Digital surveillance shaping the public sphere. The case of the use of spyware on journalists

Abstract

The public sphere has traditionally been understood as a shared space for dialogue, contestation, and the circulation of information beyond the domestic realm. Journalists have long occupied a central role within this sphere as mediators between societal actors and gatekeepers of public debate. However, digital transformation, the rise of disintermediated communication, and increasing professional precarity have weakened this role. At the same time, journalists covering sensitive issues such as corruption, environmental conflicts, and armed conflict face growing physical and digital threats. Among these threats, the deployment of intrusive spyware by public authorities has emerged as a significant challenge across Europe. Spyware enables covert access to devices, allowing operators to intercept communications, activate microphones and cameras, retrieve encrypted data, and monitor browsing activity and geolocation without users' knowledge. Although governments frequently justify these technologies on grounds of national security and law enforcement, their use has increasingly targeted journalists, activists, and human rights defenders. The recent adoption of Article 4 of the European Media Freedom Act (Regulation (EU) 2024/1083) establishes safeguards against the surveillance of journalists, limiting spyware to exceptional circumstances such as investigations of serious crimes. Nevertheless, the broad scope of these exceptions raises concerns regarding potential misuse and insufficient judicial oversight. Drawing on theories of the public sphere and surveillance, this paper argues that the expansion of spyware threatens the conditions necessary for independent journalism and democratic deliberation. Beyond direct violations of privacy, the possibility of covert surveillance generates chilling effects that discourage journalists from investigating sensitive topics, communicating with confidential sources, and exercising editorial independence. Such dynamics undermine the openness and accessibility that characterize the public sphere, replacing them with opaque forms of state monitoring. The paper adopts a comparative approach, examining Greece, Italy, and Spain through data collected by the Media Pluralism Monitor and the Mapping Media Freedom platform. It assesses existing legal safeguards protecting journalists and their sources from intrusive surveillance while situating these developments within the broader expansion of the surveillance industry, whose opaque interaction with state authority and commercial interests pose significant challenges to media freedom and democratic accountability.

1 Introduction

The concept of public sphere is historically associated with the concept of a shared, common space rather than a domestic setting. What is told in public assumes a different connotation: it is deliberately shared with a potentially larger group of people so that the information circulates freely and rapidly. Moreover, the public sphere is also associated with mutual confrontation, dialogue, or even conflict sharing opposing viewpoints.

Journalists are professional figures which are traditionally considered facilitators of this dialogue in the public sphere. They act as mediators between different stakeholders in society, as well as gatekeepers who choose which news enters the agenda. However, their role is being undermined in the last decades: the digital transition and the rise of disintermediated communication on social media increased the precarity of the profession; in addition, increasing physical and digital threats endanger journalists who work on particularly controversial issues, such as corruption, environmental issues, and war.

In the last few years, there have been multiple examples across Europe of the use of spyware by public authorities against activists, human rights defenders and journalists. Spyware is an intrusive surveillance technology increasingly used by state actors: it can be deployed on a device to secretly record calls, turn on microphones or cameras, copy messages, access encrypted data, track browsing activity and geolocation. The use of such tools is often justified as strengthening the investigative capabilities of police, and used even before judicial authorization. This practice has been recently regulated by art. 4 of the European Media Freedom Act (Regulation EU 2024/1083), which requires Member States to refrain from the use of surveillance and spyware against journalists except under specific circumstances, such as investigations of serious crimes. However, this logic of exception raises concerns about potential abuses by public authorities.

The increasing surveillance on journalists, as well as on activists and human rights defenders, risks undermining the conditions for a free and open public sphere to thrive. As a matter of fact, the possibility of being spied on at any time leads to self-discipline and to suppress dissenting thoughts. So the mere possibility of being surveilled might lead journalists to refrain from conducting investigations on sensitive topics, to contact sensitive sources and ultimately might convince them to leave the profession. Moreover, surveillance contrasts with the very core tenets of the public sphere, namely public access and openness, while surveillance power is characterised by public inaccessibility and technical closure.

This paper will focus on the intrusive surveillance through spyware of journalists across Europe and the existing legal safeguards against the surveillance of journalists and their sources, in a comparative perspective between Greece, Italy and Spain. It will be based on the data collected by the Media Pluralism Monitor (MPM) project and the data from the Mapping Media Freedom platform.

2 Theoretical background

2.1 An ecology of journalism under surveillance

Journalists operating within the contemporary information ecosystem face a paradoxical predicament. The normative principle of “transparency”, advocated by scholars such as Allen (2008) as essential for assessing the reliability of newsgathering, puts journalists in front of a dilemma that renders journalists vulnerable to hostile scrutiny. Trust remains the foundational element of the relationship between journalists, the public, and other societal actors, predicated on the willingness of news recipients to sustain their engagement with news media (Blöbaum, 2014). As such, journalism functions as a mediating agent in the trust dynamic between citizens and social institutions.

While transparency is posited as a cornerstone of democratic well-being as a way to create trust in the media institutions, a Foucauldian perspective (Foucault 1977) frames transparency as an instrument of discipline. In this framework, transparency functions as a “dangerous trap,” subjecting journalism to asymmetrical monitoring which undermines the fundamental principles necessary for the practice of journalism: professional confidentiality, editorial independence, and freedom from external influence.

The evolution of surveillance technologies is acting as a primary driver reshaping the landscape of information flow and journalistic practice. As Deibert and Rohozinski (2010) observed, the proliferation of devices and platforms with surveillance capabilities has rendered the control network increasingly socially pervasive. Many of these coercive mechanisms are not merely technological artifacts, but are deeply embedded in the inculcation of norms and the induction of compliant behaviour, such as the forms of self-censorship to which journalists are subjected in heavily monitored environments.

It is evident that political decision-making significantly influences the application of surveillance technologies. The growing emphasis on offensive cyber capabilities has necessitated a shift toward a more aggressive posture for cyber-military forces, driving the development and acquisition by public authorities of sophisticated surveillance tools, such as spywares.

Spyware can be understood as a technology that achieves maximum intrusiveness while maintaining minimal visibility, reflecting the logic of the “black box” (Di Salvo, 2024a). Although this concept is most commonly associated with algorithms, big data, and machine learning systems, it is equally applicable to spyware due to the “techno-fog” that surrounds its operation (Di Salvo, 2024b). The misuse of surveillance powers increasingly occurs within democratic settings and is often justified through security-related legislation (Papadopoulou, 2025, p. 2).

State and private actors are advancing an era of “Digital Authoritarianism” (Freedom House 2018) within a fragile normative and ethical framework. Governments across the political spectrum are amassing unprecedented surveillance capabilities. The surveillance industry is in fact a vast business ecosystem dedicated to data collection, monitoring and analysis of individuals, organizations, and populations. It develops and produces a wide range of technologies ranging from physical security hardware to sophisticated digital spyware designed to infiltrate smartphones, computers, and communication networks without the user's knowledge.

This shift shapes both the physical and digital environment in which journalism is exercised. Müller (2013) identifies normative preconditions for public trust, including press freedom, plurality, independence, and professionalism, asserting that professionalism creates and maintains trust by ensuring responsible performance according to journalistic values. In light of this vital connection between the autonomous exercise of the profession and democratic standards, surveillance activities that impede or interfere with essential journalistic functions constitute a dual attack: on the individual rights of those professionals exercising journalism, and on the trust-building process between the journalistic community and other societal stakeholders, therefore, by extension, on democracy itself. This conceptualization of surveillance has further evolved from Foucault's instrument of discipline to Lyon's characterization of it as an inherent trait of modernity (Lyon 2001). While disciplinary purposes and the inculcation of social norms of behaviour persist, Lyon notes that technological developments have reconfigured the circulation of information and the exercise of power, rendering surveillance a functional feature of contemporary societies.

