Deputy Supreme Court Prosecutor Achilleas Zisis, who heads a high-level investigating the wiretapping case, last June crossed the threshold of Greece’s National Intelligence Service (EYP) along with two court-appointed IT experts: a university professor specializing in robotics/mechatronics and a police detective sergeant specializing in applied information systems.

The three men had brought with them a list of 116 telephone numbers. This individuals on the list, who had been identified by the Hellenic Data Protection Authority (DPA), had all received SMS messages infected with the Predator spyware sold by the firm Intellexa. The three men had visited the EYP headquarters with a single goal: to find out which of these 116 numbers had had their right to confidentiality lifted for reasons of national security. What they found out that day would confirm beyond any doubt what we have been arguing for years: namely, that the legally-requested (though often abusive) surveillance and illegal wiretapping originated from a common source, and with the full knowledge of the Prime Minister’s office.

The identification of the 87 subscribers

The list of 116 telephone numbers was the result of an ex-officio investigation into the Predator illegal surveillance case launched by the HDPA back in July 2022. The decision to launch the investigation was prompted by the eavesdropping on the mobile phone of the subsequently elected president of the PASOK party, Nikos Androulakis, and former SYRIZA minister Christos Spirtzis.

In April 2023, when it had successfully identified 115 of the 116 recipients of infected messages with the help of the cellphone companies, ADAE informed the Prosecutor of the Athens Court of First Instance—who was investigating the case at the time, before it was taken from that office without warning in October 2023 by decision of the prosecutor of the Supreme Court, Georgia Adeilini, who then assigned it to the Deputy Prosecutor of the Supreme Court, Zisis.

The vital cross-check, which involved working through the list and identifying which of the individuals on it had also been subject to legal surveillance, took a full 14 months (April 2023 – June 2024) to complete. Eight of those months went by while the case was being handled by Deputy Prosecutor Zisis. In the six months prior to that, the Prosecutors of the Court of First Instance and the Hellenic Authority for Communications Security and Privacy (ADAE), which was responsible for the cross-checking, encountered a constant stream of impediments which made it impossible to make progress.

The highlight was the unconstitutional replacement of members of the ADAE whose term of office had ended by the government majority, and their replacement with others of their liking, and of course the abrupt removal from the case of the two Prosecutors of the Court of First Instance who had requested the cross-check from the ADAE.

According to the confidential findings of the HDPA, of the 115 cellphone numbers whose owners have been identified, 32 are registered to legal entities and 64 to individuals, while 19 correspond to ‘disposable’ mobile numbers, or “burners”. These latter numbers were registered to nationals from Asian countries and appear to have been used in a “test run” by Predator operators.

The Authority identified more than 225 attempts to install the spyware on 94 different numbers belonging to 87 individuals or legal entities (i.e. corporate cell phones). The burners and personal numbers have been removed from the calculations, since they do not appear to be related to attempts to install Predator. Something that had not been made public, until Inside Story revealed it today is that the telephone numbers on the list include the cell phone of Minister Takis Theodorikakos, as well as the journalist and editor of Proto Thema, Tasos Karamitsos.

The cross-check conducted by the two court experts and Deputy Prosecutor Achilleas Zisis proved that of these 87 persons, 27 had had at least one order issued by the NSA to lift their right to confidentiality. In other words, one in three of the Predator targets were also subject to official surveillance by the NSA—some for two whole years—under the pretext of national security concerns. Of these 27, 22 were legally wiretapped over a period identical or similar to that of the attempted Predator infection.

These figures are purely indicative, which is to say there is every likelihood that they are much higher. There are two reasons why this might be so:

  1. First, because the investigation of the DPA has only addressed the tip of the iceberg. By restricting its investigation to text messages sent in 2021 through two specific SMS centers, it has left out those sent in 2020 or through applications (a Predator victim who received an infected message through the Signal application, for example).
  2. Second, because Deputy Prosecutor Achilleas Zisis and his two court experts chose to go to the NSI, which is under investigation for its role in the case, and not to the service providers themselves. If he had gone to the providers, he would have had access to all the documents lifting subscribers’ right to privacy for reasons of national security, i.e. not only those ordered by the NSA, but also those issued at the request of the Counter-Terrorist Unit, which constitute the lion’s share. Also, according to Inside Story, during their visit to the NSA they did not have direct access to the agency’s archive; the requested data was provided to them instead.

The names

As you read on, bear in mind that privacy waivers issued by public prosecutors on national security grounds have a two-month duration and can be renewed indefinitely. This means, for example, that for the NSA to be able to tap someone’s cellphone for six months, three waivers would have to be issued. In every case, from ministers to prosecutors, the cause cited was “for reasons of national security”. Under the current legislation, it is virtually impossible in practice for the persons targeted to be officially informed of the reason why it was deemed appropriate for the NSA to lift the confidentiality on their communications.

