AI-powered spyware used to track Italian journalists

Italian journalists and activists were covertly targeted with an Israeli military-grade spyware tool in an apparent state-sanctioned surveillance operation that undermined press freedom and raised fundamental questions about provacy, civil libertiesa and government accountability. What happened Between late 2024 and early 2025, several prominent Italian journalists, notably Francesco Cancellato and Ciro Pellegrino of the investigative news site Fanpage.it , discovered their mobile devices had been compromised. The campaign also targeted activists from the NGO Mediterranea Saving Humans. The breach was executed via "zero-click" exploits on platforms such as WhatsApp and iOS, requiring no interaction from the victims. Forensic investigations by Citizen Lab later confirmed the presence of Graphite, a military-grade AI-powered spyware that grants operators full access to messages, encrypted chats, location data, and the device’s microphone and camera. The Italian government admitted that seven Italians were targeted but maintained that any surveillance was lawful and overseen by a public prosecutor, denying it engaged in illicit spying. However, it offered no explanation for why journalists with no apparent connection to criminal investigations were included. Why it happened Italy's intelligence services authorised the use of Paragon's spyware in 2023 and 2024 to monitor a small number of individuals in connection with criminal investigations, including suspected terrorism, people smuggling, and espionage. The incident was made possible by the availability of "mercenary spyware" sold to government agencies with minimal oversight. The developer, Paragon Solutions , claims its technology is only for "fighting crime," but the lack of transparent auditing allowed the system to be used against civil society. Indeed, everything about spyware operates as a "black box": the technology itself, the market in which it is sold, and the use that law enforcement and intelligence agencies make of these tools are all deeply opaque. Compounding matters in an apparent attempt to avoid accountability, the Italian government issued increasingly contradictory statements: initially denying journalists had been surveilled, then refusing to answer parliamentary questions by invoking state secrecy. What it means The case has significant implications for press freedom, democratic accountability, and the regulation of surveillance technology across Europe. For those directly impacted, the incident represents a "digital violation" of their personal and professional lives, potentially endangering whistleblowers and confidential sources. For society, it signals a dangerous trend where democratic governments adopt authoritarian-style surveillance tactics, leading to a "chilling effect" on investigative journalism. Policymakers are now facing increased pressure to implement a moratorium on spyware sales and strictly enforce the European Media Freedom Act to protect the Fourth Estate from technological overreach. System 🤖 Graphite Developer: Paragon Solutions Country: Italy Sector: Media/entertainment/sports/arts; Politics Purpose: M onitor journalists, activists Technology: Spyware; Machine learning Issue: Accountability; Dual use; Human/civil rights; Privacy/surveillance; Security; Transparency Timeline ⏰ December 14, 2024. Francesco Cancellato’s phone is successfully infected with Graphite spyware during a synchronised "infection campaign." January 31, 2025. Meta (WhatsApp) notifies Cancellato and roughly 90 other global users that they had been targeted by a spyware company. February 6, 2025. Paragon Solutions reportedly terminates its contract with the Italian government amidst the unfolding scandal. April 29, 2025. Journalist Ciro Pellegrino receives a "mercenary spyware" alert from Apple, later confirmed to be a Graphite infection. June 12, 2025. Citizen Lab releases forensic evidence linking the attacks on European journalists to Paragon’s software. Marc

Date it happened

2024-01-01

Organisation involved

Government of Italy

Product, system or model

Graphite

This is a record of what was reported, not a finding that anyone broke the law. If it names your organisation and you believe it is wrong, the corrections process is free and open to everyone.