EU called to take action following the impact of Pegasus on its spyware investigation.

      Civil society organizations and Members of the European Parliament (MEPs) are urging the European Commission to take immediate action regarding spyware, following confirmation from Citizen Lab that Stelios Kouloglou, a member of the PEGA committee investigating spyware, was hacked with Pegasus in both 2022 and 2023. The identity of the attacker is unknown, the Commission has not commented, and the PEGA committee's recommendations from 2023 have largely gone unaddressed. This follows up on TNW's previous report about the hacking incident.

      There is increasing pressure on the European Commission to respond to issues related to spyware after forensic evidence indicated that one of its own investigators was targeted with Pegasus. Civil society organizations released a joint statement insisting that such abuses should be met with accountability rather than impunity.

      Citizen Lab revealed that Stelios Kouloglou, a former Greek MEP, was compromised in October 2022 and again in March 2023 while he was part of the PEGA committee, which investigates these specific abuses. The attacker has not been identified, and Citizen Lab does not suggest that the Greek government was involved. However, the same Pegasus-associated email address that appeared in a previous campaign against journalists across Europe raises concerns about unauthorized users of the NSO Group tool operating in various countries.

      The hacker potentially gained access to confidential documents and discussions within the committee, leading lawmakers to characterize the incident as an attack on the rule of law. The left faction within the Parliament is calling for stringent EU-wide restrictions on the use of spyware.

      The Commission did not respond to TechCrunch's request for comments. It has yet to provide a public account of its implementation of the 2023 recommendations from the PEGA committee, and campaigners are now seeking a public roadmap to address this gap.

      The signatories of the statement outlined a series of European scandals involving spyware: targeting exiled journalists in Latvia, Lithuania, and Poland; the targeting of the Parliament's president with Predator; and Graphite infections in Italy, where fake WhatsApp applications with spyware have appeared. EU public funds have reportedly ended up in the surveillance industry, according to EUobserver.

      Enforcement of the EU's dual-use export regulations remains inconsistent, highlighted by leaked Bulgarian export licenses to repressive regimes. While the EU officially regulates spyware vendors, it sometimes also finances them.

      Moreover, NSO Group has considered selling Pegasus, which raises additional accountability concerns, as its customers continue to find targets in Europe. The PEGA committee dedicated two years to documenting the spyware issue in Europe, and one of its members was hacked during this process. If this situation does not prompt the urgent action that campaigners are advocating for, it is difficult to envision what might.