The EU needs tighter regulation of the spyware industry, a European parliament special committee has said, after concluding that Hungary and Poland had used surveillance software to illegally monitor journalists, politicians and activists.
A special European parliament committee voted on Monday for a temporary ban on the sale, acquisition and use of spyware while the bloc draws up common EU standards based on international law. The moratorium would be lifted only on strict conditions, including independent investigations into the abuse of spyware in the EU.
A committee report found that Hungary and Poland’s nationalist governments had “weakened and eliminated” safeguards on spyware, “effectively leaving victims without any meaningful remedy”. MEPs also raised questions about the use of the spyware in Spain and Greece, while voicing concern that many EU member states had created a “safe haven for the spyware industry, often in violation of union laws and standards”.
Although non-binding, the vote is one of the most comprehensive responses by lawmakers yet to the Pegasus project, revelations by a consortium of journalists that governments were using powerful spyware to target domestic opponents, foreign politicians and investigative reporters.
The lead author of the report, Dutch centrist MEP Sophie in ’t Veld, said all member states were guilty of silence on the issue. In an interview with the Guardian ahead of the vote, she said EU leaders had failed to hold Hungary, Poland and other states to account on spyware. “What’s happening here is not a technical issue. It’s so basic: opposition, scrutiny, criticism, dissent. These are vital elements of a democracy. And they’re being throttled, and everybody is quiet about it. I find it shocking.”
The veteran MEP accused national governments of “hiding behind the argument” that national security is not in the purview of the EU. “It may well say in the treaties that national security is a national competence, but that is not a blank cheque for violating the rights of our citizens or destroying democracy.”
She also highlighted how EU governments appear to have granted export licences, enabling spyware companies to sell their wares to repressive regimes, despite EU laws against such trade. According to her report, a company based in Greece was said to be exporting its products to Sudan, Bangladesh, Madagascar and at least one Arab country, while in France two firms were being prosecuted for exporting surveillance technology to Libya, Egypt and Saudi Arabia.
In its resolution, the Pegasus committee said such actions were “a severe violation of fundamental rights” and “a gross violation” of EU export rules, namely the “dual-use regulation”, which prohibits the sale of products that can be used by authoritarian regimes to repress their own people.
The problem, In ’t Veld argued, was a failure by the European Commission to enforce EU law, in failing both to ask questions and to take rule-breaking member states to court. “This is a perfect illustration of how the European Commission is so afraid to piss off the national governments that it just refuses to enforce,” she said, reflecting her long-standing critique that the national governments have too much sway in the running of the EU.
The MEPs’ resolution also concluded that the EU’s foreign service, the European External Action Service, was guilty of breaking EU law and of maladministration by helping countries in the Sahel region develop surveillance capabilities.
The committee’s recommendations, which were approved with 30 votes in favour, five against and two abstentions, are expected to be approved by the full European parliament in June.
The final report and list of recommendations follow a year-long investigation by the committee, which was set up after 80 journalists, working with the French non-profit group Forbidden Stories, revealed that politicians and activists were being targeted by governments that had bought Pegasus spyware from the Israeli firm NSO Group.
The spyware effectively turns people’s phones into surveillance devices without their knowledge, copying messages, harvesting photos and recording calls.
The Guardian and other members of the consortium found that the French president, Emmanuel Macron, and nearly his entire cabinet were on a leaked list, suggesting they were of interest to NSO clients.
At the time of the revelations, NSO Group said the consortium had made “incorrect assumptions” about the clients using its technology. In December 2021 it promised to take legal action against customers “misusing” its technology.
In the run-up to Monday’s vote, the most hard-fought sections of the report centred on Greece and Spain. Both governments are facing questions over their use of spyware but have powerful support inside the European parliament.
The Greek prime minister, Kyriakos Mitsotakis, has confirmed that the opposition leader Nikos Androulakis was targeted by spyware, which he described as a mistake that should never have happened. An early draft of the MEPs’ resolution said it was “highly probable” that Predator, a cheaper alternative to Pegasus, had been “used by or on behalf of persons very close to the prime minister’s office”.
Mitsotakis is a member of the centre-right European People’s party, which is the largest group in the European parliament, although the group does not have a majority.
In Spain, judges are grappling with two spyware scandals: the alleged targeting by Morocco – strongly denied – of Spain’s socialist prime minister, Pedro Sánchez, and one of his ministers, as well as surveillance by Madrid of dozens of Catalan independence leaders.
According to the MEPs’ resolution, 65 Catalan politicians, lawyers and activists are believed to have been victims of spyware. Spanish authorities have admitted targeting 18 of the 65 with court authorisation, but refused to provide information on the rest, citing national security concerns.
Spain had “on paper, most of the necessary safeguards in place”, In ’t Veld said, but in practice, the targets of spyware found it difficult to bring cases to court.
Based on her conversations with Spanish sources, the MEP predicted that the Spanish investigation into spying by Morocco would be swept under the carpet because it was “just too awkward for diplomatic relations”.
In a statement following the vote, In ’t Veld said the parliament’s work was not finished: “Not one victim of spyware abuse has been awarded justice. Not one government has really been held accountable.”
