Spyware and political games

by George Kakouris

The European Parliament's Committee of Inquiry's draft report on the use of spyware in the EU was lengthy and comprehensive, but in the case of Cyprus, a sizable portion of the information was a repetition of already well-known facts and concerns about the absence of the required institutional framework.  The rapporteur's unequivocal assertion that Cyprus is a hub for the export of surveillance technologies (produced outside of Cyprus) to other nations, as well as the documentation of information on links between political figures in Greece and Cyprus helps to justify the use of Predator in Greece, were the draft's most notable features. MEPs have been informed of the "tricks" a company can use to export surveillance products, despite the Cypriot government's claims that it never did. The report is still being drafted but is not yet final or binding. Its adoption could happen as early as March or as late as June, and debate over the draft is anticipated to begin in late November.

In spite of the report's non-binding nature, PEGA members are already divided over its conclusions, as evidenced by rapporteur Sophie in 't Veld's decision to make the draft public and the responses of MEPs from the European People's Party.

Bypassing the rules

While much of the draft chapter on Cyprus is devoted to the well-known facts of the black van case and the widely-publicized allegations of journalist Makarios Drushiotis' surveillance, a sizable portion of it focuses on the official procedures by which lawful interceptions can be carried out for national security reasons. The NSO Group claimed in a 2001 transparency report that the company's operations were governed by "the export control authorities in the countries from which we export our products: Israel, Bulgaria, and Cyprus," but the Cypriot government responded to PEGA's questionnaire that the company had not exported from Cyprus. This immediately raises questions for PEGA.

The draft's paragraph 213 mentions articles from Inside Story and Phileleftheros, noting that "Cyprus reportedly grants export permits to spyware companies leniently in practice. To avoid the rules, businesses employ strategies. In other words, the product's hardware is shipped to the recipient nation without the software already installed. Another option is to add a thorough description of the product while still stating that it is only being exported for demonstration purposes."  This reference doesn't specifically detail the actions taken by the companies under investigation, but it essentially illustrates how exports could have been made... without being produced, with companies using their presence in an EU country to claim that they are operating legally while governments ignore or conceal the fact that the country is becoming a hub for the sale of such technologies.

According to the government's response to PEGA, NSO Group (which makes Pegasus) has no presence in Cyprus, but six of its board members have established or acquired businesses there, according to paragraph 241 of the report. In this context, the report contains details supplied by AKEL regarding the export of Pegasus through a subsidiary of NSO Group in the United Arab Emirates, and there is a reference (with reference to M. Droussiotis' book and a Haaretz article) to the presence of Saudis at a presentation of the software in Limassol, Cyprus, a year prior to the murder of Khashoggi.

The parties and PEGA

Even before the PEGA delegation's visit to Greece and Cyprus ended, rapporteur Sophie in 't Veld (Liberals, Netherlands) told the press that she would present her draft on November 8th, immediately after sharing it with her colleagues. This was preceded by public clashes with Elisa Wozemberg (European People's Party, Greece), who accused the rapporteur of using the committee to promote personal views, and Saskia Brickmont's (Greens, Belgium) Twitter response that what was discussed at the press conference had been agreed.

The EPP MEPs in PEGA, led by Xuan Ignacio Zoido (EPP, Spain), immediately dissociated themselves from their stance in a letter to all members of the committee of inquiry and criticized In 't  Veld's manipulations. According to reports, PEGA is frequently tense, with EPP MEPs downplaying the findings while defending the Mitsotakis government and its chairman, Jeroen Lennaers (EPP, Netherlands), keeping the peace by stating after Zoido's letter that the document was a draft and refraining from taking a side.

On the one hand, the EPP is accused of treating Poland and Hungary (where it has no relations with the governments) differently than Greece and Cyprus while on the other, the EPP accuses both Ms. In 't Veld and the opposition in Greece and Cyprus of politicising the debate.

Pressure

The action taken by In 't Veld can be seen as an effort to use public opinion to put pressure on both her colleagues and national governments (which include not only Greece and Cyprus but also Poland, Hungary, and Spain and other countries whose legal systems the ecosystem of surveillance companies exploits).  In addition, PEGA received a letter (dated 18/10), signed by the Head of the Permanent Representatives to the Council of the EU, shortly before the draft was made public. As stated, the letter was sent at the request of the Member States following the distribution of the questionnaire to all Member States. Member states emphasize their commitment to upholding the rule of law and to "productive cooperation between the institutions" in the letter, but they also note that "under the Treaties, it is the responsibility of the Commission to supervise and evaluate the application of EU law by member states."

The Commission gathers data

The Commission itself confines itself to reiterating statements made in public regarding the rule of law and its expectation that member states will uphold the rule of law when conducting surveillance for national security purposes. After the draft was released, Christian Wigand, the Commission's spokesman for justice, told reporters that "we are gathering information on the alleged use of spyware such as Pegasus and Predator" and mentioned the provisions of the proposed European Media Freedom Act that would restrict the surveillance of journalists.  Constitutionally, the Commission can only wait for the report to be adopted and approved by the Parliament's plenary in March, when PEGA's mandate expires, or in June if it is extended (a committee of inquiry's mandate can be extended twice for three months). Remember that the Commission's Rule of Law report (which recorded allegations of surveillance in Greece in 2022) is issued in July and serves as a tool for prevention and consultation. The Commission could potentially initiate infringement proceedings in relation to the dual-use regulation or for violations of the rule of law, but this appears unlikely at this time. 

[This article from Kathimerini's printed edition was translated from its Greek original]