[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhlPU0s5_0eIIUptoEYcmkaoziDmN0r6i0ENDhc66Mmw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"39cee85d-af14-4317-87e8-1243eedb47de","government-spyware-abuse-exposes-critical-gaps-in-accountability-and-victim-rights","3037cd85-ad5f-4ee4-8d29-dc580effa60a","Government Spyware Abuse Exposes Critical Gaps in Accountability and Victim Rights","The confirmed infection of Greek journalist Thanasis Koukakis with Predator spyware — and the broader pattern of Pegasus and Paragon abuse across EU member states — reveals a systemic failure of regulatory accountability rather than a purely technical security lapse. Governments invoking national security claims to deny victims even basic surveillance disclosures leaves individuals with no meaningful recourse, undermining the rule of law. Despite the European Parliament issuing concrete recommendations in 2023 — including victim support funds and independent forensic laboratories — member states have taken no action, demonstrating that policy recommendations without enforcement mechanisms are largely symbolic. This matters because the absence of consequences emboldens further abuse and erodes public trust in both democratic institutions and the broader digital rights framework.","**Immediate actions for affected individuals and organizations:**\n- Conduct forensic device audits using tools like Amnesty International's Mobile Verification Toolkit (MVT) if spyware infection is suspected.\n- Document and preserve all evidence of suspected surveillance for potential legal proceedings before devices are wiped or replaced.\n\n**Institutional and regulatory actions:**\n- Establish independent, government-arms-length forensic laboratories at the EU level to verify spyware infection claims without relying on member state cooperation.\n- Create legally binding victim notification and disclosure obligations that cannot be overridden by national security exemptions without judicial oversight.\n- Implement enforceable sanctions on member states that fail to investigate or disclose unlawful surveillance within defined timelines.\n\n**Long-term governance improvements:**\n- Require mandatory licensing, end-use auditing, and binding export controls for commercial spyware vendors operating within or selling to EU member states.\n- Establish a standing EU parliamentary committee with subpoena power to compel member state transparency on surveillance tool procurement and use.",[12,13,14,15,16],"GDPR Article 15","GDPR Article 79","NIS2 Article 21(2)(b)","NIST SP 800-53 IR-6: Incident Reporting","MITRE ATT&CK T1430: Location Tracking",{"GDPR Article 15":18,"GDPR Article 79":19,"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1430: Location Tracking":21,"NIST SP 800-53 IR-6: Incident Reporting":22},"Article 15 grants individuals the right of access to data processed about them, which member states are denying to spyware victims by invoking national security claims without judicial oversight.","Article 79 guarantees effective judicial remedy against controllers, yet victims in Spain and Hungary have been unable to obtain even basic surveillance information, rendering this right meaningless in practice.","NIS2 requires incident handling procedures including detection and reporting, but no equivalent obligation exists to notify victims of state-sponsored spyware incidents, leaving them uninformed for years.","Commercial spyware like Predator and Pegasus exploits mobile device capabilities including location tracking and data exfiltration, illustrating how mature adversarial techniques are being deployed against civil society targets with no accountability framework in place.","IR-6 requires timely reporting of security incidents to affected parties and authorities, a standard that government spyware programs systematically violated by concealing surveillance operations from victims.","published","2026-11-12T16:22:18.104313+00:00","2026-11-12T16:22:18.064+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F202922\u002Fmalware\u002Fpredator-pegasus-and-graphite-governments-accused-of-spyware-abuse-face-little-accountability.html","predator-pegasus-and-graphite-governments-accused-of-spyware-abuse-face-little-a-b15130","Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",[],[]]