator-gate’ began in March 2022, when Koukakis found that his phone had been infected with Predator, a spyware developed by a company called Cytrox, based in North Macedonia. The software was on his phone for roughly three months in 2021.
Inside Story and two other media outlets ran with the story, revealing a link between the government’s general secretary and nephew of the Greek premier, Grigoris Dimitriadis, and Intellexa, a company that sold Predator spyware in Greece.
But it was only in July 2022, when reports revealed an attempt to plant Predator on the phone of Nikos Androulakis, leader of the opposition PASOK party, the third biggest party in parliament, that the story really gained traction. It also emerged he had separately been placed under monitoring by the EYP, which the government said was legal but wrong.
After the revelations, Dimitriadis and EYP director Panagiotis Kontoleon both resigned. The same day, Dimitriadis sued two media outlets that had published the reports as well as Koukakis.
By that point, the Athens prosecutor’s office was investigating, but in October last year, Supreme Court prosecutor Georgia Adeilini asked that the case be forwarded to her deputy, Achilleas Zisis, saying it was of “major importance” and that the statute of limitations risked expiring.
On July 30, Zisis reported back in a 287-page report: the EYP was cleared but four individuals linked to the private companies involved in the spyware will be prosecuted. Under legal changes in 2019, the charges will be prosecuted as misdemeanours. No state body was implicated.
The opposition called the findings a farce, while Koukakis told BIRN: “There cannot be such conclusions in a case where all the evidence is clear.”
Dimitris Ververesos, president of the Athens Bar Association and the Plenary of Greek Bar Associations, wrote in an op-ed in the To Vima newspaper in August that “the rule of law is being peeled away”.
Possible appeal to European court
As a plaintiff, Koukakis was allowed to see the case file. He and his lawyer, Kesses, said the investigation was flawed.
Koukakis said that Zisis had characterised as a coincidence the fact that 27 people being monitoring by EYP were simultaneously targeted by Predator spyware, given that this represented only some 24 per cent of all identified Predator victims. He also said that none of the victims were asked to testify. “Their mobiles were never examined, so he cannot know if they were infected,” Koukakis said.
The Greek Data Protection Authority detected at least 225 cases of attempted spyware installation on numbers registered to 87 private individuals or company employees.
According to reporting by Inside Story, Intellexa, the company that brought the Predator software to Greece, was involved in editing the text of an intergovernmental agreement on cyber security between EYP and its Macedonian counterpart.
“However,” said Koukakis, “the Greek Supreme Court says the [Intellexa] executive may have provided his services to the EYP in the role of an individual”.
Such are the shortcomings, said Kesses, “there is the possibility of appealing to EU institutions, to the EU [European] court [of human rights], for not effectively and adequately investigating the case”.
Journalists vow to keep going
Not even EYP employees were safe from Predator.
One 17-year veteran, who spoke to BIRN on condition of anonymity, said “strange things” began happening at the agency after the conservative New Democracy party came to power in 2019.
“We were being asked to do things that were completely outside the scope of our service,” the woman said. She began making complaints and finally, with several other employees, filed a lawsuit.
Three days after she gave a statement to the prosecutor, the woman said she received an SMS on her phone that read, “My little girl, do you remember?”, and a link apparently to YouTube.
“Due to my training I would never click on that link,” the employee said.
Kesses said it was apparent that a number of targets – in government – have since risen up the ladder.
“If you look at the list of people who were under surveillance, they were all upgraded in one way or another in the last cabinet reshuffle,” he said.
The journalists, meanwhile, say they will not stop digging.
“Our work is not the work of justice, it is journalistic,” said Triantafillou. “We continue to investigate and we will continue to find things out and write about them.”