The case of Thanasis Koukakis, a Greek journalist monitored by the Greek National Intelligence Service and later hacked by Predator spyware

The monitoring of journalist Thanasis Koukakis by the National Intelligence Service and his subsequent hacking by Predator spyware raise questions about the free exercise of journalism and the protection of press freedom in Greece.

According to Reporters United, on June 1, 2020, EYP submitted a request to telecommunications company Cosmote to lift the confidentiality of communications on a mobile number belonging to the journalist in question. The duration of the breach of privacy was to be two months – from June 1 to August 1, 2020 – for reasons of national security.

Shortly afterwards, on 13 July, EYP requested an extension for a further two months, until 1 October 2020, again for reasons of national security. However, the surveillance was ended by request of EYP on 12 August, i.e. before the extension had expired.

So why would EYP stop their surveillance voluntarily? On the same day, August 12, the journalist had asked the independent authority, the Hellenic Authority for Communication Security and Privacy (ADAE) to inform him if his communications were being monitored. One hypothesis is that, because the authorities were monitoring Koukakis, they were aware that he was going to go to the ADAE and as a result they stopped their surveillance of him. 

Koukakis suspected he was under surveillance after sources revealed to him the existence of transcripts of personal telephone conversations. Included in the documents that Koukakis saw was the transcript of a telephone conversation between himself and a foreign journalist. This of course means that EYP also intercepted the communications of a foreign journalist.

In his letter to ADAE, the journalist stated that he wanted to be informed if his mobile number, landline or internet connection were being monitored. The accuracy, he said, of the transcripts that he had seen, as well as the fact that some of the recorded conversations took place outdoors, suggested that they were the result of ongoing surveillance.

It would take months for ADAE to contact the telecommunications provider and confirm that the secrecy for one of Koukakis’s three numbers had indeed been lifted.

On March 10, 2021, i.e. after they had confirmed the existence of the surveillance, the ADAE asked the EYP Prosecutor, Vasiliki Vlachou, if the legal conditions had been met for them to inform the journalist that the confidentiality of his communications had indeed been lifted. 

At this point in time, the law provided that after the surveillance had ended, the ADAE were able to notify the subject that the privacy of their communications had been lifted. This was the case whether the surveillance was initiated on the basis of the investigation of serious crimes or for reasons of national security. The only condition placed on the notification of the subject was that doing so should not jeopardise the purpose of the surveillance. The ADAE therefore asked the EYP Prosecutor if the disclosure of the surveillance to the journalist would jeopardise the purpose of the surveillance itself.

On March 31, just 20 days after the ADAE sent this question to EYP, the government submitted to Parliament an illegal and unconstitutional amendment that changed the law and prohibited the ADAE from notifying the subjects of surveillance (where this had taken place for reasons of national security) that the confidentiality of their communications had been lifted.The regulation had a retroactive effect, and therefore applied to the surveillance of Koukakis. 

On April 7, 2021 the president of ADAE, Christos Rammos, and two other members of the Authority, (Aikaterina Papanikolaou and Stefanos Gritzalis,) published an article in the scientific journal Constitutionalism making the case that this legal amendment violates the constitutionally guaranteed protection of the confidentiality of communications, as well as the right to respect for private and family life of the European Convention on Human Rights (ECHR).

The EYP Prosecutor now informed ADAE that they may not disclose to Koukakis that the confidentiality of his communications had been lifted since the surveillance was carried out for reasons of national security. At the end of July 2021 therefore, ADAE replied to the journalist, confirming only that no violation of the legislation on the confidentiality of communications had taken place.

According to a report by inside story, in the summer of 2021, i.e. a year after Koukakis was monitored by EYP, the journalist’s mobile phone was infected with Predator spy software. The University of Toronto’s Citizen Lab confirmed that Koukakis’s phone had been infected by malware from July 12 to September 24, 2021.

Predator is a powerful monitoring tool, which gives full and permanent access to the target device. The user can extract passwords, files, web browsing history, photos, contacts and messages and can activate the device’s microphone and camera, enabling the recording of conversations that take place in the same room as the phone, for example.

Shortly after the victory of New Democracy in the 2019 elections (Government Gazette: Issue A ‘/ 119 / 8.7.2019), Kyriakos Mitsotakis placed the National Intelligence Service under the direct supervision of his own office, making the Prime Minister institutionally responsible for EYP.