In these societies, authorities maintain constant scrutiny over (among others) journalists, oscillating between legitimate oversight and invasive surveillance tactics. This scrutiny extends to intimate spaces, including the home and the digital memory of personal devices.

The journalist's physical body is subjected to Amoore's concept of the “portable biometric border” (Amoore 2006), borrowed from Foucault's concept of bio-power, wherein the body itself becomes a site of bio-power policies. The journalist is rendered trackable, traceable, visible, datafied, and targetable, representing a risk not only to themselves but also to their sources and associates, who in turn become risks to the journalist. The biometric border implies that surveillance techniques now follow the moving bodies of journalists everywhere. Time and space no longer afford protection against monitoring: countless sensors surround the journalist's physical and digital persona, which includes devices voluntarily carried for professional purposes, such as smartphones. Societies have transitioned from an era defined by enclosed discipline, performed in fixed spaces such as schools or factories, to one defined by continuous control, a shift to fluid and digitalised systems utilizing data and technology to modulate behaviour in real time everywhere in the world (Deleuze 1992). Looking at technologies devised for the surveillance of individuals, the shift from bugging devices placed under desks to the hacking of ubiquitous smartphones, that we knowingly carry with us, represents a fundamental technological and social transition for analysing the nature of spyware and its impact on journalistic work.

These systems were conceptualized as “surveillant assemblage” (Haggerty and Ericson 2000), focused on the integration of practices and technologies contributing to the production, combination, and movement of data flows. More recently, Haggerty coined the definition of “Surveillantization” as the “proliferation and normalization of systems for observing, categorizing, and managing human life” (Haggerty 2025), all in a context marked by power asymmetries (Andrejevic and Burdon 2014), where states act as all-powerful entities and journalists find themselves with few means of defense or protection. As a result of these historical processes, contemporary journalists are the targets of multiple, coexisting, and fluctuating surveillance tools that permeate both physical and digital spaces. In this pervasive environment, journalists face a dilemma: they cannot retreat from transparency without forfeiting the visibility necessary for legitimacy and readership, yet they cannot be fully transparent without compromising source protection, nor can they remain entirely anonymous, given the necessity of a public persona. The stakes are high, ranging from arbitrary detention, harassment, physical and psychological violence, and even extrajudicial killing. This was the case for the Saudi journalist Jamal Kashoggi, whose murder in October 2018 following extensive digital surveillance sparked intense public outrage.

Ultimately, journalists must navigate these pressures while remaining committed to holding power accountable and pursuing public interest that provides for the legitimate basis of their social role. The opacity inherent in spyware's black-box dynamics generates significant chilling effects on journalists, fostering fear, self-censorship, and paranoia. Journalists resort to mixed responses: adaptation, avoidance, or resistance to these control mechanisms. In this context, one of the primary forms of resistance has been the exposure of spyware abuses through investigative journalism (Papadopoulou, 2025, p. 5). Notably, all cases of spyware-based surveillance targeting journalists known through the analysed MPM and MMF datasets have come to light through journalistic investigations and academic research.

This article adds to the existing literature on the topic of surveillance of journalists through spyware offering a comprehensive overview of the existing legal frameworks dealing with surveillance of media actors in three country cases: Greece, Italy and Spain. As explained in Section 3 on Methods, starting from sociological and theoretical legal considerations, this article aims to offer a most up-to-date state of the art in terms of events and legal reforms, analysing them in light of a critical sociological and legal perspective. This constitutes a novelty in the academic literature on the topic, which usually lacks cross-disciplinary perspectives on this specific issue, as well as comparative overviews across different countries.

2.2 The internal market of free journalism: protection of sources and exceptions in art. 4 EMFA

The emergence of scandals related to surveillance of journalists through spyware was preceding the publication of a Proposal for a European Media Freedom Act, published on September 16, 2022. The Act was enacted in 2024 and contains a specific article (Article 4) providing safeguards for journalistic sources and confidential communications. As a general rule, it foresees that EU Member States cannot compel journalists or related persons to disclose their sources, subject them to detention or sanctions, intercept their communications, or deploy surveillance technologies against them. Exceptions are permitted as ultima ratio measure, where specific conditions are met, including prior judicial authorisation, a case-by-case assessment, compliance with EU primary law and the Charter of Fundamental Rights, the ECtHR and CJEU jurisprudence, and the existence of a public interest justification. Judges must verify, with periodical judicial review, both compliance with Article 4 conditions and proportionality in practice between the intrusion and the offence pursued. Derogations apply only to offences under Framework Decision 2002/584/JHA or other serious crimes punishable by at least five years’ imprisonment.

Nevertheless, civil society organisations and other relevant stakeholders have frequently criticised the indeterminate scope of the exceptions to the prohibition on the deployment of spyware, especially those justified on grounds of national security or the protection of classified information. It has been argued that these derogations may significantly weaken the effectiveness of the safeguards introduced by the EMFA and related national frameworks, potentially rendering them largely ineffective in practice.

Article 4(5)(b)(i) EMFA permits the deployment of intrusive surveillance software (ISS) where journalists, or individuals maintaining a regular or professional relationship with them, are investigated for offences listed in Framework Decision 2002/584/JHA that are punishable in the relevant Member State by a custodial sentence or detention order with a maximum term of at least three years. This provision raises significant concerns for the protection of journalistic sources, as it may allow surveillance measures to be directed at journalists solely because their sources are suspected of having committed one of the listed offences.

Equally important is the interpretation of the notion of “serious crime” under Article 4(5)(b)(ii) EMFA. Over the last decade, this concept has become a cornerstone of EU internal security policy, yet scholars have consistently criticised its lack of conceptual clarity, arguing that such ambiguity hinders coherent policymaking and legal harmonisation. Research suggests that the seriousness of a crime may be assessed through both legal criteria, such as statutory sentencing thresholds, and empirical criteria, including the extent of the social harm caused by the offence (Paoli et al. 2016). The latter perspective is particularly relevant, as it grounds assessments of seriousness in the actual societal impact of a criminal conduct rather than in perceptions of its gravity (Visschers and Paoli, 2024).

This harm-based approach is consistent with the jurisprudence of both the CJEU and the ECtHR. In particular, cases such as Digital Rights Ireland Ltd (C-293/12) emphasise the need for strict scrutiny and rigorous proportionality review whenever state measures interfere with freedom of expression, privacy, or data protection rights (Malferrari 2025; Venice Commission 2024). Accordingly, any interpretation of “serious crime” capable of justifying surveillance measures against journalists should be narrowly construed and assessed in light of the fundamental rights at stake.

Article 4 of the EMFA requires prior authorisation by a judicial authority or an independent decision-making body before intrusive surveillance technologies may be used against media service providers or related persons. In urgent cases, however, authorisation may be granted retrospectively without undue delay. The Regulation also provides for periodic reviews to ensure that the conditions justifying the surveillance measure remain satisfied. Critics highlight that these provisions are falling short of the standards developed under Article 10 ECHR and ECtHR case law. In Sergey Sorokin v. Russia (2022) and Big Brother Watch and Others v. the United Kingdom (2021), the Court emphasised the importance of prior judicial authorisation, independent oversight, and consideration of less intrusive alternatives before surveillance measures are deployed. Concerns have also been raised about granting authorisation powers to independent administrative bodies, which may not provide the same guarantees of independence as courts (Bayer 2024). This criticism reflects the ECtHR's reasoning in Sanoma Uitgevers B.V. v. the Netherlands, where authorisation by a public prosecutor was found incompatible with Article 10 ECHR.

