Italy: Call for full transparency after Fanpage editor-in-chief surveilled with spyware

Our organisations are alarmed by the latest case of a journalist within the European Union having their secure communications and sources compromised using advanced spyware technologies, representing yet another serious attack on press freedom.

In the wake of recent revelations, we also urge other governments in Europe to launch investigations into targeted surveillance against any other journalists who it emerges have been affected by the same spyware technology.

On 1 February 2025, it was revealed that investigative journalist Francesco Cancellato, the editor-in-chief of Italian news outlet Fanpage, was among more than 90 individuals worldwide to have had their WhatsApp hacked using Graphite, a military-grade zero-click spyware sold by Paragon.

According to WhatsApp, which said it disrupted the spyware attacks in December 2024, this list included journalists and civil society members around the world. In the EU, it is understood that individuals were targeted in 13 Member States: Austria, Belgium, Cyprus, Czech Republic, Denmark, Germany, Greece, Latvia, Lithuania, Netherlands, Portugal, Spain, and Sweden.

The full scope of the spyware hacking, as well as the number of journalists who were among the 90 individuals worldwide who were targeted, is currently unknown. Cancellato is the only journalist to have come forward publicly so far. It is also unclear how long he was targeted for and to what extent his communications were compromised.

Fanpage has published recent high-profile investigations into the youth wing of the Prime Minister Georgia Meloni’s party, the ‘Brothers of Italy’. However Cancellato has not speculated on the reason he was targeted, or by whom, and said that he had never been told by any authorities that he was under investigation.

In the wake of the revelations, the Italian government confirmed that seven mobile phone users within the country had been targeted and has said that its law enforcement agencies do use spyware. However, Prime Minister Giorgia Meloni’s office has denied any involvement in the targeting of journalists and the government has not formally acknowledged the existence of a contract with Paragon.

However, according to multiple media reports Paragon has suspended or terminated at least one of its two contracts with the country due to the violation of its terms of use. Like other spyware firms, Paragon markets its products exclusively to state intelligence and law enforcement agencies from approved governments.

While investigations have been opened within Italy and the case has received parliamentary scrutiny, the actor ultimately responsible for deploying the spyware has yet to be disclosed. However, multiple factors point to the involvement of at least one state agency from within Italy.

The MFRR stresses the need for urgent and thorough investigations to identify the source of the surveillance and how many media professionals were affected, in which countries, for how long, and under what legal justification. Those responsible for the potentially illegal surveillance of journalists must be held to account and steps must be taken to assess why legal safeguards to protect journalists from undue surveillance were potentially ineffective in EU Member States.

Amidst a global proliferation in spyware capabilities and a record number of abuses against journalists and other civil society actors, our organisations further call for the EU to refocus its attention on assuring strict implementation of the European Media Freedom Act (EMFA), which sets out new protections for journalists inside the bloc from undue surveillance.

Under Article 4 of the EMFA, the use of spyware is banned except in very specific cases including investigations of serious crimes, and requiring judicial approval. Establishing how such surveillance against media actors in Italy and beyond was permitted under current legal regulations, and whether due diligence was followed, will be vital in the coming months.

Under Article 4.7 of the EMFA, journalists surveilled using spyware in the EU also have a right to know about the accessing and processing of their personal data in the context of the deployment of the surveillance measures or the deployment of intrusive surveillance software as part of a criminal investigation. MFRR therefore urges Italian authorities to ensure the relevant provisions are upheld in the case of Cancellato, and any other journalists in Italy who it emerges were also surveilled.

Given the seriousness of this case for media freedom and its EU-wide considerations, we further support the recent initiative of Italian MEPs to request that the European Parliament establish a Commission of Inquiry into the Graphite spyware case. We also support the recent initiative by the National Federation of the Italian Press (FNSI) and the National Order of Journalists to file a criminal complaint over the spyware hacks with the Rome Public Prosecutor’s Office.

Our organizations remain committed to advocating for the strongest possible regulations against spyware use against journalists and other civil society actors within the EU, and beyond, and will continue to assist journalists who believe they may have been targeted by spyware in connecting with experts for diagnostic tests on their mobile devices.

*If you are among the journalists within the EU to have received messages from Meta/WhatsApp about hacking in December 2024, please reach out to MFRR representatives at the following secure communication to discuss for device testing: contactMFRR@proton.me

This statement was coordinated by the Media Freedom Rapid Response (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States, Candidate Countries and Ukraine.