Wiretapping scandal: the chronicle of a cover-up

Jul 31, 2024

On July 30, the Prosecutor of the Supreme Court, Georgia Adilini announced what was the widely expected archiving of the case of illegal wiretapping, regarding the part which concerns the National Intelligence Service and any other state agency or authority.

Apparently, in the course of merely three working days, Adilini was able to read the 300-page report compiled by the Deputy Prosecutor of the Supreme Court, Achilleas Zisis, who has been conducting the preliminary examination of the case for the past nine months. The two prosecutors of the Court of First Instance –Angeliki Triantafyllou and Konstantinos Spyropoulos– were suddenly dismissed

Achilleas Zisis started drafting the legal part of his report last April. At that point he had not collected all the witness statements (the last ones were made in June); a few days ago he mentioned to some of the parties involved that he would continue taking statements until September.

The finding was eventually filed at the end of July and the Prosecutor of the Supreme Court decided to file misdemeanour charges against certain legal representatives and beneficial owners of companies, for the crime of violating the confidentiality of communications. The charges will be brought directly before the court to verify whether or not they are well-founded. This means that there will be no further investigation.

According to the statement made by Adilini, no Greek state agency ever used Predator to monitor –among others– several ministers, the Chief of the Armed Forces, opposition officials, journalists and businessmen – despite the fact that according to our investigation the Predator software is exclusively available to state actors.

The question then arises: who needed the personal data and communications of all these people? Is it not breach of duty to not identify the person or persons who were behind the interception of personal data and confidential communications of so many people, many of whom are related to the country’s state security? This is espionage since –according to the Supreme Court– the spying did not come from within the state.

In the beginning was the Prosecutor’s Office

The investigation of the case by the Public Prosecutor’s Office began ex officio in April 2022, immediately after the first publications by inside story about the illegal wiretapping of journalist Thanasis Koukakis’ mobile phone

. However, the procedure did not move quickly –not necessarily due to the prosecutors who were assigned to the case– thus allowing for precious time to pass in favour of those involved and of course in favour of the government, which from the first moment wished to downplay the case that harmed its image.

Regardless of who is to blame –the reluctance of prosecutors or, according to inside story sources, the reluctance of the police to investigate the actions of their colleagues in the National Intelligence Service (NIS) and acquaintances at the highest levels of the Hellenic Police and the government– the bottom line is this:

In November 2022, after a long delay, the Prosecutor’s Office asks the Financial Police to conduct an investigation at the headquarters/residence of legal and natural persons related to the case, such as Intellexa, Krikel, Yannis Lavranos, Felix Bitzios and the then director of the Prime Minister’s office and nephew of Kyriakos Mitsotakis, Grigoris Dimitriadis. A few days later, the Prosecutor’s Office makes a second request, addressed to the Electronic Crime Directorate, asking for the establishment of a joint team with the Financial Police to conduct these investigations; but this time, the residence of Gregory Dimitriadis is missing from the list.

In the confidential finding delivered in June 2023 to the two Prosecutors of the Court of First Instance, the Data Protection Authority (DPA) writes that “at this stage, the Authority does not have any data from which it is possible to identify a specific controller (natural or legal person) for the activities of installation and use of the spyware under investigation. Therefore, further examination of the case is required”.

However, neither the Prosecutors of the First Instance, nor subsequently the Deputy Prosecutor of the Supreme Court, Achilleas Zisis, showed any inclination to examine all the evidence identified in the 96-page conclusion of the DPA.

What the prosecutors and Zisis did not do

What didn’t they do? Even though they already knew –since early February 2023– that on December 16, 2021 (the day the two investigations by Citizen Lab and META

on Intellexa’s Predator were published) two Greek employees of the company had visited a data center maintained by Intellexa at a site in Maroussi and removed servers and other equipment without warning, they never called them to testify.

Two useful questions they could have asked, had they called them, would have been what those servers were used for and where had they been taken to. If they really wished to shed light to the case, they could have had the privacy of the two employees’ communications lifted, in order to find out who and why had ordered them to rush to the data center. Additionally, none of the prosecutors turned to META (Facebook’s parent company), which in its communication with the DPA said that it possessed data including, among other things, the “target” users and the Facebook accounts through which the targeting was done. META says that in order to provide this information, a formal request for judicial assistance would have to be made; something which the prosecution authorities never made. Prosecutors did not make a formal request to Citizen Lab either, which has useful technical aspects of the case at its disposal.