The EMFA does not establish specific time limits or procedural modalities for the use of spyware, instead leaving these matters to be regulated by Member States in accordance with EU law and subject to the oversight of the CJEU. Existing national regulatory frameworks may offer useful guidance, although the intrusive nature of spyware arguably warrants more stringent safeguards than those applied to any surveillance technology regulated to date.

Furthermore, to ensure the practical effectiveness of Article 4, the Member States could extend the prohibition of unlawful state interference to proxy actors, including quasi-autonomous non-governmental organisations (quangos) and private entities acting on behalf of public authorities. Governments may otherwise circumvent formal legal constraints by outsourcing surveillance or disinformation activities to intermediary organisations, such as private “troll farms.” The recent Black Cube affair in Slovenia, which emerged in the run-up to the March 2026 national elections, appears to illustrate this risk.

Article 4(7) of the European Media Freedom Act enshrines a transparency principle by requiring that the data subject's right to information and access to personal data apply to any processing carried out during surveillance measures, including intrusive spyware deployment. This transparency framework operates as a necessary complement to the substantive protections enshrined in the precedent paragraphs, activating when journalists’ source confidentiality or editorial independence is compromised under authorized derogations. Where judicial bodies permit surveillance that violates these protections, transparency norms should demand accountability through disclosure of acquisition methods and processing purposes. Yet this principle remains largely absent in national implementations; journalists subjected to surveillance rarely learn how their data was collected or processed, creating an information asymmetry. Such opacity effectively undermines the right to effective judicial remedy guaranteed in paragraph 8 of art. 4 EMFA, as affected persons cannot challenge procedures they do not know did occur. Consequently, without robust enforcement of these transparency obligations, the article's safeguards risk becoming theoretical rather than operational protections.

3 Materials and methods

This paper focuses on cases and legal frameworks related to the intrusive surveillance through spyware of journalists across Europe, in a comparative perspective between Greece, Italy and Spain. It is based on the data collected by the Media Pluralism Monitor (MPM) project and the Mapping Media Freedom platform.

For the sake of this study, we adopt the definition of spyware outlined by art. 2 (20) of the European Media Freedom Act, referring to “intrusive surveillance software”, namely: “any product with digital elements specially designed to exploit vulnerabilities in other products that enables the covert surveillance of natural or legal persons by monitoring, extracting, collecting or analysing data from such products...without the natural or legal person concerned being made aware in a specific manner and having given their express specific consent.”

The Media Pluralism Monitor project has collected for 12 years data on the risks to media pluralism across the 27 EU countries and four candidate countries (Albania, Montenegro, Serbia and the Republic of North Macedonia). The project is run by the Centre for Media Pluralism and Media Freedom (CMPF), based at the European University Institute.

The Media Pluralism Monitor (MPM) employs a 200-variable questionnaire that reflects the diverse dimensions of media pluralism, drawing upon internationally recognized standards developed by institutions including the Council of Europe, the European Union, and the United Nations. The questionnaire is answered through an assessment of risk (low, medium or high) and a more extensive qualitative answer by a network of more than 100 academic researchers, based in each of the countries under investigation. Once the country teams have completed the data collection, the CMPF team checks the quality and consistency of the data collected through the questionnaire.

The MPM questionnaire is divided into four areas of investigation: Fundamental protection, Market plurality, Political independence, and Social inclusiveness. The area of Fundamental protection considers, among other things, the existence of effective regulatory safeguards to protect freedom of expression; the right to seek, receive and impart reliable and accurate information; and the favourable conditions for the free and independent conduct of journalistic work. Three variables in this area do specifically address the protection of journalistic sources, in practice, and the existence of a legal framework providing for such protection. These are var. 36, 37 and 38 of the MPM questionnaire¹ (see Table 1). Each implementation of the MPM investigates the risks for media pluralism concerning the previous year of implementation: therefore, the data from MPM2026 reported in this article assess the risks in 2025.

The Mapping Media Freedom (MMF) platform is a component of the Media Freedom Rapid Response (MFRR), a pan-European mechanism dedicated to tracking, monitoring, and reacting to violations of press and media freedom². Established with the primary objective of constructing a verifiable archive of such violations, the platform's scope extends across all European Union Member States and candidate countries.

MMF employs a collaborative approach that aggregates data from networks of monitoring partners and crowdsourcing methods. Every reported incident undergoes a scrutiny process, cross-referencing the initial report with secondary sources, legal documents, and direct testimony where possible, to ensure factual accuracy. The verification phase is critical in distinguishing between isolated incidents and systemic patterns.

A cornerstone of the MMF methodology is its definition of who constitutes a “media worker”, encompassing a broad spectrum of actors beyond traditional journalists, such as photographers, camera operators, fixers, bloggers, and whistleblowers. Furthermore, the methodology acknowledges the collateral impact of attacks on the media ecosystem by extending protection to family members of journalists who may face intimidation or retaliation as a proxy for their relative's work.

Similarly, the definition of a “press freedom violation” is constructed on professional practices that imply a broad categorization that includes any act intended to silence, intimidate, or impede the exercise of journalism and the free flow of information. This includes physical and verbal attacks, legal threats, attacks on property or equipment, and interference with editorial work. Although spyware attacks involve multiple type of breaches within a single incident, they were originally classified under the category of “property attacks,” since the compromise of the device constitutes the initial event underlying all others. This categorization was further improved in 2026 with a change in the tagging system and the creation of the “Data attack” type of incident, which now features a dedicated “spyware” sub-tag. The Mapping Media Freedom platform has been collecting cases of spyware surveillance since 2020 (Table 1).

Considering the nature of the MMF and MPM projects, producing reliable monitoring and working reports based on multiple layers of cross-verification, large sections of this article (especially section 4. Results) rely on grey literature and non- academic sources. The authors of this article work on the MMF and MPM projects, respectively. However, all the data used for the sake of writing this article have been produced independently, following the methodology of data collection and verification outlined in this paragraph.

A juxtaposition of the data collected by the MMF and MPM projects is proposed in this study. Through a comparative and critical legal perspective, the article describes the existing and proposed legal frameworks related to the surveillance of journalists and their sources, in light of international standards from the Council of Europe, the European Court of Human Rights (ECtHR) and the EU legislation (especially, art. 4 EMFA). A functional comparative law methodology has been followed: focusing on the functions of the legal frameworks under analysis, in light of their functional relationship to society and where functionality serves as an evaluative criteria (“better-law comparison”) (Michaels 2019). In this case, we have thus analysed legal frameworks that serve the function of regulating surveillance on individuals, especially on journalists. The methodology of this article is based both on the legal analysis and on the discipline of sociological surveillance studies: as a matter of fact, functional comparative law as a method is keen to interdisciplinarity (Michaels 2019).

Among the sadly high number of European countries that have experienced spyware cases since 2020, the case studies of Greece, Italy and Spain have been selected for various reasons: first, all three cases are available in the MMF and MPM databases; second, two cases (Italy and Greece) are novel (the Graphite case in Italy emerged in 2025) or important news took place recently (in 2026, in Greece, there was a first conviction related to the Predatorgate case). Spain was selected in addition to the cases of Greece and Italy for two reasons: a different kind of intrusive surveillance software was employed (Pegasus, different from Graphite and Predator) and because of the similar context for the journalistic profession in the three countries. As a matter of fact, Spain, Italy and Greece are categorised under the polarised pluralist model of media system (also called “Mediterranean model”; Hallin and Mancini 2004), characterised by high levels of political polarisation and state control in and on the media system, but also by a relative plurality of commercial owners and political views.

