Report says Paragon not cooperating with Italian probe into spyware attacks

Last year, WhatsApp and Apple alerted several individuals in Italy, including journalists and activists, that they had been targeted with government spyware. WhatsApp specifically identified Paragon Solutions as the provider of the technology used in a hacking campaign that reportedly targeted around 90 people globally using its "Graphite" spyware.

Those notifications sparked a major controversy in Italy that continues to develop. After learning of the attacks, several victims filed criminal complaints, leading Italian prosecutors to open an investigation into the matter.

Recent reporting now suggests that Paragon has not been cooperating with the inquiry, despite earlier indications that it would assist authorities. According to Wired Italy, prosecutors in Italy submitted a formal request for information to the company through the Israeli government. However, more than a year after the investigation began, Paragon has reportedly not responded.

Following the emergence of the spyware controversy, Paragon publicly criticised the Italian government, stating that officials had declined its offer to investigate whether a journalist had been targeted with its Graphite spyware. The company subsequently terminated its contract with Italy's intelligence agencies, AISE and AISI, citing in part the government's refusal to cooperate with its proposed internal review.

The reasons behind Paragon's lack of response to prosecutors remain unclear. There is speculation that the Israeli government may have played a role. In 2024, The Guardian reported that Israeli authorities seized documents from NSO Group's offices to prevent compliance with legal demands related to a lawsuit involving WhatsApp.

Israeli human rights lawyer Eitay Mack told Wired Italy that while the Israeli government has the authority to compel domestic companies to cooperate with foreign judicial requests, it has not done so in practice.

Earlier this year, Spain's High Court closed its own investigation into the use of NSO spyware against Spanish politicians, citing a lack of cooperation from Israeli authorities. Paragon, the Israeli embassy in Washington, D.C., and prosecutors in Rome and Naples — who are jointly handling the Italian case — have not provided further clarity on the matter.

It is uncommon for a surveillance technology company to clash with one of its clients publicly. Paragon's stance may reflect its effort to position itself as a more ethically aligned alternative to other firms in the spyware industry, such as NSO Group or Intellexa, both of which have faced numerous global controversies.

Paragon has previously emphasised its commitment to responsible practices, with its now-inaccessible website stating that it provides customers with tools and insights grounded in ethical principles.

Despite this positioning, the company is now facing its first major public controversy. It currently holds a contract with U.S. Immigration and Customs Enforcement, whose enforcement arm, Homeland Security Investigations, has reportedly used Paragon's spyware in efforts related to counterterrorism and drug trafficking.

Italy's government, led by Prime Minister Giorgia Meloni, has consistently denied targeting two journalists — Francesco Cancellato and Ciro Pellegrino — who work for the online news outlet Fanpage and whose devices were reportedly infected with the Graphite spyware.

However, Citizen Lab, which has a long history of investigating spyware abuses, confirmed that both journalists had been targeted using the Graphite tool.

Other individuals affected in Italy include activists associated with Mediterranea Saving Humans, a group focused on rescuing migrants crossing the Mediterranean Sea.

In June of last year, Italy's parliamentary oversight committee for intelligence agencies reviewed the case and determined that surveillance of the activists had been conducted lawfully. At the same time, the committee stated that it found no evidence confirming that Cancellato had been targeted and did not examine Pellegrino's situation.

Later, in March, prosecutors investigating the case announced that forensic analysis of Cancellato's device confirmed it had been compromised, while similar analysis of Pellegrino's phone did not yield definitive conclusions.

The investigation by Italian prosecutors remains ongoing.