Surveillance

In summer 2020, Thanasis Koukakis, an investigative journalist who reports on financial crimes and corruption in Greece, noticed his cell phone was acting a bit glitchy. He contacted a source who confirmed his fear — his device was being tapped — and on August 12 that year, he filed a complaint with Greece’s Communications and Privacy Authority asking if he was being monitored. Though Koukakis did not know until later, the Greek National Intelligence Service ceased its surveillance of him that same day.

In March 2021, the Greek parliament passed a law forbidding the Communications and Privacy Authority from informing citizens that they were under surveillance. The law retroactively applied to Koukakis and Malichudis, who was also under surveillance at that time.

Some months later, in July 2021, Koukakis was sent a text message with a spoofed link that appeared to lead to a Greek news blog. He clicked it, and his device was infected with the Predator software. Whoever was operating the spyware had full access to his phone — even passwords and encrypted apps — until the end of September 2021.

That was the same month that Nikos Androulakis was sent the same spoofed link in a text message. A member of the European Parliament, Androulakis was running to become leader of Greece’s third-ranking political party, the Panhellenic Socialist Movement (PASOK). Androulakis did not click the link. Days later, he was put under official monitoring by the National Intelligence Service that lasted until December 13, 2021, when he was elected leader of the center-left party.

All this information was revealed piecemeal this spring and summer through leaks and investigations that swallowed the Greek news cycle with each new revelation. The scandal reached a fever pitch on August 3, when two lawmakers anonymously admitted to Reuters that Koukakis had in fact been monitored by the National Intelligence Service. “I am surprised that areas that I cover as a reporter, economic policy and the banking system, can be a national security threat,” Koukakis told Reuters.

Shortly after, it was confirmed that Androulakis had also been wiretapped by the National Intelligence Service.

In the following days, Prime Minister Mitsotakis accepted the resignation of his general secretary (also his nephew) Grigoris Dimitriadis and National Intelligence Service chief Panagiotis Kontoleon. In a televised address, Mitsotakis admitted Androulakis had been officially monitored but stated, “It was a mistake. What happened might have been in accordance with the letter of the law, but it was wrong. I didn’t know about it and, obviously, I would never have allowed it.”

But fingers remained pointed at Mitsotakis, who had moved the country’s National Intelligence Service — previously overseen by the Greek Ministry of the Interior — under his purview shortly after his election in July 2019. It was later reported that the National Intelligence Service issued surveillance of fifteen thousand Greek phones in 2021.

“With his statement today, the prime minister again appeared blameless by adopting the narrative of a ‘legal error’ to justify a criminal act and the direct violation of the constitutional provision for parliamentary privacy,” Androulakis said in a statement. “I will not accept any cover up.”

Androulakis also pointed to the targeted Predator attacks, which the Greek premier did not mention in his address.

Predator

Predator was first exposed by the spyware research laboratory the Citizen Lab in December 2021. Predator requires targets to click a link, but once the malware enters a device, it has the ability to not only read every message and listen to every call but also open the camera and microphone to listen to conversations nearby. The spyware is sold by a company called Cytrox, based in North Macedonia, and is marketed by a consortium of companies called Intellexa, which has offices in Athens. The Citizen Lab found there were likely Predator customers in Greece, an assertion later supported by Google’s Threat Analysis Group, which stated: “We assess likely government-backed actors purchasing these exploits are operating (at least) in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia.”

Greek journalists have spent months looking into the murky connections between Predator, Intellexa, and the Greek government. A series of investigations at Inside Story found the Greek government had contracts with companies run by businessmen who had indirect connections with Intellexa in Athens. A Reporters United investigation found that Dimitriadis continued buying and selling companies despite being in office. One of the companies he bought was owned by people who were also dealing with the owner of Intellexa.

The Greek government has repeatedly denied using Predator and dismissed the connections pointed to in these investigations. “It is clear that the Greek authorities do not use this kind of software. They have no dealings with any company that manufactures or supplies this type of software,” stated government spokesman Yannis Oikonomou.

The Communications and Privacy Authority started an investigation into the Koukakis case and the allegations that the government had bought Predator, concluding three months later that the Greek government had not purchased the spyware. But during its investigation, the authority did not raid the offices of Intellexa, did not interrogate the workers, and did not look through company financial reports for 2021.

Many remain unconvinced. “Even if we believe the Greek government that they have nothing to do with Predator and a private actor is using Predator against Greek citizens, Greek journalists, and Greek politicians, we haven’t seen the will from the Greek government to safeguard its members and to find out who is actually using it,” said Eliza Triantafillou, a reporter at Inside Story who has been following the story and testified about her findings at the European Parliament inquiry earlier this month. She said the investigations have not been thorough and the prosecutions have been lagging.

“Why isn’t the Greek government willing to find out who is behind this?” she asked. “One reason is they are lying and they are behind this, or they know who is behind this and they are not willing to touch him. I cannot find any other reason for this reluctance and delay in shedding light on this spying case.”

On September 9, another opposition politician, Christos Spirtzis from the left-wing Syriza party, announced that he had been targeted by the same phishing link sent to Koukakis and Androulakis. Spirtzis blamed the prime minister directly in his announcement: “Mr Mitsotakis, how many other MPs, how many other politicians, how many other business journalists and citizens did you follow?”

Elections

Prime Minister Mitsotakis has sold himself at home and abroad as a modernizing liberal force for Greece, a symbol of efficiency and order after years of economic crisis. The surveillance scandal has revealed cracks in that rhetoric. A recent poll found three-quarters of Greek citizens believe the premier has a personal political responsibility for the phone surveillance scandal, and many believe he should resign. Members of his own party have critiqued him in the country’s parliament.

The scandal has also disrupted the coalition government predicted prior to this summer: Androulakis’s PASOK will almost certainly (though not necessarily) rule out a coalition government with Mitsotakis’s New Democracy.

Polls show that if the country were to head to elections now, Mitsotakis’s party would still be in the lead. Mitsotakis has tried to focus on the upcoming winter and Greece’s financial gains in recent statements, presenting himself as the only stable choice for Greece, regardless of the spyware revelations.

Malichudis believes his phone is no longer being monitored — but doesn’t believe the spyware scandal is over yet. “I think what we have seen now with these surveillance cases is still only 1 percent of what’s going on,” he said. In the months after he learned his phone had been tapped, he says he became anxious that he had exposed vulnerable sources and was worried about further surveillance. But he is glad the story broke: “And I think as more cases go out, and with each case so different, it shows just how widespread and scary this is.”