The hacking mystery roiling the Italian prime minister Giorgia Meloni’s rightwing government is deepening after researchers said they found new evidence that two more journalists were targeted using the same military-grade spyware that Italy has admitted to using against activists.
A parliamentary committee overseeing intelligence confirmed earlier this month thatItalyused mercenary spyware made by Israel-based Paragon Solutions against two Italian activists.
But the same committee, which launched an investigation into the hacking scandal in March, said it was unable to determine who was behind the targeting of a prominent Italian investigative journalist named Francesco Cancellato, whose news outlet has been critical of the Meloni government.
Now areport by researchers at the Citizen Labhas revealed that a close colleague of Cancellato, Ciro Pellegrino, who is head of the investigative outlet Fanpage.it’s Naples bureau, was also targeted by a user of Paragon Solution’s spyware, which is called Graphite. The Citizen Lab said a third journalist, who chose to remain anonymous and is described as a “prominent European journalist”, had also been targeted with the spyware.
The news comes as Paragon and the Italian government have been engaged in an acrimonious public spat. Haaretz reported this week that Paragon had offered to assist the Italian government in investigating Cancellato’s case. Italy reportedly rejected that offer, however, with the Italian department of security intelligence saying that it raised national security concerns.
Meloni’s office did not reply to a request for comment. A debate on the matter, which has prompted outrage among the Italian opposition and MEPs in Brussels, has been scheduled in the European parliament on 16 June.
The Guardian approached Paragon for comment on the latest development. It referred to comments it made to Haaretz, in which it confirmed it cancelled its contract with the Italian government after reports first emerged in February that Cancellato had been targeted. The Guardian first reported that Paragon wasterminating its contract with Italy in February.
Like other spyware vendors, Paragon sells its cyberweapon to government clients who are supposed to use it to prevent crime. The company has said it sells its spyware only to democratic countries and that its terms of service forbids agencies to use the spyware against journalists or members of civil society.
The question now remains who is behind the targeting of the two journalists.
John Scott-Railton, a senior researcher at the Citizen Lab, said: “We found that both journalists phones bore Paragon’s unmistakable digital fingerprints. Making matters even more interesting, we found fingerprints matching the same Paragon customer in both cases.”
A report released by the Copasir parliamentary committee found that Italy’s domestic and foreign intelligence agencies had contracts with Paragon in 2023 and 2024, and that the hacking software was used with the permission of a prosecutor and in limited circumstances. The committee said the spyware had been used to search for fugitives, investigate alleged terrorism, organised crime, fuel smuggling and counter-espionage efforts.
It said the pro-immigrant human rights activists who were targeted – they included Luca Cassarini and Giuseppe Caccia – had been spied on due to their connection to “irregular immigration” and not because they were involved in human rights.