2020

The individuals who were subject to both legal and illegal interceptions include ministers and senior officials within New Democracy, journalists, lawyers, a tax inspector, a public prosecutor, members of the armed forces and the police, as well as a banker.

On 31 March 2020, the privacy of the communications of Manolis Grafakos, the Secretary General for Waste Management Coordination at the Ministry of the Environment and Energy, was lifted. After a pause lasting a few months (June – November 2020), legal surveillance resumed on 24 November and continued through to the end of March 2021. In January 2021, Manolis Grafakos received the first Predator-infected text message on his cellphone.

On 1 June 2020, it was the turn of Giorgos Mylonakis (Secretary General of the Hellenic Parliament at the time), the journalist Thanasis Koukakis, and the Financial Prosecutor Christos Bardakis (appointed on 23 June 2020) to have their phones legal tapped by the NSA for “reasons of national security”.

A few days later, on June 9, 2020, the communications of the journalist Tina Messaropoulou, who happens to be the wife of Giorgos Mylonakis, also became subject to surveillance. The legal tapping of her phone ended in February 2021; one month later, she would receive her first message infected with Predator spyware.

Giorgos Mylonakis’ legal surveillance ended almost six months after it began, on 24 December 2020. In 2021, starting in January, Predator operators would attempt to infect his cellphone on 11 separate occasions (with other attempts possible in 2020, given that the HDPA investigation was restricted to 2021, as mentioned above).

The legal surveillance of the journalist Thanasis Koukakis was brought to a hasty halt in August 2020, on the very same day he went to the ADAE to file a complaint and request that the Authority investigate whether the confidentiality of his communications had been lifted.

However, the Predator operators had already sent him an infected message on 31 July 2020 and finally succeeded in infecting him with a message sent almost a year later, on 12 July 2021. For at least 10 weeks, his cellphone had been turned into a super bug.

A curious coincidence

Several months after Koukakis lodged his complaint with the ADAE, on 10 March 2021, the Authority approached the NSA Prosecutor to ask whether the legal requirement had been met to inform the journalist that the confidentiality of his communications had been lifted. On 31 March, just 20 days after the ADAE posed this question to the NSA, the government amended the law to prohibit the ADAE from disclosing interceptions to citizens. The provision was retroactive and therefore covered the tapping of Koukakis’ cellphone.

The lifting of the confidentiality of the communications of the Financial Prosecutor Christos Bardakis lasted for two full years, running from 1 June 2020 to 12 June 2022, with a brief pause between 31 March 2021 and 11 April 2021.

In mid-July 2020, the confidentiality of the communications of Yannis Olympios and Thomas Varvitsiotis, the two founders of the communication and public relations company V+O, were lifted. The NSA listened in on them until mid-July 2022, which is to say for two years.

During this period, attempts were also made to install Predator on their mobile phones.

In September 2020 the wiretapping of Argyro Xagorari, who had in the past been a close associate of Mareva Grabowski, the wife of Prime Minister Kyriakos Mitsotakis, began. Argyro Xagorari received at least three messages infected with Predator in 2021.

Still in 2020, on 10 November the legal wiretapping of the then Minister for the Environment and Energy, Kostis Hatzidakis, began; it would continue until June 2021. Shortly before and after the legal tap came to an end, the Minister received infected messages on his cellphone. In total, at least six attempts were made to install Predator on his phone.

A few days later, legal wiretapping began on the phones of two of Kostis Hatzidakis’ associates. On 18 November 2020, the NSA began to tap communications consultant Nikos Sigalas (it would continue to do so until 2 August 2021), while on 26 November the legal tapping of the phone of Kostis Mousouroulis would begin (it would continue until 22/3/2021). The latter had been selected on 13 February 2020 by the Interministerial Committee for Delignitization to coordinate the Just Transition Development Plan for the regions of Western Macedonia and Megalopolis. Both these associates of Minister Kostis Hatzidakis received Predator-infected messages while the NSA was wiretapping them.

The NSA began to tap the phone of Aristidis Alexopoulos, then General Director of the General Directorate for Defense Investments and Armaments at the Ministry of National Defense (a post he continued to hold until recently) at the end of December 2020; the tap would not end until June 2022). During this period, he received at least one spyware-infected message.

2021

On February 20, 2021, the cellphone of the actor and comedian Lakis Lazopoulos would be tapped, with the NSA continuing to listen in to his communications until March 2022. During this time, the Predator operators sent an infected text message to his cellphone.

Two days later, on 22 February 2021, the NSA would start tapping the telephone of the publisher Stefanos Chios. After successive renewals, the legal tapping of his cellphone would eventually end on 17 August 2022. In the meantime, however, he had also been targeted by Predator.

