Spyware scandals in Europe are 'much worse than Watergate'

The illicit use of spyware in Europe is comparable to the Watergate scandal, the wiretapping case which led to the resignation of US president Richard Nixon in 1974, "but much, much worse", she said in an interview with EUobserver magazine.

"It's not a matter of a few isolated incidents where some governments have crossed the line. It's a widespread system that centres around Europe."

Not all member states use spyware illicitly, but "all member states have spyware at their disposal, whether they admit it or not," in 't Veld warns.

Governments operate alongside "an impenetrable maze of persons, locations, connections, ownership structures, letterbox companies, ever-changing corporate names" and purchase spyware, often through middlemen, "from criminals or quasi-criminals," she adds.

Israeli spyware companies dominate the sector and have spread their operations across Europe, taking advantage of lax export enforcement, and favourable tax arrangements, in Ireland and other countries.

In 't Veld's report, presented in November and to be finalised next year, points to the Polish government's use of material extracted from telephones for smear campaigns against journalists. The Hungarian government used spyware on at least 300 telephones belonging to NGOs and individuals connected to American-Hungarian businessman George Soros.

Top-level politicians in Greece have used spyware to cover up corruption, and the Spanish government has used spyware on 65 Catalans, supposedly in connection with the independence movement.

14 member states involved

A central player has been the Israeli company NSO Group, which has sold Pegasus and other products to 22 end-users in 14 member states, including Poland, Hungary, Spain, the Netherlands and Belgium.

The US has blacklisted the group and is developing new spyware legislation. Victims have filed legal complaints. Tech giants like Microsoft and Apple have launched legal challenges against spyware companies, the latter describing the NSO Group as "amoral 21st-century mercenaries" who "target, attack, and harm…for their own commercial gain."

But the European response has been muted. The European Council has yet to respond and the European Commission, which was itself hacked, has "absolutely no interest" in pursuing the question, in 't Veld says.

Europol, the EU's law enforcement agency, has so far declined to investigate the matter, claiming it is an exclusively national matter. But EU governments have "stonewalled" in 't Veld's efforts, citing 'national security reasons.'

"Citizens have the right to know what's going on," she said.

"But as soon as national security is invoked, all doors close. It's become an excuse for lawlessness." Out of all the EU's 27 governments that she has sent questions to, only Austria, Cyprus, and Poland have responded, and then only "in the most evasive terms."

Partly because of this, there is a lack of hard evidence.

Modern spyware can be used to take complete control of a mobile phone with hardly a trace, and even if it is detected, it is nearly impossible to prove who was responsible for the attack.

"The list of victims of spyware tells the real story," she underlines. "If you have nine hundred pieces of a puzzle of a thousand, you have a good idea of the whole picture."

Those victims who have mounted legal challenges find that judges and prosecutors refuse to investigate and put the burden of proof on the victims. This leaves victims defenceless against state power. All vital checks and balances of a democratic society are disabled.

"Democracy isn't about elections. Russia has elections. Democracy is about countervailing power," in 't Veld says. "Once it's gone, democracy ends."