Why the "Greek Watergate" earthquake has only just begun

A digital surveillance scandal targeting PASOK-KINAL leader Nikos Androulakis and investigative journalist Thanasis Koukakis, via Predator spyware. The so-called "Greek Watergate" is shaking the Mitsotakis government

The Greek secret services intercepted all the personal communications of MEP Nikos Androulakis during the race for the PASOK-KINAL primary elections in the second half of 2021. The revelation triggered a political earthquake in Greece, leading to the resignation of the head of the intelligence and the right-hand man of Premier Kyriakos Mitsotakis.

After too many months of silence, the surveillance scandal is now making the rounds in the international media, marking the end of the European honeymoon for the leader of New Democracy, Kyriakos Mitsotakis, long hailed as the enfant prodige of European liberal conservatism.

The actual responsibilities of the government in the "Greek Watergate" – as opposition leader Alexis Tsipras dubbed it – have yet to emerge, however, especially with regard to the purchase and use of the expensive Predator spyware.

From Androulakis to Koukakis: politicians and journalists under surveillance

On 26 July, Androulakis reported to the Greek authorities an attempt by unknown persons to install Predator spyware on his smartphone. The leader of PASOK-KINAL had his device analysed through a service offered to MEPs in the context of the investigation into the more infamous Pegasus spyware.

Like Pegasus, Predator allows you to intercept all communications sent or received by the infected device, take screenshots, and remotely activate the microphone and camera. The most notable difference between the two is that Predator's installation requires a "click" on a trap link sent to the victim. On 21 September 2021, Androulakis received a suspicious message with a link attached, which the MEP however did not open.

So far, it would be a disturbing unsuccessful surveillance attempt. But Androulakis’ complaint alarmed the Greek authority for the security and privacy of communications (ADAE), which in a few days uncovered a separate case of surveillance that actually took place against Androulakis by the EYP, Hellenic intelligence.

This is not the first surveillance case that has emerged in recent months. The University of Toronto Citizen Lab revealed to financial reporter Thanasis Koukakis that Predator had been active on his smartphone for at least six weeks between July and September 2021.

Just like Androulakis, the investigation into the case revealed a separate case of surveillance of the reporter by the EYP dating back to the previous year, when Koukakis was working on an investigation into Greek bankers and powerful businessmen. Monitoring was mysteriously suspended on the same day that the journalist, suspicious, filed a complaint with the ADAE.

Journalist Stavros Malichudis, author of numerous investigations into the treatment of migrants and asylum seekers, also came under the EYP's crosshairs, as revealed by the Efsyn newspaper.

The government's omissions on Predator

Although not unprecedented, the Androulakis case is making much more noise, attracting the attention of the international media and the European Commission .

The Greek government could no longer pretend nothing had happened: head of intelligence Panagiotis Kontoleon and secretary general of the office of the prime minister Grigoris Dimitriadis, right-hand man and nephew of Mitsotakis, resigned. The premier assured that, if he had been aware of it, he would have prevented the surveillance of Androulakis, calling it an act in compliance with the law but "politically unacceptable". Finally, Mitsotakis promised EYP reform to increase transparency.

Everything solved? Not really: the official version of the facts is full of gaps and contradictions, and leaves several questions open.

The Greek government continues to deny having bought Predator, or having had anything to do with Intellexa, the company that markets spyware in Greece. Yet, spyware is the element that unites the episodes of Koukakis and Androulakis: both learnt that they were being monitored by the EYP with "traditional" methods only after being informed of the surveillance (only attempted, in the case of the MEP) through Predator.

According to the Citizen Lab, it is difficult for a private company to have the financial means to purchase Predator and to use it legally.

All suspicions fall on the Greek state: Google's Threat Analysis Group (TAG)  claims that government-backed actors have likely bought Predator in Egypt, Armenia, Greece, Madagascar, Ivory Coast, Spain, and Indonesia.

Mitsotakis and relations with the EYP

In July 2019, immediately after the elections that brought New Democracy to the government and marked the end of the SYRIZA era, Mitsotakis introduced an EYP reform: from then on, intelligence reports directly to the prime minister.

In addition, when Koukakis approached the authorities suspecting he had been under surveillance, the government was quick to approve an amendment with retroactive effect to prevent the ADAE from informing citizens monitored by the EYP after the surveillance was over. The moves appear perfectly coordinated with those of the intelligence.

While admitting the political gravity of the affair, Mitsotakis defended the legality of the EYP's actions, but did not explain how two investigative journalists engaged in investigating corruption and abuses of power are a danger to national security.

As for Androulakis, the initial hypothesis attributed the surveillance to a request made by two foreign countries – Ukraine and Armenia – due to the MEP's allegedly suspicious relations with Russia and Turkey. The ambassadors of both countries promptly denied: Sergii Shutenko, representative of Kiyiv in Athens, spoke of “statements disconnected from reality” .

The other hypothesis – which linked Androulakis' surveillance to his role in relations between the EU and China – was soon discredited too, leaving room for the only likely explanation: the MEP was spied on for his political activities in Greece when he became the new leader of PASOK-KINAL.

The premier's nephew sues journalists

Thanks to a joint investigation, Reporters United and the Efsyn newspaper were able to draw a line between the resigning Dimitriadis and Predator. The spyware was developed by North Macedonian start-up Cytrox, which was acquired by Intellexa in 2018 for 5 million dollars. Owned by Israeli Tal Dillian , Intellexa moved its headquarters from Cyprus to Athens following some legal problems with the Cypriot authorities.

The journalistic investigation does not prove the purchase of the spyware by the government, but identifies a network of business and personal ties that binds the prime minister's nephew to Felix Bitsios, deputy administrator of Intellexa in Athens between 2020 and 2021.

In response, Dimitriadis sued Reporters United and Efsyn, demanding 150,000 and 250,000 Euros in compensation for defamation, respectively. Journalists Nicolas Leontopoulos, Thodoris Chondrogiannou, and Thanasis Koukakis himself are also targeted for sharing the results of the investigation on social networks.

As highlighted by the International Press Institute , Dimitriadis’ lawsuits are a classic example of SLAPP – spurious lawsuits that aim to morally and economically dry up journalists, to silence critical voices.

The European Federation of Journalists  condemned the lawsuits, asking the Greek judicial authorities to identify those responsible for the illegal surveillance of journalists. Such concern was also expressed by Reporters Without Borders (RSF) , which had ranked Greece in the last place among the EU countries for freedom of the press already in May, when the surveillance scandal was just beginning.