Thanasis Koukakis is a financial reporter. He has been working for CNN Greece for many years as well as collaborating with other Greek and international media, such as the American CNBC, the Financial Times and inside story. Indicative of his work is a 2019 investigation into Piraeus Bank, its former chairman Michalis Sallas and a number of transactions relating to the Libra business group, owned by the shipowner George Logothetis, which ultimately proved damaging to the bank (Financial Times 1.11.2019 inside story 28.1.2020 & 21.2.2020)

In November 2019 he also published an article in the Financial Times about how the Mitsotakis government had amended the Penal Code in a move that “appears to overturn Greece’s commitment to international standards on combating corruption and money laundering.” 

So how are the activities of this journalist who investigates financial crime and business interests related to national security? This is a question which neither the government nor EYP have answered.

Government spokesman Giannis Oikonomou has insisted that the Greek authorities do not use such software and have had no dealings with any company that manufactures or supplies such software. The use of the Predator spyware, he maintains, must have been by a private individual. 

Let’s summarise the chain of events: EYP were monitoring Koukakis’s communications in the summer of 2020 and stopped when he communicated with the ADAE. In the spring of 2021 the government changed privacy laws, likely due to the Koukakis case, while in the summer of 2021 the journalist’s mobile phone was hacked by Predator. We also know that Predator is used mainly by government agencies. So how likely is it that Predator was deployed by a private party and not the state in this case?

According to a follow-up report by inside story about the case, the Greek government reportedly had intentions to partner with private companies to gather national security intel from abroad, following in the footsteps of Israel.  

Indeed, if it was not the state, then an even more serious national security issue arises: in this case an extremely powerful surveillance tool is available for hire by individuals to spy on citizens, journalists or even politicians. (Citizen Lab recently revealed that it had found traces of Pegasus spyware (another tool, similar to Predator) in the office of British Prime Minister Boris Johnson.)

IPI Deputy Director Scott Griffen said the surveillance of Koukakis posed serious threats to source confidentiality as well as journalist safety and called for an immediate investigation by Greek law enforcement authorities to establish the source of the surveillance.

On April 22, seven international press organisations sent a letter to the Greek authorities – including Prime Minister Kyriakos Mitsotakis and the head of the EYP Panagiotis Kontoleon – expressing concern and requesting information about the surveillance of Koukakis, 

“It is deeply concerning that an agency under the control of the office of the Prime Minister spied on a journalist investigating corruption in the business and financial world.”

(Committee to Protect Journalists, European Centre for Press and Media Freedom, European Federation of Journalists, Free Press Unlimited, International Press Institute, Reporters Without Borders, Transeuropa).

The Journalists’ Union of Athens Daily Newspapers also issued a statement requesting the immediate investigation of the allegations, and the Foreign Press Association of Greece has requested immediate answers from the Greek authorities.

By order of the head of the Athens Prosecutor’s Office, Sotiria Papageorgopoulou, a preliminary investigation has been initiated to determine if there has been a  criminal violation of communications privacy.

In response to a question from journalist Giannis Paleologos from Kathimerini, European Commission spokesman Johannes Barke said that the Commission was aware of the case of Thanasis Koukakis, and noted that illegal access to citizens’ personal data, including journalists and politicians, was unacceptable.

In response to a question from journalist Matina Stevis-Gridneff, head of the New York Times Brussels office, the European Commission spokesman said that the Commission would be following up on whether or not the change to the privacy laws in Greece, banning the notification of surveillance subjects that they had ever been surveilled, is compatible with EU law.

Opposition party SYRIZA characterised the revelations that EYP had requested surveillance of the mobile phone of a journalist as a ‘huge scandal’, while the Movement for Change party requested that all aspects of the Koukakis case be investigated as the protection of the confidentiality of communications and the free exercise of journalism are fundamental rights.

An MP of the party Movement for Change, George Kaminis, submitted a question to the Prime Minister, underlining that since the transfer of the oversight of EYP to the PM’s office in 2019, the Prime Minister himself must take a stance on these surveillance cases as they affect him personally, as well as going to the heart of democratic values and violating fundamental constitutional rights.

In a state governed by the rule of law, where individual rights and the freedom of the press are protected, journalists have the right to practice their profession freely and independently, without censorship or influence. 

Despite the guarantee of the freedom of the press by Article 14 of the Constitution, the revelations about the surveillance of journalist Thanasis Koukakis by the Greek National Intelligence Services and the hacking of his phone by Predator spyware are a clear blow to the free exercise of journalism and to the protection of journalists’ sources.

The surveillance of journalists, either by government agencies or private individuals, makes it impossible for journalists to practice their profession independently and violates the constitutional protection of the freedom of the press.