This article aims to answer to the following research questions:

RQ1: Which are the legal frameworks applicable to the use of intrusive surveillance technologies in Greece, Italy and Spain? Have they been aligned to the new EU-wide legislation as provided by art. 4 EMFA?

RQ2: Are these legal frameworks coherent with rule of law principles, e.g., striking a balance between the protection of freedom of expression and other interests, such as national security?

4 Results

The spyware sector is thriving on both public and private funds. National intelligence services, defense departments, and police forces across the globe allocate billions annually to procure surveillance technologies, often through contracts shielded from public scrutiny (Panagiotopoulos 2025). At the same time, private capitals channelled by tech giants fund research, development and commercialization of surveillance products (Hayes 2012).

A robust domestic surveillance industry exists in the EU, sitting next to some of the most stringent privacy related regulations, such as the GDPR. Thales and Leonardo (France and Italy respectively) are major defense contractors heavily involved in border control and intelligence surveillance systems³. Furthermore, various smaller European firms have become integral to the continental surveillance apparatus⁴.

Perhaps the most controversial segment is the commercial spyware market, where one or zero-click exploits allow attackers to infect devices simply by connecting to a network or receiving a malicious message. The most notorious player is the Israeli firm NSO Group, creators of the Pegasus spyware, which has been linked to the hacking of journalists, activists, and heads of state globally. Other significant manufacturers include Candiru and Paragon Solutions (both Israeli), and Predator developed by the Greek company Intellexa Consortium. These companies claim to operate selling their tools exclusively to vetted government entities, though investigations and news reports have repeatedly exposed widespread abuse by these governments against civil society.

4.1 General data EU-wide

Between 1st January 2020 and 15th October 2025, the MFRR consortium mapped 19 documented cases of spyware attacks against media workers that occurred across ten European countries: Greece, Hungary, Latvia, Serbia, Spain, Belgium, France, Italy, Lithuania, and Poland (Figure 1). A total of 38 media-related persons or entities were affected across the EU and candidate countries, though the report notes that these are conservative estimates, given the total absence of enforced transparency mechanisms for disclosure of use of spywares. These cases are identified with the tag “spyware”, which falls under the “type of incident” category on the MMF platform.

Figure 1

All collected data, in fact, stem from academic and NGO research or journalistic investigations, usually connected to mistakes in spyware deployment, in depth research on single cases, or partial disclosure through court proceedings or privacy laws implementation.

For instance, in February 2025 Meta notified at least 90 WhatsApp users about potential targeting of their devices. Only a few journalists publicly came forward, with the following inquiry revealing the use of the Israeli produced Graphite spyware against them.

Particular attention should be paid to the Predatorgate case in Greece, the Graphite case in Italy, and the Pegasus case in France, Hungary, Poland and Spain⁶; also, the presence of spyware producing companies in Bulgaria, Cyprus, Czechia and Malta must be signalled: as a matter of fact, the market of surveillance tools and the large number of companies involved is one of the crucial components of the commodification of this technology (Di Salvo, 2024b).

Samuel Woodhams’ report, “Spyware: An Unregulated and Escalating Threat to Independent Media”, presents a stark assessment of how the commercial surveillance industry has fundamentally altered the landscape for journalists worldwide (Woodhams 2021). The report argues that the rapid expansion of a lucrative, opaque market for military-grade spyware has enabled governments to bypass traditional security measures, turning personal devices into tools for digital repression. Woodhams highlights that while manufacturers claim their products are strictly for combating terrorism and serious crime, evidence overwhelmingly shows they are being used to target journalists, human rights defenders, and political dissidents, confirming the inconsistencies of securitization policies in the asymmetric environment mentioned by Andrejevic and Burdon (2014).

Published by the Atlantic Council's Cyber Statecraft Initiative in April 2024, an update to the landmark “Mythical Beasts” report offers a comprehensive mapping of the global spyware market from 1992 to 2024 (Messieh 2024). The authors analysed a dataset of 561 entities involved in the spyware ecosystem to reveal how the industry has evolved while maintaining consistent structural patterns. The report underscores that despite increased regulatory attention and high-profile scandals like the Pegasus Project, the market remains robust, driven by complex networks of vendors, investors, and intermediaries that often operate with significant opacity. Another investigative report by Follow the Money examines the troubling intersection of European public funding and the commercial spyware industry source (Panagiotopoulos 2025). The findings reveal that dozens of companies involved in developing and selling surveillance technologies have received substantial financial support from EU bodies and member state governments over the years. This creates a paradoxical situation where taxpayer money is indirectly funding an industry that has been repeatedly linked to violations of fundamental rights, including privacy, data protection, and press freedom across the continent.

In her 2026 article, Lena Riecke investigated the persistent failure of the international community to curb the proliferation of commercial spyware (Riecke, 2026). Despite over a decade of diplomatic efforts and repeated revelations of abuse—such as the Predator Files—governments continue to permit the sale of tools capable of turning mobile phones into 24-hour surveillance devices. Riecke argues that this regulatory paralysis is not a result of technical complexity or vendor evasion alone, but stems from a fundamental structural conflict of interest within states themselves. Nations act simultaneously as regulators tasked with protecting human rights, as clients desperate for intelligence capabilities, and as market hosts eager to protect domestic defense industries. When these roles collide, the operational and economic incentives to maintain access to spyware consistently outweigh the regulatory impulse to restrict it.

Looking at the Media Pluralism Monitor data, var. 38 of the MPM2026 questionnaire asks about the existence of a legal framework preventing the illegal surveillance of journalists and any person with regular contacts with them. As shown in Figure 2, thirteen countries score a high risk in this regard, which means that the national researchers assessed that “There are no measures in place that prevent the illegal surveillance of journalists or media service providers and any persons with regular or professional ties to them”. Those countries are Austria, Belgium, Bulgaria, Croatia, Cyprus, Hungary, Italy, Montenegro, Republic of North Macedonia, Romania, Serbia and Spain.⁷ All the remaining countries, except for The Netherlands, score a medium risk- meaning that according to the national researchers “The country has adopted measures that partially prevent the illegal surveillance of journalists or media service providers and any persons with regular or professional ties to them”. The peculiarities of the partiality of the protection entrusted by each legal framework are detailed in the MPM country reports⁸, and explained more extensively in this article with regards to Greece, Italy and Spain.

Figure 2

4.2 Country cases

4.2.1 Greece

Greece is among the ten European countries where spyware attacks against media workers have been documented. According to the MMF data⁹, six Greek journalists were targeted with Predator spyware, developed by the North Macedonian firm Cytrox under the Intellexa Consortium.

A key case is the one related to Greek financial reporter Thanasis Koukakis¹⁰. On 28 February 2022, journalist Thanasis Koukakis was informed that his mobile phone had been surveilled for at least ten weeks using Predator spyware. This news was revealed on 11 April 2022 by the Greek media outlet Inside Story.

The Citizen Lab of the University of Toronto, a research centre specialised in surveillance studies, conducted the technical analysis after Koukakis filed an official request to investigate potential surveillance. Their three-page report concluded that Koukakis’ phone was infected with the spyware between at least 12 July 2021 and 24 September 2021. The investigation identified the source of hacking as a Greek phone number that sent Koukakis a text message containing an infected link to a fake website. Citizen Lab stated they could not confirm whether the spyware was used by the Greek government or a private company, leaving initial accountability uncertain.

