Report says Paragon is not cooperating with Italian authorities investigating spyware attack

Last year, WhatsApp and Apple notified several people in Italy, including journalists and activists, that they had been targeted by government spyware. In particular, WhatsApp accused Israeli-American surveillance technology maker Paragon Solutions of providing technology to a hacking campaign that targeted around 90 people around the world using the spyware Graphite.

This notice caused a scandal in Italy that continues to this day. After being notified of the attack, a number of victims filed criminal complaints with Italian authorities, and prosecutors launched an investigation.

Paragon is said to be failing to cooperate with Italian authorities in their investigation into the scandal, despite previously promising to do so.

According to Wired Italy, Italian prosecutors sent a formal request for information to Paragon through the Israeli government, but Paragon has not responded a year after the investigation began.

After the spyware scandal broke in Italy, Paragon publicly criticized the Italian government, claiming that the Italian government rejected its offer to investigate whether journalists had been hacked and spied on by its Graphite spyware. The company even ended its contracts with two Italian spy agencies, AISE and AISI, after the Italian government declined its offer of assistance.

It is unclear why Paragon did not comply with the prosecutor’s request. It is also possible that the Israeli government intervened. In 2024, The Guardian reported that the Israeli government had seized documents from NSO’s offices to prevent the company from complying with the demands of a lawsuit against WhatsApp.

Israeli human rights lawyer Eitai Mak told Wired Italia that the Israeli government could force domestic companies to cooperate with foreign judicial requests for information, but “that has never happened.”

Earlier this year, Spain’s High Court closed an investigation into NSO’s use of spyware to target Spanish politicians, citing Israeli authorities’ failure to cooperate with the investigation.

Paragon, the Israeli embassy in Washington, D.C., and the prosecutors’ offices in Rome and Naples, which are jointly investigating the case, did not respond to TechCrunch’s requests for comment.

In the history of government spyware, it has been extremely rare for companies to get into public disputes with former customers. Paragon’s move is likely motivated by a longstanding attempt to present itself as an ostensibly more righteous alternative to other spyware makers such as NSO Group and Intellexa, which have been embroiled in countless scandals around the world.

Instead, Paragon’s official website (which is no longer loading) says the company provides customers with “ethically-driven tools, teams, and insights.”

This is Paragon’s first public scandal so far, but the company currently has an active contract with U.S. Immigration and Customs Enforcement, which has arrested and deported tens of thousands of immigrants across the country over the past year. ICE told lawmakers that its law enforcement agency, Homeland Security Investigations (HSI), uses Paragon’s spyware to combat terrorism and drug trafficking.

The Italian government, led by Prime Minister Giorgia Meloni, has always denied hacking Francesco Cancellato and Ciro Pellegrino, two of the journalists who worked for the online news site Fanpage and whose phones were targeted by Paragon Graphite. Citizen Lab, a research organization that has investigated spyware abuse for more than a decade, confirmed that both journalists were hacked with Graphite.

Other victims in the country include activists working for the Italian nonprofit organization Humans for the Rescue of the Mediterranean, whose mission is to rescue migrants trying to cross the Mediterranean Sea.

Last June, the Italian parliamentary committee that oversees the country’s spy agencies investigated the scandal and concluded that the targeting of activists was legitimate. However, it said it found no evidence that Mr. Cancerato was targeted and that the commission had not investigated Mr. Pellegrino’s case at all.

And in March, the same prosecutors who requested information from Paragon said in a press release that while a forensic examination of Mr. Cancellato’s device confirmed that his phone had indeed been hacked, an analysis of Mr. Pellegrino’s phone did not allow them to reach the same conclusion.

The prosecutor’s investigation is still ongoing.