(Athens, December 8, 2022) – Greece’s lawmakers are considering a draft surveillance law that lacks effective privacy and human rights safeguards, Human Rights Watch said today.
Surveillance legislation should not go forward without clear safeguards in place and until the completion of a thorough and independent investigation into a major surveillance scandal implicating the government and its conclusions and recommendations are made public. Lawmakers should withdraw the bill.
“Without proper safeguards and a clear understanding of what went wrong, a new surveillance law will only make things worse,” said Eva Cossé, senior Greece researcher at Human Rights Watch. “If the government won’t press pause on this risky bill, parliament should.”
The draft law to reform the National Intelligence Service (EYP) is a flawed attempt to respond to a scandal that has shaken Greek politics, as it was revealed by investigative media outlets that dozens prominent figures were targeted by secret services and spyware.
The bill was introduced in parliament on November 29 after a rushed seven-day public consultation period and adopted in the parliamentary committee on December 6. The draft law is to be debated and voted in plenary on December 8.
The surveillance scandal began with revelations in November 2021 that Greece’s intelligence service, EYP, had wiretapped the phone of Stavros Malichoudis, a freelance reporter. It then emerged in April 2022 that the mobile phone of Thanasis Koukakis, a freelance journalist investigating banking and business stories, was infected by the Predator spyware – a software that allows users to monitor every aspect of a target’s phone, including calls, messages, photos, and videos, as well as to access the microphone and camera. Days later, it was also revealed that the security service had also wiretapped Koukakis’ phone though the official procedure.
At the end of July and in early August, it was reported that the intelligence services had also conducted surveillance on the leader of the opposition party PASOK and member of the European Parliament, Nikos Androulakis, and that there had been an attempt to hack his mobile phone with Predator.
Since then, a much broader and growing list of targets, including journalists, politicians, entrepreneurs, members of the government, and judicial officials have reportedly also been targeted by Predator, according to the investigative media outlet Documento. National authorities have been accused of being complicit in the surveillance.
The government denies the allegations and its links to the use of spyware. It admitted, though, that the state intelligence service was monitoring Androulakis for what it described as reasons of national security. The head of the security services, which falls under the direct supervision of the prime minister’s office, resigned following the news.
A Greek parliament inquiry into the surveillance scandal opened in September, but the ruling New Democracy party blocked dozens of witnesses proposed by opposition parties, including journalists whose phones had been wiretapped. In addition, the ruling party-controlled committee conducting the inquiry decided that all inquiry meetings would be held behind closed doors and remain confidential, along with the committee’s concluding report, raising transparency concerns. A judicial investigation is also ongoing.
The draft law fails to take into account objections from two constitutionally entrenched independent public bodies: the Hellenic Authority for Communication Security and Privacy (ADAE), which oversees surveillance powers, and the Data Protection Authority, which oversees the use of personal data. ADAE is tasked with monitoring compliance with the terms and the procedures of legally permitted interception of communications, but lacks the power of review that competent judicial authorities have.
ADAE criticized the government for failing to consult with it prior to putting the bill out for public consultation, and said that the legislation effectively abolishes its oversight powers. The Data Protection Authority raised concerns that “the core of individual rights is affected” by the bill.
Until March 2021, a person under government surveillance for national security reasons had the right to file a request with ADAE for information about themselvest. But ADAE would only provide that information once those measures were no longer in effect and, notably, only if disclosure would not compromise the purpose of the investigation. An amendment adopted at the end of March 2021 made it impossible for someone under government surveillance for national security reasons to ever get informaiton about it or to seek a remedy.
The draft law reintroduces access to such information, but only three years after the end of the monitoring. The affected person can be informed of the fact of the surveillance and of its duration but not of the content, significantly hampering a potential victim from collecting evidence about their surveillance and challenging it in court on the basis that it is illegal, abusive, or disproportionate.
Known victims of state surveillance, such as Malichudis, Koukakis, and Nikos Androulakis have not be able to find out why they were under surveillance by the country’s secret services. If the bill were adopted, they would still not have access to such information since the law does not authorize such disclosures.
Following a visit to Greece by a European Parliament committee that investigates spyware use by European Union governments, the Greek government promised to ban the sale of spyware. The draft law would make it a criminal offense for non-state actors to possess, produce, purchase, or sell software or devices capable of interception, recording, and extraction of content or communication data. A list of such surveillance technology would be published by the head of the intelligence service.
But the draft law legitimizes the procurement and use of such spyware by the government, under a presidential decree, and lacks safeguards, including independent oversight, against the misuse of such spyware by state officials and agencies, Human Rights Watch said. ADAE has said that the law opens up the the possibility of legal monitoring with spyware technology outside of the existing official system of legally permitted interception of communications.
Members of Parliament should withdraw the bill immediately until there has been a meaningful consultation with ADAE, civil society, privacy rights experts, and the public, Human Rights Watch said. They should also open a new parliamentary inquiry into whether and how Greek intelligence agencies procured and used spyware to violate privacy and other human rights. At a minimum, this inquiry and its outcome should be public, and should seek evidence from journalists, politicians, and activists wiretapped or targeted by Predator.
The government should also immediately prohibit its agencies from procuring or using spyware until it establishes whether it can put meaningful human rights safeguards in place to curb its misuse.
“The bill comes at time of rising concern about media freedom and the rule of law in Greece,” Cossé said. “Parliament should play its role and make sure that this legislation actually moves Greece in the direction of intelligence and surveilleance reform.”
