Spywares are a threat to democracy

Picture a snitch who never sleeps: they silently sits in your pocket, listens to your calls, switches on your microphone and camera at will, reads your encrypted messages, and tracks everywhere you go. This busybody doesn't need nor asks for permission, and you'd never know they were there. This is not science fiction. It is spyware, military-grade software sold by private companies or developed by governments. it is increasingly being turned against the very people whose job is to keep those governments honest: journalists. We can see spyware as a new form of power over journalists' bodies and minds: today's smartphone, voluntarily carried everywhere, adds to yesterday's hidden bug under the office desk, once the malicious software turned it into the perfect spy.

Nineteen attacks, thirty-eight victims, and those are just the ones we know about

Between January 2020 and October 2025, the Media Freedom Rapid Response consortium documented 19 spyware attacks against media workers in ten European countries, affecting 38 people in total. Numbers that are almost certainly an understatement.

Nearly every known case came to light through journalistic investigations, academic research, or corporate interests, such as the warns that Meta launched to 90 WhatsApp users in early 2025 to let them know they may have been targeted. States and institutions remain creepingly silent, reluctant to roll out a season of transparency, accountability and public oversight.

These spywares have names: Pegasus, Predator, Graphite, NoviSpy are the ones known to be used against journalists. Many other exists, many more undisclosed.

In nearly 79% of cases, the perpetrators of these attacks remain unknown: spyware is designed to remain invisible and leaves no traces, almost. In the rest of the cases, the frail trail leads to state security forces, either police forces or secret services. It is consistent with military-grade, dual-use softwares that are officially sold exclusively to government agencies. How long it will take to find out that private actors have had access to spywares too?

Three countries, three scandals

Three Southern European democracies emerged as epicentres of spyware scandals: for the sheer number of cases, their relevance, and the details that slowly emerged on these cases.

In 2022, five Spanish journalists were found to have been targeted with Pegasus, the infamous spyware made by Israel's NSO Group. Judicial investigations into the scandal have stalled, with civil society organisation Irídia blaming the failure to execute European Investigation Orders. Spain is now drafting two landmark laws: one recognising journalists' professional secrecy for the first time — explicitly banning spyware on journalists' devices — and another on classified information, replacing a Franco-era secrets law. But press freedom groups warn the classified-information bill could criminalise publication of state secrets with insane fines up to €2.5 million. Journalists wan't be exempted, nor will be able to tell people about the dirty dust under the state's carpet.
In 2022 in Greece, it merged that financial journalist Thanasis Koukakis's phone had been infected with Predator spyware. Hidden in a simple text message link, the software grabbed the journalist's professional secrets for at least ten weeks. Likely, his personal life and the ones of all of his family members, friends and peers who got in touch with him through the same phone were stolen away too. Five more Greek journalists were later found to have been targeted. In February 2026, an Athens court convicted four people, including three executives of the surveillance firm Intellexa, in the first judgement of its kind in Europe. Yet, no involvement of state officials or institutions was punished, and Greek media outlets that exposed the scandal still face criminal investigations over their own reporting. Greece passed a surveillance reform law in 2022, but critics note it allows prosecutors tied to the intelligence services to authorise interceptions. A role that should be reserved to independend judges.

In early 2025 it was revealed that Italian journalists Francesco Cancellato, Fanpage editor-in-chief, and reporter Ciro Pellegrino from the same outlet had been monitored with military-grade spyware Graphite. Italy's parliamentary intelligence committee run a brief investigation that led to little conclusions, denying any involvement of the Italian state, and pointing out to vague foreign secret services. Prosecutors later confirmed that cancellato's phone was hacked in a likely single "infection campaign" in late 2024, which included activits from a NGO working on migrant routes who were targeted by the Italian agency AISI, as the parliamentary committee admitted. This coincidence was not enough to find out the perpetrators of this attack.
Italian laws still prove inefficient in explicitly prohibit surveillance against journalists: the protection covers only fully registered professional journalists, and Cancellato's case proves its inconsistency, but it also leaves freelancers exposed with no safeguards.

The chilling effect: surveillance you can't see

The danger goes far beyond the individual journalists whose phones were hacked. It strikes at the foundations of democratic public debate. The mere possibility of being watched changes behaviour. Journalists who suspect they might be surveilled may drop sensitive investigations, avoid contact with confidential sources, or leave the profession altogether. Sources, too, grow reluctant to speak once they realise that a reporter's phone is a listening device for someone else. A phenomenon known as the chilling effect, that results in a quieter, narrower public conversation that steers away from sensitives or dangerous paths, no matter the stakes and the public interest in them.

How can a journalist perform its duty and abide to the obligations towards their fellow citizens? Spywares are a heavy blow to media's ability to act independently and in an efficient way, and they undermine the trust at the foundation of the relationship between the journalist and their public. Journalism is a cornerstone of democracy: if you attack them, you attack democracy too.

Europe's shield: a new law with cracks in it

In 2024, the European Union adopted the European Media Freedom Act. It is fully in force since August 2025, therefore member states are obliged to respect and enforce it. Its Article 4 prohibits member states from deploying spyware against journalists. Only under except in extraordinary circumstances, when every other investigative path has failed, a spyware can be used, and only with prior judicial authorisation.

But there are serious doubts about how effective this shield is. The exceptions to the safeguard are broad, starting from a list of "serious crimes" that includes terrorism and human trafficking, but also crimes such as counterfeiting or copyright violations, whose "seriousness". More concerns stems from the fact that any crime punishable with 5 or more prison years is also a reason to deploy a spyware, making penal codes amendments a way to expand the already cospicuous list of exeptions.
Moreover, Jjournalists under surveillance are rarely ever told how their data was collected, making the right to challenge abusive surveillance in court, as disciplined by the norm, largely theoretical.

As a final concern, even if the EU set an August 2025 deadline for national laws to align with the Act, yet transpositions on behalf of member states has barely begun, particularly the work on Article 4 specifically. Spain's reform is still a draft, and Italy has adopted nothing. Meanwhile, the spyware industry thrives. Surveillance technology companies have received substantial public funding from EU bodies and member-state governments, meaning European taxpayers are, in effect, helping finance the very sector implicated in attacking European journalists.

The reality is stark: spyware has become a normalised feature of contemporary security policies and practices, which resemble more policies of insecurity, and the opacity around its production, commercialisation, and usage makes true accountability nearly impossible. Yet there are signs of resistance: every single known case of spyware surveillance against journalists came to light because of the extraordinary results from journalism and academic research. Public outrage over these scandals helped push the EU to move out the comfort zone and legislate in the first place. Yet both states and private companies turn their heads to other, shadowy directions.

The ongoing test is, there fore, efficient enforcement. Article 4 of the Media Freedom Act sits on paper. Whether it protects journalists in practice depends on how EU countries write it into their national law. Until then, the assumption for anyone reporting on power in Europe may be the one recommended by surveillance scholars: act as if your devices are already compromised.

This article is based on the peer-reviewed study "Digital surveillance shaping the public sphere. The case of the use of spyware on journalists " by Sofia Verza and Dimitri Bettoni, published in Frontiers in Communication (30 September 2026), drawing on data from the Media Pluralism Monitor and the Mapping Media Freedom platform.

This content is part of the Media Freedom Rapid Response  (MFRR), a Europe-wide mechanism which tracks, monitors and responds to violations of press and media freedom in EU Member States and Candidate Countries. The project is co-funded by the European Commission.