Security researchers have confirmed that a European politician’s phone was hacked with the Pegasus spyware while he was working on an investigative committee looking into abuses of the notorious surveillance tool. This has reignited new debate over whether governments are misusing spyware to gather information about their critics.
Researchers at The Citizen Lab at the University of Toronto’s digital rights unit say the confirmed phone hacking of Greek journalist and former politician Stelios Kouloglou during 2022 and 2023, a member of the European Parliament’s PEGA committee, is the first time Commissioned by European governments to investigate phone spyware attacksknown to the public as a victim of spyware.
Kouloglou told TechCrunch in a phone call that it was “reckless” that his phone was intentionally compromised. One European lawmaker described the hacking of Kouloglou’s phone as a “direct attack on the rule of law” and called on the European Commission to take concrete measures by imposing strict restrictions on the use of spyware in the 27 member state bloc.
While spyware attacks on lawmakers are rare, the timing and targeting of a committee investigator under investigation by spyware suggests an intense focus on the committee’s internal affairs ahead of a long-awaited report detailing its findings. The hacks raise fresh questions about how governments use spyware that is supposedly needed to identify serious crimes but is then caught snooping on the communications of journalists, lawmakers and critics.
Citizen Lab researchers did not link the phone hack to a specific country, but said a government client used a Pegasus-laden email address used in a previous campaign to hack the phones of journalists in Europe. The identity of the customer is unknown, but the repeated use of the same attack email address suggests that the customer has permission from NSO Group to use the Pegasus spyware to track phones in multiple European countries.
A spokesperson for the European Commission did not respond to TechCrunch’s request for comment. The NSO Group also did not respond to a request for comment on the Citizen Lab report prior to publication.
In his report was released on FridayCitizen Lab said Kouloglou was hacked in October 2022 and at least twice in March 2023 using an exploit that compromised a security flaw in Apple’s iPhone software. The vulnerability has been patched, but the fix has not yet been installed on Kouloglou’s phone. The exploitation was a “zero click” errorthat is, the spyware hacked and stole his data without requiring any interaction from him.
Wrong a previously discovered abuse A flaw in Apple’s smart home software used on iPhones. This allowed the spyware to capture private information from Kouloglou’s phone, such as her text messages and other correspondence, location data and photos, without her knowledge.
The timing of the October 2022 hack coincides with the intense debate over email and text messaging during October and November 2022, ahead of the release of the first draft describing spyware abuses in Cyprus, Greece, Hungary, Poland and Spain.
The hack also matches the exact time Kouloglou was in the hospital for a pre-planned operation, possibly allowing spyware operators to listen in on ambient audio of him discussing his health or other conversations he had with visitors.
Months later, on March 6 and 7, Citizen Lab Kouloglou said Kouloglou’s phone was hacked again by the same Pegasus operator while Kouloglou was traveling from Athens to Brussels, during committee hearings and months before the committee finalized and adopted its draft written report.
In a call, Kouloglou told TechCrunch he didn’t know why he was specifically targeted, but believed it was because of his work on a European Parliament committee investigating Pegasus abuses.
He described his anger when he found out his phone had been hacked.
“You understand that all your private information (was taken) — not all professional exchanges or messages with ministers — but very private things like happy moments and sad moments,” he told TechCrunch.
Kouloglou said he plans to sue Israeli-headquartered spyware maker NSO Group. The use of NSO has been largely banned in the United States since the Biden-era government issued an executive order banning the use of spyware that could violate people’s human rights.
Last year, the spyware maker confirmed an unnamed American investment group spent tens of millions of dollars likely entered the company as part of an effort Restore NSO’s closed brand creates conditions for violation of human rights.
Kouloglou said he went public with his story “for democracy, human rights and the fight against corruption.”
“Corruption worries everyone,” he said.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
