The first-instance prison sentences, delivered in an Athens court on 26 February, provide long-sought but partial justice for one of the most prominent cases of spyware surveillance against a journalist in Europe in recent years, and follow a years-long campaign for accountability by IPI and other press freedom groups.
According to IPI monitoring, this is also thought to be the first case anywhere in the world of individuals in the commercial spyware sector being criminally charged and convicted of marketing, distributing and using spyware which was used to illegally surveil a member of the press – marking a major step forward for accountability for the abuse of spyware technologies globally.
The surveillance of Koukakis was part of a wider wiretapping and spyware scandal in 2022 which became known as the “Greek Watergate”, involving the targeted and coordinated surveillance of more than 80 people, including government ministers and military officials.
On Thursday, the court convicted four individuals from Intellexa, the private company at the heart of the scandal, with violating the confidentiality of telephone communications and illegally accessing personal data and conversations using Predator.
The businessmen, all founders, executives or shareholders in the companies involved, were each sentenced to 126 years in prison, of which eight years must be served. All defendants plead not guilty. The first-instance verdict will be appealed.
IPI Executive Director Scott Griffen said: “This verdict is a major legal victory which provides accountability and justice for the illegal surveillance of a respected journalist and IPI member Thanasis Koukakis. We hope this ruling will be upheld on appeal and IPI will continue to monitor the case closely. This is a win not only for all those who pushed for justice, but also for the Greek investigative media community, who have fearlessly documented the surveillance scandal and its implications in Greece in recent years, facing abusive lawsuits in doing so.
Griffen added: “The illegal surveillance of journalists using tools like Predator and Pegasus continues to pose a severe threat to press freedom and journalist safety globally. This ruling boosts efforts to hold those responsible to account, but more needs to be done – IPI continues to work with our members and partners around the world to document spyware attacks on journalists, support legal safeguards, and push for justice for abuses.”
Koukakis told IPI: “The decision of the Athens Single-Member Misdemeanor Court to impose exemplary punishment on the producers and distributors of the spyware and to refer the case for further investigation, including possible acts of espionage, marks a return to institutional normalcy. It reaffirms that no one is above scrutiny and that journalistic sources, democratic oversight, and the rule of law are not negotiable. Justice must now be pursued fully and without fear or favour. The rule of law is not anyone’s private domain.”
Surveillance case
In February 2022, it was revealed that Koukakis – a contributor to Greek investigative platform Inside Story as well as international media such as the Financial Times and CNBC – had his mobile phone surveilled for at least ten weeks in 2021 using Intellexa’s technology.
Predator is a highly invasive commercial spyware that, among other methods, utilises zero-click infections to target devices, allowing the attacker to gain full access to a target’s phone to extract data, contacts and messages, including those sent through encrypted applications, as well as turn on the microphone and camera. The infection was confirmed after a forensic analysis by digital security research centre Citizen Lab.
At the time, the surveillance of Koukakis was the first publicly confirmed case of a journalist in Europe being spied on using Predator. In October 2022, he sued Intellexa in Greece for criminal breach of privacy and communications laws. Though the technology is developed by Cytrox, it was marketed by Intellexa, at the time based in Athens.
The spyware scandal revealed multiple additional targets of Predator spyware in Greece, shaking the government and leading to widespread demands for answers.
After initial criticism over the slow pace of justice in investigating the case, a dedicated criminal trial concerning Intellexa began in March 2025 before the Single-Member Misdemeanor Court of First Instance in Athens. The trial was adjourned and resumed in the autumn. The almost four-month-long proceedings heard testimony from more than 50 witnesses, including Koukakis, who provided detailed testimony to the court.
Questions remain over wider state involvement
Despite the verdict against individuals connected to Intellexa, serious questions remain over the potential involvement of state intelligence bodies in the spyware surveillance of Koukakis and many other targets in Greece.
At the same time as the spyware surveillance, Koukakis had also been put under traditional wiretapping by the Greek intelligence body, the EYP. This surveillance of his phone was conducted in June–August 2020 under a “national security” justification and was approved by an EYP prosecutor.
At that time, Koukakis had been investigating alleged financial misconduct related to Piraeus Bank and figures later linked to the Predator supply chain.
When Koukakis then filed a complaint with the Greek communications authority ADAE to identify whether he had been wiretapped through his telecom provider, the EYP immediately terminated the surveillance the same day. This action by the EYP raised concerns that the wiretap was halted to avoid disclosure and wider institutional scrutiny.
Crucially, evidence shows that as soon as the official state surveillance of Koukakis was ended by the EYP, the illegal use of Predator spyware surveillance against Koukakis began. This surveillance continued for around two months.
The Greek government has publicly admitted that the EYP, which was previously put under the supervision of the Office of the Prime Minister, conducted legal, conventional surveillance of the journalist. However, it has repeatedly denied that the state purchased or used Predator or that it has any relationship with Intellexa.
One third of all individuals infected with Predator in Greece were, at the same time, also under traditional wiretapping surveillance by the EYP, pointing to a pattern of overlap and potential coordination of surveillance between state and non-state actors.
Although a substantial body of circumstantial evidence indicates the coordination or at least parallel use of traditional state wiretapping by the EYP and Predator spyware used by Intellexa, direct proof that EYP operated or requested the use of Predator has not been established.
In the recent court verdict against Intellexa the judge stated that the four defendants appeared to have acted with the participation of “unknown third parties”. The judge indicated this could have been officials from Greek and foreign intelligence services.
The judge also ordered that trial reports containing crucial information about this element of the trial could be sent to the Athens Prosecutor’s Office for assessment. This could open the door to espionage investigation involving state bodies in the future.
While four individuals from the private company Intellexa have now been criminally convicted, currently no government politicians or officials from the EYP or wider state intelligence or law enforcement bodies in Greece has been investigated or charged with involvement in the use of spyware, which was illegal at the time.
After the scandal emerged, in 2022 the Greek government responded by criminalising the use of commercial spyware in Greece. Before the revelations, no law had explicitly banned the use of such tools by private actors. However, the same law also effectively legalised the use of spyware surveillance by state bodies, under strict conditions.
Advocating for accountability
Throughout this process, IPI consistently documented and highlighted the surveillance of journalists in Greece. In cooperation with media freedom partners, IPI wrote to the Greek government to demand accountability and answers and engaged with the European Parliament’s PEGA Committee investigating spyware abuse within the EU.
During a 2022 press freedom mission to Greece by the Media Freedom Rapid Response (MFRR), IPI questioned a government minister over the surveillance, who was unable to provide additional information. During the mission, the delegation also met with other authorities and institutions in Greece connected to the spyware scandal, as well as with journalists affected by surveillance, including Koukakis.
In 2023, IPI published an in-depth report into the targeting of journalists in Greece using Predator, which probed the potential involvement of state authorities.
IPI will continue to closely monitor the legal proceedings on appeal and push for accountability for the illegal surveillance of journalists in Greece, as well as strong implementation of the new European Media Freedom Act (EMFA) rules on spyware use.
Despite sanctions, Intellexa remains one of the world’s leading providers of advanced commercial spyware. It now operates outside Greece and continues to market and sell its surveillance tools to governments around the world.
Library
