Spyware. Something’s wrong in Italy, says journalist under surveillance

Questo articolo è disponibile anche in:

Ciro Pellegrino considers two strange and worrying phenomena : the fact that two professionals from the same newspaper were spied on and the centre-right’s silence

OSSIGENO, May 31, 2025 – “Something’s wrong here,” says Ciro Pellegrino, head of the Naples editorial office of the online newspaper ‘Fanpage’, the second Italian journalist to be spied on via his phone in a manner that appears illegal. He recounted this in detail publicly at an Ossigeno conference, learning how, at the end of April 2025, he  had been the victim of “mercenary” electronic espionage, just as his newspaper’s editor, journalist Francesco Cancellato and several activists had been three months earlier. Ciro Pellegrino’s exact words can be read below, after some background notes on his case.

THE BACKGROUND – It wasn’t Meta who notified the journalist, as had happened in the case of Francesco Cancellato, but Apple itself, the manufacturer of his smartphone, first with an email and then with the following message: “Apple has detected a targeted mercenary spyware attack against your iPhone. This attack is likely targeting you specifically because of your identity or activities.”

The company further explained: “Today’s notification is being sent to affected users in 100 countries, and to date, we have notified users in over 150 countries in total. Their high cost, sophistication, and global nature make mercenary spyware attacks among the most advanced digital threats currently in existence.”

A month later, it is still unclear whether the spyware that infected Ciro Pellegrino’s device is Graphite, the software from the Israeli company Paragon used to spy on other Italian users, including Francesco Cancellato, activists of Mediterranea (an association assisting migrants) Luca Casarini and Beppe Caccia, and their on-board chaplain, Father Mattia Ferrari.

The journalist has filed a formal complaint against persons unknown to determine what happened and how he fell victim to spyware.

Following this new complaint, the Naples Public Prosecutor’s Office, which is also following those previously filed with four other Italian prosecutors’ offices, and others  are conducting investigations.

THE GOVERNMENT has been implicated in the Graphite case, as it involves spyware that the Israeli company Paragon Solutions sells exclusively to government entities. The Government has declared the software a state secret and denied having spied on Francesco Cancellato. Undersecretary to the Prime Minister, Alfredo Mantovano, interviewed by COPASIR (the Italian parliamentary security committee) at the end of March, admitted that the security intelligence services are in possession of the Israeli software, but that its use is legitimate and follows established procedures.

ODG AND FNSI – Following the Ciro Pellegrino case, the National Order of Journalists (ODG) and the National Press Federation (FNSI) have filed complaints with the judiciary. “Italian and European laws, as well as constitutional principles on freedom of information, are being violated,” they said. “Now comes evidence of a second journalist, coincidentally also from Fanpage, being the target of spyware. This is intolerable and unacceptable. Our solidarity goes out to our colleagues. We ask the government why this very serious matter has been classified as a state secret. We ask all democratic institutions to take action to clarify matters and guarantee press freedom which is being seriously endangered.”

THE EUROPEAN DELEGATION – To assess the latest developments in the Paragon spyware scandal, a delegation of the Socialists and Democrats in the European Parliament, led by Democratic Party MEP Sandro Ruotolo, has announced a mission to Rome in the coming days to meet with those affected by the spyware, including the two Fanpage journalists, representatives of the National Federation of the Italian Press (FNSI), the RAI journalists’ union (Usigrai), the National Council of the Order of Journalists, and Amnesty International. A visit to the Chamber of Deputies and a meeting with the heads of COPASIR and DIS (the department for information security) are also planned.

– – – – – – – – – –

CIRO PELLEGRINO’S OWN ACCOUNT

Ciro Pellegrino recounted his ordeal first-hand on May 5^th  2025, at the Ossigeno conference “Helping Those Suffering from Lawsuits and Threats,” held on World Press Freedom Day at the Casa del Jazz in Rome. Here are his words:

“Today, I am the unwilling protagonist of a story that began like this: on April 29^th  a message from Apple on my iPhone informed me that the phone was a ‘target,’ meaning the target of a spyware attack, conducted with the type of software inserted into mobile  phones or other devices to monitor their entire activity. Calls, messages, archives, contacts, photos, and so on. Everything. Because the mobile phone has become the black box of our existence,” said Ciro Pellegrino.

“When spyware is used lawfully by prosecutors and police forces to monitor certain situations, the person being intercepted has a series of guarantees. At a certain point, once the investigation is concluded, the person being intercepted learns about it  and not from Apple, as happened to me.

When a phone manufacturer or a messaging service like WhatsApp alerts you, as in the case of my editor Francesco Cancellato, who was alerted in this way by the Meta group, it’s meant to signal that you’re the victim of an illegal intrusion. So far in Italy, we’ve only counted these two intrusions targeting journalists, and both in the same newspaper, our Fanpage. It’s a very strange coincidence.

“In my case, investigations are underway to determine the name of this spyware, how long someone had been listening in, and what they were trying to do. The name of the spyware used is important because, as Apple says, these extremely powerful tools cost millions of euros and aren’t used to empty your bank account: they’re used for very specific targets. So it’s likely that I was attacked because of my identity (as a journalist) and what I do, as Apple has told me.

I’ve been a professional journalist for 20 years and have been working at Fanpage for 15;  these are certainly interesting elements of my identity.

“In the case of my editor Francesco Cancellato, it was discovered that Graphite spyware, from the Israeli group Paragon, was used, which is also in use by various governments. In Italy, the authority delegated to the security services (the one that authorizes wiretaps for preventive investigations to protect public safety, ed.) is Undersecretary Alfredo Mantovano, who in the Cancellato case stated that the Italian government had never spied on journalists. Classified hearings were held at COPASIR, and from what little we learned, nothing was found. Moral of the story: two journalists and several citizens in Italy, according to what we know so far, were spied on by military spyware and mercenary spyware, and we don’t know why.

The first issue that arises is cyber security, because two Italian citizens, two journalists, were spied on. The second issue concerns our profession, given that they were two journalists from the same newspaper: Francesco Cancellato in January and myself at the end of April. It’s likely that we were monitored at the same time, but we’re not yet certain.

“But who is supposed to give us answers? Clearly, the Italian intelligence services could begin, if not confirming, at least denying: saying you were spied on, or you weren’t.

” I must say that we’ve received great solidarity on this matter, and there’s been a great response, both from professional bodies and colleagues, and from Fanpage readers. We’re very pleased. However, on the political level, positions have diverged: one political faction has spoken out, while another has remained completely silent.

“I’ve been a journalist since I was 20, and now I’m 48 (everyone knows me), yet not even the local centre-right political representatives, those I’ve known all my life, have expressed solidarity. It almost seems like the Italian centre-right has imposed silence. Not even those at the lowest levels of the political hierarchy , such as city councillors (I mainly cover Naples news and work here), have said anything. A gesture of solidarity would have been enough.

“It’s strange and worrying.