REPORTS
Questions raised around the thoroughness of the criminal investigation into the wiretapping scandal
On July 30, 2024, the Prosecutor of the Supreme Court, Georgia Adilini, issued a statement announcing the results of the judicial investigation into the wiretapping scandal, which was conducted by the Deputy Prosecutor of the Supreme Court, Achilleas Zisis.
Ms. Adilini noted that, as regards orders lifting the secrecy of communications issued by the prosecutor of the National Intelligence Service (EYP), Vasiliki Vlachou, the procedure provided for by law was strictly followed. She also stated that the investigation had confirmed that no state agency was ever involved with the spy software Predator or any other similar software.
However, quite apart from the issue of Ms. Adilini’s erroneous invocation of the case law of the Court of Justice of the European Union (CJEU) regarding the need for a specific justification of the prosecution’s privacy waiver orders (an issue we approached in detail here), influential personalities from the field of law and well-researched press reports have raised further issues pertaining to the thoroughness of the investigation.
As previously pointed out by Reporters United and Efsyn (3.8.2024), the Deputy Prosecutor of the Supreme Court, Mr. Achilleas Zisis, in the course of his investigation, had failed to summon for questioning the three Intellexa employees who – after Citizen Lab first broke the scandal about the use of Predator against targets in Greece – visited a data center in Maroussi where they downloaded the company’s servers. Intellexa is the Greek company that both marketed Predator and exported it under license from the Greek government.
Furthermore, a report in Vima (5.8.2024) noted that the investigation had not taken into account the fact that the two Greek businessmen accused of running Predator (Yannis Lavranos and Felix Bitzios), had long-standing acquaintances with persons at the highest level of government, as well as with state officials, and nor were the indirect partnerships that existed with some of them, which were identified by a Financial Police investigation in October 2023, taken into account. The same report notes that the officials investigating the case never examined why the National Intelligence Agency had put the 28 targets (who were also targeted by Predator) under surveillance, nor whether the Agency’s prosecutors were informed.
In another report (28.7.2024), Vima noted the failure to examine the fact that seven ‘targets’ of the illegal Predator software were baited with an SMS regarding their vaccination against Covid-19, which contained real data about the individual’s vaccination history. The Data Protection Authority had carried out a thorough investigation of the systems, finding no corresponding data leakage. The report points out that one way for the Predator operators to possess this personal data of their targets would have been if their phones were already being monitored by the security services, which they indeed were, and for this information to then have been shared with the Predator operators.
Inside story documented that during the investigation, Mr. Zisis never called the individual (Mr. Achilleas Kosmidis) in whose name the prepaid card used to pay for the sending of the infected Predator messages was registered. This, despite the fact that victims of the malware attack included former Prime Minister Antonis Samaras, PASOK President Nikos Androulakis and journalist Thanasis Koukakis. (Mr Kosmidis was ultimately exonerated by Mr Zisis in January 2025.)
Furthermore, inside story have highlighted how the investigation did not summon for questioning either the arms dealer Mr. Stavros Komnopoulos, or his nephew Mr. Panagiotis Tamvakidis who had been identified as potential collaborators of Intellexa.
Antonis Karampatzos, Professor at the Law School of the University of Athens in an article in NEA (1.8.2024) raised questions around why all known Predator victims were not called to testify, and why mobile phone providers were not investigated The article notes that the Prosecutor’s conclusion accepts that it was a mere coincidence that about 1/3 of the persons identified as Predator targets were also monitored by the Greek intelligence services. Karampatzos concluded that even an investigation at the highest judicial level has failed to shed light on this case, noting that the scandal has deeply wounded the rule of law in Greece.
All of these questions raise the issue of the effective protection of the constitutionally guaranteed confidentiality of communications on the one hand, and the effective functioning of the criminal justice system on the other.
Article 19 of the Constitution guarantees the confidentiality of communications as “absolutely inviolable” and provides that the Hellenic Authority for Communication Security and Privacy be the guarantor of the confidentiality of communications, “1. Secrecy of letters and all other forms of free correspondence or communication shall be absolutely inviolable… 2. Matters relating to the constitution, the operation and the functions of the independent authority ensuring the secrecy of paragraph 1 shall be specified by law.”
Furthermore, Article 96(1) of the Constitution provides that, “the punishment of crimes and the adoption of all measures provided by criminal laws belong to the jurisdiction of ordinary criminal courts.” .
However, the facts presented above suggest there may be gaps in the Supreme Court’s investigation; an investigation which ultimately did not refer to trial even a single state official or politician, but only four private individuals or representatives of companies. And these, only for a misdemeanour rather than a felony offence, despite the fact that the surveillance targets included ministers, opposition politicians, journalists, state officials and military officers, offences which by definition are linked to espionage. (1, 2, 3, 4, 5, 6, 7, 8, 9)
Predator is a powerful surveillance tool, allowing its operator full and continuous access to the target device. It enables the extraction of important information from the mobile device – such as secret passwords, files, photos, contacts and web browsing history – and can take screenshots and activate the device’s microphone and camera, making it possible to monitor any action taken through or near the device, such as conversations taking place in a room.
Furthermore, in Greece, no legislative framework had been adopted to provide for the possibility of using interception software at the time when Predator was used to target or monitor private and public officials in the country. Therefore, the use of Predator was illegal.
Despite the constitutional guarantee of the absolute inviolability of the confidentiality of communications (Article 19 of the Constitution) and the constitutional provision that “the punishment of crimes and the adoption of all measures provided by criminal laws belong to the jurisdiction of ordinary criminal courts.” (Article 96(1) of the Constitution), in this case, doubts have been raised at high levels by legal experts and investigative journalists that question the thoroughness of the judicial investigation into the so-called wiretapping scandal, which saw members of the government, the opposition, journalists, official and military personnel targeted for surveillance by malicious software.
Bank Account number: 1100 0232 0016 560
IBAN: GR56 0140 1100 1100 0232 0016 560
BIC: CRBAGRAA
In a time where the very foundations of democracy are gradually being eroded by the rise of extreme nationalism, alt-right movements, the spread of disinformation and corporate capture, the efforts of organisations such as Vouliwatch are more relevant than ever.
We rely on the generosity of each and every one of you to continue with our efforts for more transparency and accounta
By financially supporting Vouliwatch you support our litigation strategy, our campaigns for transparency and accountability in the political system, the development of new civic tech tools, our research projects and last but not least our impartial and accurate