The only Intellexa employee called to testify named Merom Harpaz as the head of the company’s offices in Athens and the one who did all the hiring. Merom Harpaz was never called to testify. By the way, the employee who made the technical presentations of the products (proof of concept) exclusively to foreign customers of the company, states in his testimony that the only customers of Intellexa were governments and government agencies. He also named his immediate supervisor, who was also not called to testify.

The delay in comparing the list of Predator targets with the list of legitimate privacy waivers under the pretext of national security is also of significance. This was finally done in June 2024 by the Deputy Attorney General of the Supreme Court, in a rather problematic manner. On the one hand there was the reluctance of the CSA to proceed with this audit ex officio, by going to the providers, and on the other hand there was the delayed order of the Prosecutor General’s Office that reached the CSA in October 2023, shortly before the two prosecutors were removed from the investigation by decision of the Supreme Court Prosecutor and after the unconstitutional replacement

of the members of the CSA –whose term of office had expired– with other persons of the government’s liking.

Prosecutors also did not investigate the persons who paid the servers that hosted the fake websites (such as blogspot.edolio5[.]com, which was used 86 times to infect devices or emvolio-gov[.]gr), or the persons who paid to send the SMS that were infected with links from these malicious websites to the targets. These persons used means of payment such as Paypal, prepaid electronic cards from Viva and a prepaid Mastercard issued by the National Bank of Greece. The lifting of the privacy of the transactions could possibly have revealed where the money needed to make the electronic payments was transferred from.

And while the Data Protection Authority has been stressing, since last summer, that further investigation is needed, having exhausted all the means at its disposal, the Supreme Court Deputy Prosecutor asked them once again, for a second time in two years, if they had taken any other steps and what they were. It should be noted that no one from the DPA was called as a witness, nor was the Authority’s technical assistance sought in understanding complex technical issues included in its finding that had to do with the Predator software and the channels of infection used by its operators.

The baton is passed to the Supreme Court

In the course of his nine-month investigation into the wiretapping case, the Deputy Prosecutor of the Supreme Court, Achilleas Zisis, limited himself to taking 44 witness statements. He issued only one order, in June 2024, to cross-check Predator targets identified by the Privacy Authority against the privacy waiver orders issued for national security reasons by the NIS – that is, not including those issued by the Anti-Terrorism Agency.

As we wrote recently

, the experts appointed by Achilleas Zisis, making their own calculations and several logical leaps, concluded that the fact that 27 people (out of at least 87 targets) were simultaneously targeted with the legal interception ordered by the NIS and the illegal surveillance through the Predator spy software, is a mere coincidence and that the two methods of interception of communications had no relevance to each other.

As Supreme Court Prosecutor Georgia Adilini said in the statement

explaining her decision to archive the case regarding the part concerning the NIS and other state agencies and to prosecute individuals on misdemeanor charges for breach of secrecy, during the preliminary examination “almost all the witnesses proposed by the plaintiff-petitioners were examined”. What Adilini does not mention, of course, is how superficial the examination of key witnesses was in some cases, and the omission of other persons with knowledge of the facts.

The witness statements collected by the Deputy Prosecutor of the Supreme Court include those of the former prosecutor of the National Intelligence Service, Vasiliki Vlachou (herself a target of Predator), the former commander of the NIS Panagiotis Kontoleon (against whom victims of surveillance have filed lawsuits), Themistocles Demiris (its current commander), high-ranking NIS executives and employees as well as former commanders of the service (Roubatis, Dravillas). Testimonies were also given by (current and former) high-ranking officials and officers of the Hellenic Police.

All their testimonies can be summarized as follows: regarding the legal surveillance, everything was done by the book and nobody knows anything about the illegal surveillance through Predator. Some people just happen to know socially two of the individuals who are indirectly or directly related to the spy software marketed by Intellexa.

Something that prosecutors have known since July 2023, when we published the relevant story

, was that a classified draft of a memorandum of cooperation between the NIS in Athens and the Operational Technical Service in Skopje was circulating between the two agencies on cybersecurity issues. Panayiotis Kontoleon admitted to its existence during his testimony to the parliamentary committee of inquiry. This draft had been communicated to the Prime Minister’s Office in March 2022, at which time Kyriakos Mitsotakis’ nephew, Grigoris Dimitriadis, was still in charge. The draft was highly confidential and was the product of meetings between Panagiotis Kontoleon and the head of the OTA, Zoran Angelovski.