In February 2026, a Greek court convicted four individuals¹¹ (MFRR, 2026)—including two Israelis—in connection with the “Predatorgate” case (Stamouli 2026). The court ruled that three top executives of the Greek company Intellexa and a notable businessman had committed crimes against dozens of people including journalists, politicians, businessmen, and others, both via the Predator spyware software as well as via traditional wiretap, involving unlawful system intrusion, privacy violations, and data interference using surveillance software. Despite this decision, media outlets that helped in shedding light on the case are yet subject to judicial initiatives that target their reporting production on the spyware use and industry. On 27 March 2026 for instance, the Athens Public Prosecutor's Office started a criminal investigation into reporting by Greek newspaper Documento in relation to its previous investigative work on the Predator spyware scandal¹².

The other five Greek journalists or media workers attacked with Predator included Alexis Papahela, Yannis Kourtakis, Panos Kyriakopoulos, Antonis Dellatolas, and Eva Antonopoulou.

According to MPM2026 (Papadopoulou and Angelou, 2026), Greece scores a medium-risk in variable 38, meaning that “the country has adopted measures that partially prevent the illegal surveillance of journalists or media service providers and any persons with regular or professional ties to them”. In the aftermath of the Predator spyware scandal, which revealed the illegal surveillance of politicians, journalists, and business actors, Greece enacted Law 5002/2022 to regulate surveillance practices and bring national legislation into closer alignment with European standards¹³. The law aims to strengthen the National Intelligence Service (EYP), improve cybersecurity, and enhance personal data protection in accordance with GDPR requirements. It also regulates the acquisition and use of surveillance technologies by state authorities to mitigate the risk of abuse.

The legislation permits surveillance on grounds of national security, criminal investigations, and public safety, while establishing procedures for lifting communication confidentiality and imposing penalties for violations. Nevertheless, it fails to provide specific protections for journalists and media workers, leaving them and those associated with them exposed to potential unlawful surveillance.

The Hellenic Authority for Communication Security and Privacy (ADAE) has identified several shortcomings in the new legislative framework. Notably, it has criticized the ongoing practice whereby decisions to lift the confidentiality of communications are authorized by the prosecutor attached to the intelligence services instead of an independent judicial body. ADAE has further raised concerns about a 2021 legislative amendment that stripped the authority of its longstanding competence to notify individuals once surveillance measures affecting their communications had been carried out¹⁴.

Despite these reforms, questions persist regarding the extent to which the legislation complies with the ECHR standards of clarity, accessibility, and foreseeability in the field of surveillance. While the legal framework is designed to curb unlawful monitoring practices, its practical application has revealed significant limitations (Papadopoulou and Angelou, 2026). These shortcomings are illustrated by the management of the Predator spyware scandal and the slow pace of the investigations that followed.

More recently, Article 40 of Law 5253/2025 established a National Action Plan for the Safety of Journalists, with the objective of protecting media professionals from threats, harassment, and unlawful surveillance. The plan envisages a range of measures, including preventive actions, support mechanisms for journalists, enhanced coordination among relevant authorities, and procedures for investigating attacks against media workers, thereby promoting media freedom and accountability. However, many of these measures remain at the level of policy commitments and have yet to be fully implemented in practice.

At the same time, the implementation of Article 4 of the European Media Freedom Act (EMFA) in Greece has generated debate among political actors and civil society organizations, particularly concerning the need to safeguard oversight mechanisms from political and economic influence.

4.2.2 Italy

Cases of illegal surveillance and breaches of journalistic sources occurred in Italy in 2025. In early 2025, it was revealed that at least three journalists and four activists, including Fanpage journalists Francesco Cancellato¹⁵ and Ciro Pellegrino¹⁶, had been monitored throughout 2024 using military-grade spyware. The case sparked major concerns over potential abuses of state surveillance. In response, the National Federation of the Press and the National Order of Journalists filed a complaint with the Rome Prosecutor's Office against unknown perpetrators¹⁷.

The parliamentary committee overseeing Italian intelligence services (Copasir) published an investigation report in June 2025¹⁸, denying involvement of Italian actors in the surveillance while indicating foreign services might be responsible. No further action has been taken by authorities, though two court proceedings remain ongoing in Rome and Naples.

In March 2026, Italian prosecutors investigating the spying scandal said they had independently confirmed that the Fanpage editor-in-chief, Francesco Cancellato, and two immigration activists were hacked at the same time in late 2024, suggesting all three were part of the same “infection campaign”¹⁹. This development brought more questions for the Italian government that denied any involvement in the hacking of the journalist.

According to MPM2026 (Vigevani et al., 2026), Italy scores a high risk related to var. 38, meaning that “there are no measures in place that prevent the illegal surveillance of journalists or media service providers and any persons with regular or professional ties to them”. Article 200 of the Italian Code of Criminal Procedure (CCP) provides journalists with a degree of professional secrecy by allowing them to protect the identity of their sources. This protection is not absolute, however, as a judge may order disclosure where it constitutes the only means of obtaining essential evidence. Furthermore, the Italian law distinguishes between two categories of journalists, both recorded with the Order of Journalists under two separate registers: professional journalists are those who practice journalism on an exclusive and continuous basis, while “pubblicisti”, or non-professionals, are those who combine journalistic work with other professions or occupations. The safeguard under art. 200 CPP applies exclusively to fully qualified professional journalists. In practice, the effectiveness of source protection has been inconsistent. As noted by several monitoring organisations, investigative authorities have on occasion circumvented these safeguards through the use of searches and seizures. While the CCP also establishes limits on the use of wiretapping for investigative purposes, Italian law does not contain an explicit prohibition on the surveillance of journalists, as envisaged by Article 4(3) of the European Media Freedom Act (EMFA). It may therefore be argued that, in certain cases—such as the Iuventa case (Sambataro, 2022)—investigative measures effectively bypassed the protections afforded by Article 200 and failed to satisfy the proportionality requirements developed through relevant case law. Moreover, because the journalists whose communications were intercepted were not themselves under investigation, they were not afforded any specific domestic remedy through which to challenge the lawfulness or necessity of the surveillance measures.

Article 267(2) of the Italian Code of Criminal Procedure provides that the public prosecutor may authorise wiretapping by means of a reasoned order, subject to judicial validation within 48 h. In addition, the prosecutor must specify the methods and duration of the interception. Pursuant to Article 267(3), wiretapping measures may not exceed 45 days unless further extensions are justified by the emergence of specific and concrete new elements. The EMFA does not establish detailed rules concerning the duration, modalities, or conditions governing the use of intrusive surveillance software, leaving these matters to the discretion of individual Member States. In developing such rules, national legislatures may draw on existing legal frameworks regulating comparable interferences with private communications, including those applicable to wiretapping and other forms of electronic surveillance.

Preventive wiretaps, by contrast, serve a public security function, namely the prevention of criminal offenses. The mechanism governing this category of interceptions, conducted by intelligence services under delegation from the President of the Council of Ministers and subject to prior authorization from the Public Prosecutor General at the Court of Appeal of Rome, operates as follows: the head of government may delegate, under his or her political responsibility, the directors of intelligence services for security to conduct interception of communications or conversations, even when such communications occur within a private residence. This includes the acquisition of external data (so-called metadata) relating to telephone and electronic communications that have transpired, as well as the acquisition of any other useful information.