On 2 April 2021, the then high-ranking National Bank of Greece executive Fotini Ioannou was targeted by the NSA, supposedly on national security grounds. Since May 2019, she had been General Manager of Corporate and Retail Banking Claims Management and Chair of the Non-Performing Loans Committee of the Hellenic Banking Association. Her tap would remain in place until June 2022, a period of 14 months. In April 2021 she was subject to three separate attempts to infect her cellphone with Intellexa’s spyware. In his “Vimatodotis” column, the journalist Christos Papachristos of To Vima would indirectly link the targeting of Ioannou with the debt a large industrial conglomerate owed the National Bank.

On 10 May 2021, the tapping of Pinelopi Miniati, a police major general at the time and director of the Forensic Science Division of the Hellenic Police, would begin; the wiretapping would continue for several months.

The cellphone of the assassinated journalist Giorgos Karaivaz, who was found dead outside his home in April 2021, had been sent to the Forensic Science Division for examination. Just 18 days after the privacy of her communications was waived, Pinelopi Miniati received an infected text message on her cellphone.

On 16 June 2021, the NSA started listening to the telephone communications of P.Z., an art restorer specializing in the restoration of religious icons who had profession contacts with the ecclesiastical world. The wiretap would remain in place until early March 2022, while an attempt was made as early as 29 June 2021 to infect his cellphone with Predator.

On 22 June 2021 the wire taps on the telephones of the lawyer Tonia Primpa, a legal advisor for a number of years to the General Secretariat of Telecommunications and Postal Services at the Ministry of Digital Governance, and Athens lawyer Ioannis Fytilis, who had represented Stefanos Chios for a short time in 2021, began. Three days later, on 25 June 2021, both would receive messages intended to infect their cellphones with Predator. The NSA listened in on the telephone communications of Tonia Primpa until mid-August 2022 and Ioannis Fytilis until early April 2022.

On 23 July 2021, the Greek-American citizen and Facebook (META) executive at the time, Artemis Seaford was targeted by the NSA. A few months later, on 17 September 2021, her cellphone was infected with a message simulating an official Covid-19 vaccination reminder. The tap on her phone would remain in place for many months, through to 2 June 2022.

During this same exact period, the NSA was also listening in on the communications of May Zanni, an employee in the Prime Minister’s Office. Her cellphone was also hacked with Predator spyware when she received a malicious message on 2 August 2021, shortly after the privacy of her communications was lifted by the NSA.

The NSA also listened in on the conversations of a retired postman and resident of Chania between 30 July 2021 and March 2022 S.F. received a letter from the DPA (as did everyone else mentioned in this report) informing him that, on 2 August 2021, he had also received a Predator message.

Next on the list of wiretaps performed legally following the lifting of the confidentiality of communications was the president of PASOK (an MEP at the time and a candidate for the presidency of the party) Nikos Androulakis. The tap began on 14 September 2021 and ended on 17 December of the same year. He would also receive his first Predator message just a few days after the commencement of NSA surveillance.

On 24 September 2021, the wiretapping of Maria Diamanti, a staff member of the Prime Minister’s Office at the time, began; she would quit her position after the resignation of Grigoris Dimitriadis in the wake of the wiretapping revelations. The NSA would continue to tap Maria Diamanti until June 2022, while three days before the official lifting of the confidentiality of her communications, the Maximos employee (and current collaborator of Kyriakos Pierrakakis at the Ministry of Education) would receive an SMS on her cellphone which sought to contaminate her phone with the spyware.

On 15 October 2021, the tax inspector Spyros Kousounis, who was an executive at the Public Revenue Investigation and Assurance Service at the time, was targeted by the NSA. According to an article in efsyn, this Service had in 2021 frozen the accounts of Yannis Lavranos, the businessman through his company Krikel had signed seven confidential contracts with the Hellenic Police for TETRA walkie-talkies and is also linked to Predator.

2022

The year began on 28 January with the lifting of the privacy of the communications of the presenter Menios Fourthiotis on both of his cellphone numbers. The wiretap would end on 28 July 2022. The presenter was also targeted by Predator in 2021 through at least three messages.

In March 2022, the wiretapping of the cellphone of the then Chief of the General Staff, Konstantinos Floros, began; it would continue through to June of the same year. He had also been targeted by Predator in 2021.

According to press reports, on being presented the above evidence, the experts appointed after a long delay by Deputy Prosecutor Achilleas Zisis concluded that any overlaps were coincidental and that the two methods of surveillance—Predator and the formal lifting of confidentiality—were in no way connected.

As we see it, the cross-checking of the two lists looks more like an attempt to close the case than to open it.