The affair concerns two distinct operations. The first is EYP’s spying on two journalists, Stavros Malichoudis, a reporter with independent outlet Solomon, and Thanasis Koukakis, a freelance journalist investigating banking and business stories; and also Nikos Androulakis, an MEP and leader of opposition party PASOK. These surveillance operations were carried out through EYP’s “normal” procedure for listening in on a target’s communications, following approval by a prosecutor. The second was the hacking of Koukakis’s and Androulakis’s mobile phones with Predator, a spyware tool that is able to access even encrypted services.

Although the surveillance of journalists and political opponents by state services hardly seems like the hallmark of democratic governance, the first procedure can be legal, not only for “national security” reasons, but also in cases of serious crime like drug smuggling or human trafficking. The legal framework in Greece, however, lacks any provision for technically supervising the use of spyware, which in practice makes it illegal.

No conclusive link between the two operations has been proven — yet. The fact, though, that they took place one right after the other (in the case of Koukakis) or simultaneously (in the case of Androulakis) raises reasonable suspicions that they are related. Further suspicions about both the use of spyware and the ostensibly legal procedure used against two journalists and a politician are raised not only by the Greek government’s handling of the affair, but also a number of key decisions it has made in the last three years.

Legislating against transparency

Soon after being elected in July 2019, the New Democracy government implemented new legislation in two crucial areas regarding the intelligence service: first, it brought it under the direct purview of the office of the prime minister, Kyriakos Mitsotakis; second, it amended the required qualifications for the position of director of intelligence, so it could appoint the prime minister’s favourite, Panayiotis Kontoleon, who fell short of the previous criteria.

Less than two years later, in March 2021, it made another controversial move: it introduced a rushed legislative amendment, piggybacked on unrelated legislation, that changed the provisions which allowed citizens to be informed whether they had been under surveillance (provided such surveillance had been terminated), if their surveillance had taken place for reasons of “national security”. In other words, up to that point, ADAE (the Hellenic Authority for Communication Security and Privacy) could, following permission from a prosecutor, inform a citizen who requested it that they had been under surveillance in the past, which meant that there was at least a theoretical possibility to seek redress in the courts, if one believed they had been targeted unfairly. Since the law changed, it is sufficient for EYP to claim reasons of “national security” and ADAE cannot divulge anything. What is more, the law applies retroactively, so all past surveillance is now effectively beyond scrutiny.

Members of the ADAE board, albeit in a non-official capacity, had protested at the time and had pointed out that such legislation contravenes the European Convention of Human Rights, as it practically deprives victims of illegal surveillance of access to due process. There is no indication that the government even considered their protests.

This statement was coordinated by the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States, Candidate Countries and Ukraine.

From migrants’ rights to Predator

In November 2021, Efimerida ton Syntakton, a prominent left-wing daily, published a report which revealed that EYP had targeted numerous individuals for surveillance, apparently without legitimate reason. Among them, there were participants in anti-vaccination rallies, but also a civil servant who supported migrant workers’ rights, a lawyer who defended an immigrant in court, and a journalist who was trying to locate an unaccompanied minor in a refugee camp.

When Stavros Malichoudis, the journalist in question, recognised himself in the report, Solomon, the independent website where he works, published a scathing article, asking: “In which system of government does the state record the movements of journalists?” No justification for the surveillance was ever made public.

In December 2021, in a seemingly unrelated development, two reports, one by Citizen Lab of the University of Toronto and one by Meta (Facebook’s parent company), pointed out the threat of Predator, a new spyware developed by so-called “cyber-mercenaries” of the global surveillance-for-hire industry. Predator closely resembles Pegasus, a similar spyware tool implicated in illegal hackings across the world since 2016.

