Spyware company Intellexa fined €50,000 for holding up Greek inquiry

Greece’s Data Protection Authority (DPA) has issued the Israeli-owned spyware consortium Intellexa a €50,000 fine (about $54,000) for failing to comply with its investigations into the use of the controversial technology.

The DPA’s inquiry was launched following press reports in Greece which claimed that senior public figures — including the chief of national defense staff and the leadership of the political opposition — had been placed under surveillance.

The agency said its investigation is focusing on “cases of the installation of tracking software on users' mobile terminal devices, with the aim of tracking them without their knowledge, as well as the subsequent collection and processing of their personal data collected by such software.”

Described as the Greek Watergate, the scandal emerged following journalist Thanasis Koukakis reporting that his mobile phone had been hacked by the Predator spyware, which is sold by Intellexa, while investigating government corruption.

Greek Prime Minister Kyriakos Mitsotakis announced last November that his government would ban the use of spyware following these reports. A law criminalizing the sale or possession of spyware was subsequently passed by Greece's parliament in December.

Police raids on figures connected to the scandal are reportedly continuing.

According to an official document published on Monday, when DPA staff attempted to conduct an audit at Intellexa’s registered address in Athens they found it was instead occupied by an accounting firm used by Intellexa.

When the authority subsequently attempted to conduct another inspection at the company’s offices in Elliniko, a coastal suburb just south of Athens, they found the three-storey building was “completely empty and without a functional network infrastructure or IT system.”

Intellexa had been informed of the inspection beforehand.

Subsequently the consortium gave the DPA its verbal commitment that it would comply with the investigation and provide a range of requested documents, but the DPA said it has now fined Intellexa for "unreasonable delays" in responding to its requests and for not providing the information which the DPA is certain is in its possession.

Alongside the fine, the DPA has ordered Intellexa to immediately turn over all of the invoices and receipts it has generated since being launched, as well as all of the consortium’s contracts "related to production, manufacture, customization or processing in any software or hardware."

Intellexa did not immediately respond to The Record’s request for comment.

It was among the companies highlighted for criticism in a draft report by a committee of the European Parliament alleging that European Union governments have used “spyware on their citizens for political purposes and to cover up corruption and criminal activity.”

Intellexa has been investigated by the Citizen Lab as part of its civil society work tracking the abuses of spyware.

According to Citizen Lab, companies participating in the consortium have faced legal challenges before judges in France that specialize in crimes against humanity and war crimes cases. Two separate allegations related to "complicity in torture in relation to product sales to the Libyan government and complicity in torture and forced dissappearance in relation to product sales to the Egyptian government."

One of these companies, Cytrox, was identified by Meta in 2021 as part of the global surveillance-for-hire industry. Meta stated that it believes the company's customers include organizations in Armenia, Colombia, Côte d’Ivoire, Egypt, Germany, Greece, Oman, Saudi Arabia, Vietnam and the Philippines.