As we had published and later testified to the Deputy Prosecutor of the Supreme Court Achilleas Zisis, in this document there was a digital trace left by an Intellexa associate, Nir Ben Moshe, who made editorial corrections to the english text. Nir Ben Moshe was never called to testify. The fact that a classified document which was to be signed by the then commander of the NIS together with the head of the OTA, and of which the Prime Minister’s Office had knowledge, had been corrected by Intellexa was obviously not deemed sufficient for Zisis to ask a question about it during the examination of witnesses Panagiotis Kontoleon and Grigoris Dimitriadis.

Throughout the prosecution’s investigation, the fact that none of the –confirmed by the Data Protection Authority– Predator targets and victims were called to testify as witnesses, is striking. The only ones who have testified are those who sought it out on their own.

The money trail that no one followed

On October 23, 2023, the day on which the Prosecutors of First Instance were suddenly removed from the investigation, the Tax Police Department of the Financial Police delivered the findings of the preliminary investigation of the bank accounts of individuals and legal entities involved; it was the investigation which had been requested by the Prosecutor’s Office in December 2022.

The findings of the Financial Police show that Intellexa paid a company of an Israeli-born Czech national EUR 165,494 in 2020, EUR 299,905 in 2021 and EUR 91,050 in 2022. Intellexa’s affiliate Apollo Technologies paid another company, owned by the same person, EUR 83,300 in 2021 and EUR 108,200 in 2022. Another group company, Feroveno Limited, paid a third company of the Czech national a total of EUR 2,200,000, of which EUR 13,040 goes directly to him. The financial police never established who were the actual beneficiaries of the companies, for a sum that between 2020-2022 approaches EUR 3 million. According both to information that we published in April 2022 and to more recent stories published in foreign media, this person designed the fake websites that were used to trap mobile phones with the Predator spy software.

On top of the above, the Deputy Prosecutor of the Supreme Court did not request judicial assistance for the opening of the accounts of all the companies affiliated with the Greek Intellexa AE in foreign jurisdictions, with which the Greek company had regular transactions. Nor was the help of the Money Laundering Authority ever used (although it was offered). It should be noted that in order to establish a felony, it would have to be proven, inter alia, that there was a financial benefit of more than 120,000 euros from the interception of personal data.

The prosecution investigation in both phases (Prosecutors of the Prosecutor’s Office, Deputy Prosecutor of the Supreme Court) avoided dealing with the initial phase of the Israeli company’s establishment in Athens in the spring and summer of 2020. At that time the surveillance system was launched, recording the conversations of those who had dealings with the Group Naval frigate company and those involved in the confrontation with Turkey in the Aegean in August 2020 (the Oruc Reis case).

The Predator programmer who knows everything but was never asked anything

In March 2017, along with six other Israeli businessmen, Rotem Farkas founded Cytrox, the company that developed the infamous Predator spy software, in Skopje. In 2018, Cytrox was acquired by Intellexa, a company owned by Tal Dillian, a former commander of a select technology unit of the Israeli Defense Forces, with Rotem Farkas remaining in the group. In the second half of 2020, Rotem Farkas’ professional obligations on behalf of Intellexa lead him to decide to move to Paleo Faliro, a suburb of Athens.

According to people who met with Rotem Farkas during the months of his stay in Greece and wished to remain anonymous, he claimed that he came to Greece at the invitation of the Greek government and after they had agreed to use the company’s software, that he had met with various government officials and that he had received assurances from the Greek government that they would pass a law to legalize the use of spyware. This published story

was at the disposal of the Deputy Prosecutor of the Supreme Court, but Rotem Farkas was never called to testify, although confirmed media investigations have shown that he knew all about the company’s first steps in Greece and its partners here.

In her statement, Supreme Court prosecutor Georgia Adilini argues that Greece is the only country in the European Union where there has been such a thorough prosecutorial investigation into the use of spy software. This is not true. Similar investigations have been carried out in Spain, France, Hungary and recently an investigation was reopened in Poland, after the election of a new government and the change of leadership of the Judiciary. As for the adjective “thorough”, perhaps we are speaking a different language with the prosecutor.

by Adilini in October 2023.

We remind our readers that publication of articles on our site does not mean that we agree with what is written. Our policy is to publish anything which we consider of interest, so as to assist our readers  in forming their opinions. Sometimes we even publish articles with which we totally disagree, since we believe it is important for our readers to be informed on as wide a spectrum of views as possible.