Article 4 of Law Decree 144/2005 and Law 124 of 3 August 2007²⁰ govern surveillance operations carried out by state intelligence services. Under Article 17(5) of Law 124, certain members of society are granted legal safeguards against intrusive surveillance measures, among them professional journalists. Under Article 17(5) Law 124, only professional journalists qualify for special protection against surveillance activities. The same legal shield does not extend to non-professional journalists. Additionally, individuals who are not listed in the official public registries, such as numerous freelancers, lack formal recognition as journalists under Italian law and consequently receive no protective status against state surveillance.

According to Leonardo Filippi, Emeritus Professor of Criminal Procedure at the University of Cagliari, Article 4 of Law Decree 144/2005 does not indicate “any serious offence to prevent, thereby legitimizing authorization for any offence, even trivial or deemed harmless ones, provided that the operations are considered indispensable for the fulfilment of preventive activities” by the intelligence services. Rather, Filippi argues, “the generic assessment regarding the indispensability of preventive activity for the fulfilment of tasks assigned to intelligence services for security is left to the Public Prosecutor General at the Court of Appeal of Rome: if (s)he deems them indispensable, (s)he authorizes, by reasoned decree, the wiretaps” (Filippi 2023).

Whereas previously preventive wiretaps were approved when the Public Prosecutor considered “investigative elements” to exist that justified preventive activity, authorization now must be based exclusively on the fact that such wiretaps prove “indispensable for the fulfillment of tasks assigned” to the services themselves.

The current framework appears to stand in tension with the safeguards established by the European Media Freedom Act (EMFA). The authorization mechanism lacks a grounded proportionality assessment, a requirement central to the EMFA's protection of journalistic sources and communications. Instead of judicial oversight, the determination of necessity is vested solely in the Public Prosecutor General, thereby bypassing the independent judicial review mandated under Article 4(6) of the EMFA. Moreover, the absence of a transparent procedural mechanism to verify compliance with the rights of data subjects creates a significant gap in accountability, contravening the transparency obligations outlined in Article 4(7) of the regulation.

Given the current legal framework in Italy, in such situations the only remedy available appeared to be an application before the ECtHR; now thanks to EMFA, it will be also possible to apply before the CJEU. In particular, a key element to assess the proportionality and, so, the legitimacy of such measures would be to assess their motivation. However, Italy still lacks a dedicated legal framework to prevent unlawful surveillance of journalists and news organizations. Substantial legislative changes will therefore be necessary to meet the standards set by the EMFA.

4.2.3 Spain

Spain is among the ten European countries where spyware attacks against media workers have been documented. According to the MMF available data²¹, in 2022 it emerged that five Spanish journalists were specifically targeted with Pegasus spyware, developed by the Israeli NSO Group: Ignacio Cembrero, Meritxell Bonet, Marcel Mauri, Albano Dante Fachin, and Marcela Topor.²²

NSO Group is an Israeli technology company known for developing and selling surveillance software capable of infiltrating mobile phones to monitor communications, track locations, and access data stored on targeted devices. In 2021, the US Commerce Department blacklisted NSO Group for providing spyware to foreign governments that used these tools to maliciously target journalists, embassy workers, and activists.

In March 2026, Irídia, a Catalan civil society organization, raised concerns about the obstruction of several judicial investigations related to the Pegasus spyware case²³. According to the organization, these difficulties stem from the failure to execute European Investigation Orders (EIOs), an important legal instrument for investigating companies affiliated with the NSO Group and their executives, including those based in Luxembourg. Irídia argues that the lack of action by the Spanish authorities has contributed to the suspension or stagnation of critical investigative efforts necessary to obtain documentation, collect witness testimony, and establish responsibility. The organization further notes that, in certain cases, individuals under investigation have yet to be formally informed of their procedural status within the Spanish criminal justice system.

According to MPM2026 (Suau et al., 2026), Spain scores a high risk related to var. 38, meaning that “there are no measures in place that prevent the illegal surveillance of journalists or media service providers and any persons with regular or professional ties to them”. However, two recent legal reforms (still in draft stage) merit attention: one concerning journalists’ professional secrecy and another relating to the disclosure of classified information. In July 2025, the Spanish Government approved a draft law aimed at regulating journalists’ professional secrecy²⁴. As part of the Democracy Action Plan, the initiative seeks, for the first time, to give full legal effect to the right to professional secrecy in the exercise of freedom of information, as guaranteed by Article 20.1(d) of the Spanish Constitution. The proposed legislation extends protection not only to professional journalists, but also to the media service providers that employ them, their editorial staff, and any individuals who, through their relationship with these actors, may have access to information capable of revealing the identity of journalistic sources (Article 3). The bill expressly states that “this right also protects against the compulsory surrender of journalistic material, devices, or other work tools containing information that could identify a source.” In addition, it prohibits the installation of intrusive surveillance software on any materials, digital devices, equipment, or tools used by persons covered by this right. The draft law is currently under parliamentary consideration.

While professional associations and freedom of expression advocacy groups have welcomed the legislative initiative, several have expressed concerns about aspects of the draft law. In particular, the Platform for the Defence of Freedom of Information (PDLI) has warned that, unless amended, the legislation could weaken existing legal safeguards²⁵. According to the PDLI, the bill lacks sufficient clarity regarding the circumstances and conditions under which professional secrecy may be limited, creating uncertainty for journalists. The organisation also argues that the exceptions provided in the text—such as cases involving “serious and imminent harm”—are framed too broadly, potentially allowing for restrictive interpretations of source protection and confidentiality rights. Furthermore, the PDLI has noted the absence of clear coordination with other areas of Spanish legislation, which could give rise to regulatory inconsistencies, legal uncertainty, or conflicts between legal provisions.

In July 2025, the Spanish Government also approved a draft Bill on Classified Information which, once adopted by Parliament and brought into force, will replace the 1968 Official Secrets Law enacted during the Franco era²⁶. Although the introduction of a modern legal framework has been broadly welcomed, a number of advocacy organisations and professional associations have raised concerns about certain provisions of the bill. In particular, they have criticised the proposed administrative sanctions regime, which establishes fines ranging from €30,000 to €2.5 million for the disclosure or publication of classified information. The bill introduces a four-tier classification system—Top Secret, Secret, Confidential, and Restricted—aligned with NATO and EU standards, while granting the Government broad discretion in determining the classification of information. It further categorises the dissemination of information designated as “Top Secret” or “Secret” through any medium as a very serious offence. Under these provisions, the National Intelligence Centre (CNI) may seek authorisation from a judge of the Supreme Court to deploy surveillance measures aimed at preventing such infringements. Critics have noted that the bill does not provide specific safeguards or exemptions for journalists and other information professionals in this context, particularly in relation to the prior judicial control mechanism established under Article 12 of Organic Law 2/2002 governing the National Intelligence Centre²⁷. In 2025, journalists from El País and El Mundo became the subject of criminal investigations for the alleged offence of “revealing secrets.” According to the Association of Spanish Investigative Reporters (API) and the Federation of Associations of Spanish Journalists (FAPE), these proceedings underscore the urgent need to bring the Criminal Procedure Act and the legislation governing the intelligence services into line with constitutional guarantees and European standards. The organisations have further criticised the draft bill for treating the right to information merely as a factor to be considered when determining the severity of sanctions, rather than recognising it as the primary principle for balancing the public interest in disclosure against the protection of classified information²⁸.

