Paragon is not collaborating with Italian authorities probing spyware attacks, report says

Last year, WhatsApp and Apple notified several people in Italy, including journalists and activists, that they had been targeted with government spyware. In particular, WhatsApp pointed the finger at the Israeli-American surveillance tech maker Paragon Solutions as the company that provided the technology for a hacking campaign that targeted around 90 people around the world with its “Graphite” spyware.

The notifications prompted a scandal in Italy that is still unfolding. After being notified of the attacks, a number of victims filed criminal complaints with Italian authorities, and prosecutors then opened an investigation. 

Now, it appears that Paragon, despite its previous promises to help Italian authorities investigate the scandal, is said to be uncollaborative.

According to Wired Italy, Italian prosecutors sent a formal request for information to Paragon, via the Israeli government, but a year after the investigations were opened, the company has yet to respond.

Following the eruption of the spyware scandal in Italy, Paragon publicly called out the Italian government, claiming it refused the company’s offer to investigate whether a journalist was hacked and spied on with its Graphite spyware. The company went so far as to cancel its contract with Italy’s two spy agencies, AISE and AISI, in part because the Italian government turned down the company’s offer to help.

It’s unclear why Paragon has not responded to the prosecutor’s request. It’s possible that the Israeli government intervened. In 2024, The Guardian reported that the Israeli government seized documents from NSO’s office to prevent the company from complying with demands in the lawsuit against WhatsApp.

Israeli human rights lawyer Itay Mack told Wired Italy that the Israeli government could force local companies to cooperate with foreign judicial requests for information, “but this has never happened.”

Spain’s High Court closed its investigation earlier this year into the use of NSO’s spyware to target Spanish politicians, claiming Israeli authorities did not cooperate with its probe.  

Paragon, the Israeli embassy in Washington D.C., and the prosecutors’ offices in Rome and Naples, which are jointly investigating the case, did not respond to TechCrunch’s request for comment. 

In the history of government spyware, it’s extremely rare for a company to get into a public fight with one of its former customers. Paragon’s move was likely motivated by its longstanding attempts to appear as an ostensibly more righteous alternative to other spyware makers, such as NSO Group or Intellexa, which have been ensnared in countless scandals around the world.

Instead, Paragon’s official website, which no longer loads, said the company provides customers “with ethically based tools, teams, and insights.”

So far, this is Paragon’s first public scandal, but the company now has an active contract with the U.S. Immigration and Customs Enforcement, which for a year has been arresting and deporting tens of thousands of immigrants all over the country. ICE told lawmakers that its law-enforcement arm Homeland Security Investigations (HSI) is using Paragon’s spyware to counter terrorism and drug trafficking.    

Italy’s government under Prime Minister Giorgia Meloni has always denied hacking two of the journalists, Francesco Cancellato and Ciro Pellegrino, who work at the online news website Fanpage and whose phones were targeted by Paragon’s Graphite. The Citizen Lab, a research organization that has investigated spyware abuses for more than a decade, confirmed both journalists were hacked with Graphite.

The other victims in the country include activists who work for Mediterranea Saving Humans, an Italian nonprofit with the mission of rescuing migrants who try to cross the Mediterranean Sea.

Last June, the Italian parliamentary committee that oversees the country’s spy agencies investigated the scandal, and concluded that the targeting of the activists was lawful. But also said it could not find evidence that Cancellato was targeted, and the committee did not investigate Pellegrino’s case at all. 

Then, in March, the same prosecutors who have requested information from Paragon said in a press release that a forensic investigation into Cancellato’s device confirmed that his phone had indeed been hacked, while it could not conclude the same after analyzing Pellegrino’s phone.

The prosecutors’ investigation is still ongoing.