EU’s latest spyware scandal prompts calls for urgent action

Jump to main content

Search

REG AD

security

EU urged to act after Pegasus infects phone of spyware inquiry MEP

Campaigners demand investigation and long-delayed action on PEGA Committee recommendations

Connor Jones

Connor<br>Jones

Cybersecurity reporter

Published<br>mon 6 Jul 2026 // 18:00 UTC

Civil liberties groups have accused the EU of dragging its feet in implementing key measures to prevent spyware infections after Citizen Lab revealed a former member of European Parliament was placed under surveillance during his time in office.<br>Stelios Kouloglou, a former investigative journalist, served as a Greek MEP between 2014 and 2023 and was a substitute member of the inquiry into the use of Pegasus and other spyware (PEGA Committee). After Citizen Lab forensically analyzed his device, the research organization revealed on Friday that his iPhone was infected with Pegasus in October 2022 and again in March 2023, when key hearings about the committee's formal recommendations were taking place.<br>"The fact that Stelios Kouloglou's device was infected with an intrusive form of spyware that only governments can procure, while he was actively involved in the parliamentary inquiry committee that was investigating spyware abuse by European countries, raises serious concerns about the integrity of independent oversight at the highest levels in Europe," said Elina Castillo Jiménez, advocacy and policy advisor for the Security Lab at Amnesty International.

REG AD

"The brazen targeting of someone in his position underlines how inadequate the current system is, and is yet another wake-up call that the protections that were put in place to prevent this kind of abuse are still not being implemented in Europe."

REG AD

Amnesty International is one of the civil liberties groups to co-sign the joint statement to the EU, which lists several demands to ensure spyware abuse "is met with accountability, not impunity."<br>The signatories called for the EU's Directorate-General for Information Technologies and Cybersecurity (DG ITEC) to launch a robust investigation into the hacking of Kouloglou's iPhone and pinpoint who was responsible.<br>Attribution is notoriously difficult in cyberattacks, especially spyware cases.<br>Citizen Lab was unable to definitively pinpoint the NSO Group customer that launched the attacks on Kouloglou, but said it had found no indications that the Greek government was responsible, despite its "extensive" historical abuse of Intellexa's Predator spyware.<br>However, the research unit posited that the same Pegasus operator that was behind the attacks on seven targets in 2024, all of whom were exiled activists and journalists from Russia, Latvia, or Belarus, was behind the attack on Kouloglou.<br>The statement also called on the EU to "urgently and publicly" respond to the PEGA Committee's recommendations issued in May 2023, and disclose which of its key points have or have not yet been implemented.<br>The recommendations fell short of prohibiting spyware sales outright, instead favoring the tight regulation of spyware sales and use within the EU.<br>Member states seeking to use spyware lawfully would have to involve Europol, be subject to independent oversight, and thoroughly investigate all allegations of abuse.

REG AD

The statement's signatories, however, believe that the EU has failed to deliver a meaningful response to the PEGA Committee's recommendation, leaving the bloc exposed to repeated spyware scandals.<br>The signatories further called on the EU to "guarantee effective remedies for victims," which could include access to evidence, notifications of when surveillance occurred, and ensuring those behind the spyware are held accountable.<br>Campaigners also want to see meaningful reform of the 2021 Dual-Use Regulation. The EU's framework for safely exporting spyware products is currently under evaluation, and the statement calls for any updates to reflect the PEGA Committee's recommendation.<br>The EU has updated the Regulation several times since adopting it in 2021, and has routinely stood by the system, which aims to reduce the risk that cyber-surveillance tools are exported for use in human rights abuses.

MORE CONTEXT

Ireland wants to give its cops spyware, ability to crack encrypted messages

EU proposes spyware Tech Lab to keep Big Brother governments in check

Ex-Meta security staffer accuses Greece of spying on her phone

EU funds are flowing into spyware companies, and politicians are demanding answers

Critics remain unconvinced that the EU is enforcing the Regulation effectively, believing that the required level of monitoring is not being met, which in turn is allowing spyware to spread.<br>For example, the Centre for Democracy and Technology Europe (CDT), which examined the export controls in four EU countries, said in December that spyware traveling across borders within the EU is not subject to the requisite licensing or accountability measures to...