5 Discussion

This article places known events of surveillance of journalists through spyware in between a theoretical background on what surveillance means in the context of media freedom, and the existing legal frameworks regulating such practice. The focus has been placed on three country cases: Greece, Italy and Spain, where cases of spyware surveillance emerged since 2022, respectively the Predatorgate, the Graphite case, and the Pegasus case.

Answering RQ1, different legal frameworks govern the practice of surveillance on individuals, in particular of journalists. Table 2 summarises what has been outlined in the previous paragraphs.

Only in Greece a first judgement was issued following these cases: in February 2026, the Athens court ruled that three top executives of the Greek company Intellexa and a notable businessman had committed crimes via the Predator spyware software as well as via traditional wiretap, involving unlawful system intrusion, privacy violations, and data interference using surveillance software. The case sets an important precedent, however it convicts employees of a private company, while there is no mention of the Greek authorities’ responsibilities in line with EMFA's positive obligations for EU Member States of promoting media freedom and avoiding the use of intrusive surveillance technologies.

As explained in the paragraphs dedicated to each country case, the national legal frameworks guaranteeing the protection of sources and providing on the procedures for surveillance activities, differ throughout the countries under study. RQ2 asks about the adherence to rule of law principles of the existing legal frameworks: it has been observed that the nature of the crimes possibly justifying the use of surveillance activities and the thresholds of sentences foreseen in the codes of criminal procedure of each country do paint a fragmented picture of standards employed. This fact is also exacerbated by the lack of clear, universally accepted, definitions of concepts such as terrorism, national interest, public interest. In this regard, restrictive interpretations, subject to the normative and political context of the moment, may lead to excessive restrictions of journalists’ rights and the collective right to access free and plural information. That is why such interpretation should be based on a harm-based approach, namely on the actual societal impact of criminal conduct rather than on perceptions of its gravity.

RQ1 also asks about the alignment of existing legal frameworks with art. 4 EMFA: it remains to be seen how the EU countries will implement such a provision, despite the deadline for alignment of national legislations with the EMFA text was set for August 8, 2025. The EMFA implementation process triggered policy change only in Spain, where transposition is still at a draft stage and under scrutiny and criticism by different stakeholders. In addition to the different political priorities in different countries, this delay in transposition might also be related to the legal basis of the Act (art. 114 TFUE, with the objective of harmonising the internal media market). As a consequence, most of the ongoing EMFA implementation laws focus on market- related issues (e.g., competition-related issues), while in the EMFA the issue of the use of spyware on journalists is mainly framed from the perspective of protection of journalistic sources and fundamental rights. This makes the national institutions potentially in charge of dealing with this issue (i.e., law enforcement authorities, criminal courts) different from those dealing with competition-related issues (e.g., competition authorities). Among other aspects, this might have caused delays in adopting provisions in line with art. 4 in national legislation.

During this implementation phase of EMFA, Member States are called to implement the transparency provisions of Article 4(7) to mandate that police authorities explicitly disclose when judicially authorized measures have processed journalists’ personal data. This obligation compels competent Law Enforcement Authorities (LEAs) to publicly justify the specific legal grounds and proportionality assessments behind such decisions by forcing a transparent record of when and why exceptions are invoked. Such accountability mechanisms are essential to restore the practical viability of the right to effective judicial remedy, allowing affected journalists to meaningfully challenge illegitimate intrusions. The mechanism does not address the activities of secret services agencies, whose interference in journalistic rights will likely remain undisclosed.

The collected case data, increasing in recent years, confirm the trend of spread and normalization of spyware as a prime example of surveillance technologies that represent a fundamental feature of contemporaneity and a new exercise of biopower, exploiting the inherent vulnerabilities of smartphones not only as essential tools of journalistic work, but more in general as a technological extension of contemporary human bodies. This approach to technologies responds to the states’ security needs within a context of power asymmetries and profound opacities. It destabilises the democratic mechanisms of which journalism constitutes an essential element, both by undermining the protections formally guaranteed to journalists, and by interfering with the trust-building processes necessary for democratic coexistence. Against this use of spyware, Article 4 EMFA, built on complementary positive obligations for the Member States and the principle of transparency,has yet to prove capable of constituting an effective response. This leaves an answer to RQ2, looking into the adherence to rule of law principles of existing legal frameworks, still open in relation to the implementation of art. 4 EMFA.

Finally, the reactions of the targeted journalists vary. In the Italian and Greek cases, the journalists under surveillance have become champions of the cause against spyware surveillance, seeking both to obtain justice for themselves and to act in accordance with the professional mandate they believe has been entrusted to them: to hold those in power accountable for their actions²⁹. It is worth reminding here that the MMF data show how journalists investigating spyware attacks are themselves subject to threatening legal actions, making the environment even riskier. For future studies, exploring more qualitative aspects related to journalists’ self- perception of the phenomenon of spyware surveillance, including the visibility obtained by their case and if this triggered any reaction in the public. In fact, the entrance of cases of surveillance on journalists in the public debate has in some instances stimulated indignation in the general public, eventually triggering resistance against the use of this kind of technology, and—in some cases, including the EMFA Regulation itself- leading to policy reaction.

This study adds to the pre-existing literature a detailed overview of the cases of spyware surveillance from a comparative perspective, in three Southern EU countries. It offers a detailed collection of the relevant legal framework applicable to cases of surveillance of journalists, as well as analyses art. 4 EMFA as the overarching provision that will need to be implemented in the EU, updating the current frameworks.

The limitations of this study include a focus on three country cases- which might impede a generalisation of the analysis; a dependence on secondary sources, while future studies could be enriched by the collection of first-hand data, especially by the conduction of interviews with relevant stakeholders; finally, this study offers a snapshot of the current state of things, while the legal landscape is rapidly moving in 2025 and 2026. The analysis would thus benefit from an update in the short term.

References

• 1

  AllenD. S. (2008). The trouble with transparency: the challenge of doing journalism ethics in a surveillance society. J. Stud.9 (3), 323–340. 10.1080/14616700801997224

  • CrossRef
  • Google Scholar
  • View reference in article

• 2

  AmooreL. (2006). Biometric borders: governing mobilities in the war on terror. Polit. Geogr.25 (3), 336–351. 10.1016/j.polgeo.2006.02.001

  • CrossRef
  • Google Scholar
  • View reference in article

• 3

  AndrejevicM.BurdonM. (2014). Defining the sensor society. Televis. New Media16 (1), 19–36. 10.1177/1527476414541552

  • CrossRef
  • Google Scholar
  • View reference in article

• 4

  BayerJ. (2024). Digital Media Regulation Within the European Union. A Framework for a New Media Order. Baden: Nomos.

  • Google Scholar
  • View reference in article

• 5

  BlöbaumB. (2014). “Trust and journalism in a digital environment,” in Reuters Institute for the Study of Journalism. Available online at:https://reutersinstitute.politics.ox.ac.uk/our-research/trust-and-journalism-digital-environment(Accessed February 10, 2026).

  • Google Scholar
  • View reference in article

• 6

  DeibertR.RohozinskiR. (2010). Liberation vs. control: the future of cyberspace. J. Democr.21 (4), 43–57. 10.1353/jod.2010.0010

  • CrossRef
  • Google Scholar
  • View reference in article

• 7

  DeleuzeG. (1992). Postscript on the societies of control. October59 (1992), 3–7. Available online at: http://www.jstor.org/stable/778828

  • Google Scholar
  • View reference in article

• 8

  Di SalvoP. (2024a). “We have to act like our devices are already infected”: Investigative journalists and internet surveillance. Journal. Pract. 16 (9) 1849–1866.

