A report by the Italian Parliament on the use of Israeli-made spyware by government agencies has drawn criticism for downplaying allegations that journalists were targeted, even as it confirmed surveillance of humanitarian activists aiding refugees.
The spyware in question, Graphite, is developed by Paragon, an Israeli cyber technology company co-founded by former prime minister Ehud Barak and former Israeli intelligence official Ehud Schneorson.
The parliamentary committee’s findings, released last week, confirmed that two Italian intelligence agencies — AISE, responsible for foreign intelligence, and AISI, the domestic agency — used Graphite to monitor individuals deemed security threats. Italian officials claimed the surveillance was legal and conducted under judicial oversight.
However, critics say the report fails to fully address claims made by Francesco Cancellato, editor of the Italian news site Fanpage.it, who alleges he was surveilled because of his reporting on ties between Italy’s neo-fascist movements and antisemitic groups. Cancellato was the first to reveal he had been targeted and told Ynet in February, “I was really worried. Being targeted by spyware is a big problem for me. I believe they spied on me just because I'm a journalist.”
While the committee acknowledged Cancellato had been monitored, it found no evidence that Italian security agencies were responsible — a claim Paragon and independent observers find implausible.
Paragon offered to provide Italian authorities with software to check whether Cancellato’s phone number appeared in security databases using Graphite. The government declined the offer and instead accepted denials from agency heads that journalists were targeted.
Sources familiar with the matter told Ynetnews the decision to reject Paragon’s verification method was likely aimed at avoiding political embarrassment for Prime Minister Giorgia Meloni’s government, which approved the use of the spyware.
Italian officials also reportedly pressured Paragon not to release information that could confirm the surveillance of journalists. In response, Paragon canceled its contracts with Italy, a deal estimated to be worth tens of millions of dollars, citing violations of its licensing agreement and Israeli defense regulations.
Following the termination, Italian authorities claimed they were the ones to sever ties and have reportedly replaced Paragon with Italian offensive cyber firm NEGG, according to the French outlet Intelligence Online.
“We offered Italy and its parliament a method to verify whether Paragon’s systems were used illegally against journalists,” the company said. “After the authorities chose not to pursue this option, we canceled our contracts.”
Paragon has repeatedly stated that its tools are meant only for use against criminals and terrorists, not journalists or human rights defenders. However, critics say the company relies too heavily on client assurances that surveillance targets are engaged in illegal activities.
The controversy erupted in January after Meta, the parent company of Facebook and WhatsApp, reported that Paragon’s spyware had been used to breach about 100 WhatsApp accounts across 20 countries, including seven Italian users. The identities of the remaining users have not been disclosed.
Citizen Lab, a Canadian watchdog that specializes in analyzing digital surveillance, later examined devices belonging to Cancellato and others. Its March report found that the Graphite system may have been operated from servers in Germany and identified a digital fingerprint it dubbed “The Big Pretzel.” While it named several democratic nations as probable clients, no additional journalists or activists outside Italy were identified.
The scandal also touches on Italy’s broader domestic political divide over immigration. Activists who were surveilled include Luca Casarini and Giuseppe Caccia, founders of a refugee aid organization and outspoken critics of the Meloni government, as well as Father Mattia Ferrari, a Catholic priest who supports migrants.
While the government admitted to monitoring the activists, it denied tracking Cancellato or another Fanpage journalist, Ciro Pellegrino, whose surveillance was revealed last month.
Critics say the affair underscores the ethical risks posed by offensive cyber tools. Meta’s decision to alert affected users, while lauded by privacy advocates, may have disrupted criminal investigations in other countries, observers note.
Get the Ynetnews app on your smartphone: Google Play: https://bit.ly/4eJ37pE | Apple App Store: https://bit.ly/3ZL7iNv
Cancellato said he was disappointed in his government’s response. "If Italy is involved, I expected someone in the government to step forward and say, ‘Yes, we use Paragon’s tools, but only to catch criminals, not journalists. We will investigate whether anyone overstepped their authority.’ Or at least say, ‘It’s serious that a foreign government is spying on our journalists, and we will support you in finding out what happened,” he said. “But none of that happened.”
Journalist groups and civil rights advocates have warned that even legal surveillance becomes a threat to democracy when it targets the press. “The real danger isn’t privacy,” a media watchdog wrote in response to the report, “it’s the damage done to journalists’ ability to protect their sources — and, by extension, to hold governments accountable.”