EU lawmaker investigating surveillance hacked by Israeli spyware, report says

A former member of the European Parliament was hacked with Pegasus spyware while serving on a committee investigating surveillance by the tool’s Israeli creator, a Canadian research group has found.

The iPhone of Greek investigative journalist Stelios Kouloglou, who served as an MEP from 2015 to 2024, was infected at least three times with Pegasus spyware in 2022 and 2023, Citizen Lab said in a report released on Friday.

The three incidents, which occurred while Kouloglou was in Athens and Brussels, coincided with the ex-parliamentarian’s time on a committee tasked with investigating the illegal use of Pegasus and other spying tools in the European Union, according to Toronto-based Citizen Lab.

European lawmakers established the PEGA Committee in 2022 following revelations that governments in the bloc had used Pegasus to monitor journalists, activists, politicians, and other citizens.

Kouloglou received Apple threat notifications about possible Pegasus breaches after the intrusions, but only months after each incident, according to Citizen Lab.

Kouloglou, who did not immediately respond to Al Jazeera’s request for comment, requested that the research group conduct a forensic investigation of his phone in May.

Citizen Lab said in its report that the incident highlighted the “serious threat that mercenary spyware poses to the integrity of democratic processes.”

“Whichever entity is responsible for the hacking, the infection could have exposed strictly confidential exchanges among PEGA Committee members and their staff, and other sensitive and confidential parliamentary proceedings, including to parties under investigation by the Committee itself,” the report said.

Citizen Lab did not attribute the hacking to a particular government, but said it found no evidence to suggest that the Greek government was responsible.

Pegasus, developed and sold by Herzliya-based NSO Group, allows its operator to secretly take control of a target’s phone, allowing remote access to a device’s messages, photos, contacts, camera and microphone.

While NSO Group markets Pegasus as a legitimate tool for law enforcement and intelligence agencies to target criminal groups, the spyware has also been used to spy on journalists, lawyers, dissidents, and government officials.

In 2021, NSO Group was blacklisted by the administration of US President Joe Biden for acting “contrary to the foreign policy and national security interests of the US.”

Last year, a US judge also barred NSO Group from targeting the encrypted messaging app WhatsApp, arguing that its software causes “direct harm.”

NSO Group did not immediately respond to a request for comment. The company has previously said that it carefully vets buyers and that it has terminated contracts with users found to have abused the software.

The European Commission did not immediately respond to inquires.

Rand Hammoud, director of the security, surveillance and human rights programme at the Center for Democracy and Technology Europe, said the case should concern “everyone who cares about democracy, fundamental rights, and the rule of law in Europe.”

“The fact that a member of the European Parliament serving on the PEGA Committee, the very committee established to investigate spyware abuse, was reportedly targeted with Pegasus raises serious concerns about the integrity of democratic oversight itself,” Hammoud told Al Jazeera.

She described the cyberattacks as part of a “broader failure to effectively rein in the commercial spyware market.”

German MEP Hannah Neumann, who also served on the PEGA Committee, said the European Parliament should immediately investigate the breaches.

“Spyware doesn’t make democracies safer,” Neumann said in a post on X. “It weakens democratic oversight, parliamentary independence and the rule of law.”