An alleged attempt to surveil National Intelligence Service employees through Predator

On September 6, 2022, press reports revealed that in November 2021, two National Intelligence Service (NIS) employees were targeted with the illegal Predator surveillance software.

According to the report, at the time of the attempted hack, the employees in question were in the midst of a confrontation with the Greek government. The employees in question had sent, together with other colleagues, a formal written complaint to the Prime Minister, Kyriakos Mitsotakis, as well as the director of the Intelligence Services, protesting their transfer to new sub-directorates without any justification. Both employees received messages on their mobile phones containing malicious links which would install Predator. However, due to their training they did not click on the links and thus the software was not installed.

Predator is a powerful surveillance tool, allowing its operator full and permanent access to the target device. It enables the extraction of important information such as passcodes, files, photos, contacts and web browsing history, and can take screenshots. The operator can also activate the device’s microphone and camera, making it possible to monitor any activity through or near the device, such as conversations taking place in the same room as the device.

In Greece no legislative framework has been passed that provides for the use of spyware software such as Predator. Furthermore, the basic law governing the operation of the National Intelligence Service (NIS) does not provide for the use of such software (Law  3649/2008 – Government Gazette 39/Α’/3.3.2008). Therefore, the targeting and hacking of victims through Predator or any other similar spyware in Greece is completely illegal, whether done by the state authorities or by a private actor, and is in violation of Article 19 of the Constitution, which enshrines the absolute inviolability of communications.

This case follows the cases of PASOK leader Nikos Androulakis and journalist Thanasis Koukakis. According to the digital security service of the European Parliament (CERT-EU), Mr. Androulakis was targeted with Predator in September 2021, during the same period that the NIS removed his right to the privacy of communication. According to Mr. Androulakis himself, he was targeted by both Predator and the NIS only five days apart. According to an inside story report, in the summer of 2021 journalist Thanasis Koukakis’ mobile phone was hacked by Predator, with a forensic analysis by the University of Toronto’s Citizen Lab finding that Koukakis’ phone was infected by the software during the period between July 12 to September 24, 2021. According to a report by Reporters United, the NIS were also monitoring the journalist in the summer of 2020, from June 1 to August 12. Koukakis has appealed to the European Court of Human Rights.

The Greek government has denied any involvement with the use of Predator or any other malware, however they have yet to discover who is using Predator in Greece.

Mounting evidence of illegal surveillance raises questions not only about the use of malicious software in Greece, but also about the modus operandi of the National Intelligence Service, for which the prime minister is institutionally responsible. Following his victory in the 2019 elections Kyriakos Mitsotakis placed the agency under his direct control (Official Gazette: Issue Α’/119/8.7.2019). The use of illegal surveillance software to monitor politicians and journalists raises issues not only for the rule of law, but also for the freedom of the press and essential democratic values.