  • Google Scholar
  • View reference in article

• 9

  Di SalvoP. (2024b). Dealing with the black box: european journalists and the threats of spyware. Digit. Journal., 131715–1734. 10.1080/21670811.2024.2378122

  • CrossRef
  • Google Scholar
  • View reference in article

• 10

  FilippiL. (2023). “Le ‘nuove' intercettazioni preventive e le altre attivita’ di prevenzione - Rivista Penale Diritto E Procedura”, in Rivista Penale Diritto E Procedura. Available online at:https://www.penaledp.it/le-nuove-intercettazioni-preventive-e-le-altre-attivita-di-prevenzione/(Accessed July 3, 2026).

  • Google Scholar
  • View reference in article

• 11

  FoucaultM. (1977). Discipline and Punish: The Birth of the Prison. Penguin Books.

  • Google Scholar
  • View reference in article

• 12

  HaggertyK. (2025). On assemblages and surveillantization: thinking and rethinking surveillance theory. Surveill. Soc.23 (4), 529–544. 10.24908/ss.v23i4.20081

  • CrossRef
  • Google Scholar
  • View reference in article

• 13

  HaggertyK. D.EricsonR. V. (2000). The surveillant assemblage. Br. J. Sociol.51 (4), 605–622. 10.1080/00071310020015280

  • Pubmed Abstract
  • CrossRef
  • Google Scholar
  • View reference in article

• 14

  HallinD. C.ManciniP. (2004). Comparing Media Systems. Cambridge University Press.

  • Google Scholar
  • View reference in article

• 15

  HayesB. (2012). “The surveillance-industrial complex,” in Routledge Handbook of Surveillance studies, eds. BallK.SniderL. (Routledge), 167–175.

  • Google Scholar
  • View reference in article

• 16

  HouseF. (2018). Freedom of the Net. Freedom House.

  • Google Scholar
  • View reference in article

• 17

  LyonD. (2001). Surveillance Society. McGraw-Hill Education (UK).

  • Google Scholar
  • View reference in article

• 18

  MalferrariL. (2025). New and reinforced rights for media service providers under article 4 European media freedom act. Rivista Italiana di Informatica e Diritto7 (1), 143–176. 10.32091/RIID0214

  • CrossRef
  • Google Scholar
  • View reference in article

• 19

  MessiehN. (2024). “Mythical beasts and where to find them: mapping the global spyware market and its threats to National Security and Human Rights.” in Atlantic Council. Available online at:https://www.atlanticcouncil.org/in-depth-research-reports/report/mythical-beasts-and-where-to-find-them-mapping-the-global-spyware-market-and-its-threats-to-national-security-and-human-rights/(Accessed April 20, 2026).

  • Google Scholar
  • View reference in article

• 20

  MFRR. 2026. “Greece: executives of spyware firm used to surveil journalist thanasis koukakis sentenced to prison,” in Media Freedom Rapid Response. Available online at:https://www.mfrr.eu/greece-executives-of-spyware-firm-used-to-surveil-journalist-thanasis-koukakis-sentenced-to-prison/(Accessed July 26, 2026).

  • Google Scholar
  • View reference in article

• 21

  MichaelsR. (2019). “The functional method of comparative law,” in The Oxford Handbook of Comparative Law, eds. ReimannM.ZimmermannR., Online ed. (Oxford Academic), 344–389. 10.1093/oxfordhb/9780198810230.013.11

  • CrossRef
  • Google Scholar
  • View reference in article

• 22

  MüllerJ. (2013). Mechanisms of Trust: News Media in Democratic and Authoritarian regimes. Campus Verlag.

  • Google Scholar
  • View reference in article

• 23

  PanagiotopoulosV. (2025). “Spyware industry pockets EU subsidies while snooping on its citizens,” in Follow the Money - Platform for Investigative Journalism.Available online at:https://www.ftm.eu/articles/spyware-industry-eu-subsidies-surveillance-concers(Accessed March 12, 2026).

  • Google Scholar
  • View reference in article

• 24

  PaoliL.AdriaenssenA.GreenfieldV. A.ConickxM. (2016). Exploring definitions of serious crime in EU policy documents and academic publications: a content analysis and policy implications. Eur. J. Crim. Policy Res.23 (3), 269–285. 10.1007/s10610-016-9333-y

  • CrossRef
  • Google Scholar
  • View reference in article

• 25

  PapadopoulouL. (2025). Digital authoritarianism in the birthplace of democracy? Greece’s digital surveillance scandal and the lived experiences of targeted journalists. Digital Journalism, 1–19. 10.1080/21670811.2025.2568911

  • CrossRef
  • Google Scholar
  • View reference in article

• 26

  PapadopoulouL.AngelouY. (2026). Monitoring Media pluralism in the European Union: Results of the MPM2026. Greece: Country report. Available online at:https://hdl.handle.net/1814/95491(Accessed September 17, 2026).

  • Google Scholar
  • View reference in article

• 27

  RieckeL. (2026). Why states are failing to rein in the spyware market. Comp. Law Sec. Rev.61, 106322. 10.1016/j.clsr.2026.106322

  • CrossRef
  • Google Scholar
  • View reference in article

• 28

  SambataroG. (2022). The protection of journalistic sources in Italian criminal proceedings: the ‘iuventa case’ - global freedom of expression. Glob. Freedom Express.. Available online at:https://globalfreedomofexpression.columbia.edu/updates/2022/07/the-protection-of-journalistic-sources-in-italian-criminal-proceedings-the-trapani-case/

  • Google Scholar
  • View reference in article

• 29

  StamouliN. (2026). Greek Court Sentences Predator Spyware Gang. POLITICO. Available online at:www.politico.eu/article/predatorgate-greece-court-sentences-predator-spyware-gang/(Accessed July 1, 2026).

  • Google Scholar
  • View reference in article

• 30

  Suau MartinezJCapilla GarciaPCorderoLFranquetMHernandezNPuertasDYesteE. 2026. “Monitoring media pluralism in the European Union: Results of the MPM2026. Country report: Spain”. Available online at:https://hdl.handle.net/1814/95506(Accessed September 17, 2026).

  • Google Scholar
  • View reference in article

• 31

  Venice Commission. 2024. “ Report on a Rule of Law and Human Rights Compliant Regulation of Spyware” Available online at:https://www.coe.int/en/web/venice-commission/-/cdl-ad-2024-043-e(Accessed September 17, 2026).

  • Google Scholar
  • View reference in article

• 32

  VigevaniG.CanzianN.CeciliM. (2026). Monitoring Media pluralism in the European Union: Results of the MPM2026. Italy: Country report. Available online at:https://hdl.handle.net/1814/95494(Accessed September 17, 2026).

  • Google Scholar
  • View reference in article

• 33

  VisschersJ.PaoliL. (2024). A comparison of public and police perceptions of the seriousness of crime. Eur. J. Crim. Policy Res.31, 347–370. 10.1007/s10610-024-09589-7

  • CrossRef
  • Google Scholar
  • View reference in article

• 34

  WoodhamsS. (2021). Spyware: An Unregulated and Escalating threat to Independent media. Center for International Media Assistance.

  • Google Scholar
  • View reference in article

• 35

  “Αναζήτηση.” Hellenicparliament.gr, 2022, Available online at:www.hellenicparliament.gr/Nomothetiko-Ergo/Anazitisi-Nomothetikou-Ergou?law_id=3715dd48-9b39-4532-9b0e-af5c014ff48e(Accessed July 1, 2026).

  • Google Scholar
  • View reference in article