Spyware Predator : Greece’s “Watergate” scandal

Status: 10/11/2022 11:36 am

A Greek opposition politician and a journalist were bugged with spy software. The government denies any involvement – but there are links between it and the company that distributes the spyware.

By Verena Schälter, ARD Studio Athens

The small hall is filled to the last seat. Around 200 people are hanging on the every word of the man who came all the way from Canada: Bill Marczak from the Citizen Lab at the University of Toronto has been working with Pegasus, surveillance software from the Israeli company NSO Group, for years. His research results have made headlines around the world.

Canadian experts find more spyware

In July 2021, Marczak and his colleagues examined the mobile phone of a human rights activist from Saudi Arabia and discovered a second new piece of spyware alongside Pegasus. “The spyware carried the name Predator in the software code several times, which interested us a lot.” They began investigating and found an infected link on the phone. If you click on it, Predator installs itself automatically and the mobile phone itself becomes a modern bug.

Marczak and his team wanted to know who is behind Predator: “Ultimately, we found 28 IP addresses that had the same digital fingerprint as the website to which the infected link was linked. One of them was a website ending in Cytrox.com and Cytrox […] is among the companies that sell spy programs to governments.”

And they found out even more: Together with specialists from Meta – the new name of the Facebook group – Marczak published a report in December: It lists 400 links, most of which were used to install the spy software Predator. Many of them looked like links to Greek news sites at first glance.

Greek journalists were also bugged

The Greek financial journalist Thanasis Koukakis also read this report – and was taken aback: he had received one of the links listed months earlier by SMS. He immediately contacted Bill Marczak and Citizen Lab. Researchers conducted a forensic analysis of his cell phone.

Journalist Thanasis Koukakis at the Athens Supreme Court. He has filed a lawsuit against surveillance by the Greek secret service.

Image: AFP

“On March 10, 2022, I was informed by the University of Toronto that they had found the infection and also how my phone had been infected with the Predator software” – namely via the link in the SMS, according to Koukakis.

Senior officials resign

At the beginning of August, the Greek government admitted that the EYP secret service was monitoring Koukakis and a leading opposition politician. However, the phones of the two were only tapped with conventional means. The government denied the use of the Predator spy software.

On the same day, the then head of the secret service and one of the prime minister’s closest associates, Grigoris Dimitriadis, resigned.

Had to resign: Grigoris Dimitriadis, nephew of the prime minister and his chief of staff until the wiretapping scandal (archive photo from 2019).

Image: EPA

Connections to the close environment of the head of government

Dimitriadis was not only Prime Minister Mitsotakis’ chief of staff, but is also his nephew. And research by Greek investigative journalists suggests that there are connections between him and the company behind the Predator spyware.

Thodoris Chondrogiannos is one of the journalists who uncovered this connection. He is part of Reporters United, an association of investigative journalists in Greece.

We have identified a web of business people and business relationships that connects the government and Intellexa. At the same time, a politician and a journalist were bugged by both the EYP secret service and the Predator. So there is a suspicion that the government is also behind the use of Predator.

What did the Greek government know?

The Predator spy software was developed by Cytrox, a start-up from North Macedonia. Cytrox, in turn, now belongs to Intellexa, a consortium of companies founded by a former high-ranking member of the Israeli secret service. However, Intellexa’s website states: “We are an EU based and regulated company with six offices across Europe.” There are connections to Ireland, Malta, Cyprus – and Athens, among others.

So are there actually also links between the Greek government and Intellexa? And if Predator was not used by the Greek secret service, as the government claims – by who?

EU Parliament investigates spyware

A question that Sophie in ‘t Veld is also asking herself. The Dutchwoman is a member of the European Parliament and rapporteur for the so-called PEGA Committee. He is to investigate the use of spy software within the European Union.

I am very surprised that Intellexa’s offices were not searched. I would have expected the authorities to confiscate the servers, the computers, all the administration and everything else and question the employees. But none of that happened. So I’m afraid a lot of evidence has already been destroyed.

At the beginning of November, the PEGA committee will travel to Greece and Cyprus in the hope that at least the MEPs will get some answers from the Greek government.

The Greek Watergate scandal

Verena Schälter, BR, October 11, 2022 11:36 a.m

source site