The reports did not exactly rock the Greek mainstream media’s news cycle. However, one independent, investigative website, Inside Story, picked up on the fact that the reports mentioned the possibility of Predator “customers” in Greece. It followed up on the reports and published a story showing that a corporate structure had been established in Greece to market Predator, and also most disquietingly that dozens of fake urls had been created to resemble existent Greek webpages, in an apparent phishing set-up for potential Predator targets. Despite the obvious implications for the security of communications, there was no official response from competent authorities.

A private citizens’ affair

Inside Story’s next feature, however, in April 2022,  launched the torrent of revelations that have been termed the “Greek Watergate” — a title repeated by no less an authority on the matter than The Washington Post. It showed that investigative journalist Thanasis Koukakis’s phone, analysed by Citizen Lab, had been hacked with Predator, the first such confirmed case in Europe. It also showed that Koukakis, alerted by a source that his communications might have been monitored, had submitted a request to ADAE to be informed if he had been a surveillance target in the past. ADAE replied that “no event that contravenes relevant legislation has been noted”. Inside Story pointed out that the “relevant legislation”, which could have compelled ADAE to inform Koukakis of his surveillance, had been hastily amended.

The publication provoked the first reaction from the government, which amounted to no more than a dismissal: the government spokesman Yiannis Oikonomou simply said there should be an investigation if “one private citizen had another private citizen under surveillance”.

The “private citizen” argument, though, was immediately questioned when, a few days after Inside Story, another independent investigative website, Reporters United, published a report that proved that EYP had Koukakis under surveillance, citing “national security”, under its “normal” procedure, for three months in 2020. EYP broke off the surveillance on the very day that Koukakis filed his request with ADAE. His phone was hacked with Predator immediately after that.

The government neither confirmed nor denied the “normal” surveillance of Koukakis by EYP, following the same pattern it had established a year earlier with Malichoudis, but it continued to deny any involvement with Predator. Moreover, EAD (the National Transparency Authority, created by the New Democracy government), which had been tasked with investigating Koukakis’s phone hacking, issued a report absolving the government of any wrongdoing, although it failed to even consider important evidence. This is not the only time that EAD has been criticised for incomplete and pro-government investigations. Its report on illegal pushbacks of refugees had met with international ridicule when it found no wrongdoing by the Greek authorities, based solely on the testimony of the police and coastguard.

Denials and resignations

Barely a few days after EAD had cleared the government, Nikos Androulakis revealed that according to the EU Parliament’s security experts, there had been an attempt to hack his phone with Predator. Under pressure for answers, EYP revealed in July that it had been spying on him under its “normal” procedure, for reasons of “national security”, during the time he was a candidate for PASOK’s leadership. This surveillance had taken place simultaneously with the attempted Predator attack.

Meanwhile, the two independent outlets, Inside Story and Reporters United, had persisted with their investigations, and through a series of stories had established that EYP and the Greek police services had been in the market for spyware in the past, and that Intellexa, the company that markets Predator, was active in Greece and was indirectly connected, through a web of corporate entities, with government contracts. The more recent of these reports, by Reporters United, also published in Efimerida ton Syntakton, indirectly tied some of these corporate entities to Grigoris Dimitriadis, the general secretary of the Prime Minister’s office.

Initially, Dimitriadis had defended his business activities as legal, and had denied any involvement with Predator or related corporate entities. After a few days, though, under the weight of the revelations, both Grigoris Dimitriadis and Panayiotis Kontoleon, the director of EYP, submitted their resignations. Dimitriadis, however, followed his resignation with lawsuits against Reporters United, Efimerida ton Syntakton and Thanasis Koukakis, demanding exorbitant sums for alleged defamation.

It is worth noting that during the four months since Inside Story’s revelation that Koukakis’s phone had been hacked with Predator, there has barely been a mention of the affair in Greek mainstream media, whose overwhelming pro-government bias we have analysed in a previous article. It has only been since Androulakis made the attempted Predator attack on his phone public that most mainstream media saw fit to cover the scandal to a limited degree — presumably because he is a centrist politician rather than an independent journalist.