Intellexa's Predator Spyware and the Greek Wiretapping Scandal (2022–2024)

The Greek Predator case is, in the Archive's assessment, the clearest documented instance to date of commercial spyware being deployed against a domestic democratic opponent inside an EU member state while legal, state-authorized surveillance was occurring in parallel against the same target — a convergence that blurred the line between lawful intercept and illicit spyware abuse and made the scandal uniquely difficult for Greek authorities to contain politically. The Archive views the dual-track nature of the Androulakis case (simultaneous EYP wiretapping and Predator infection) as evidence that mercenary spyware is increasingly used not merely by authoritarian governments against foreign dissidents, but as a supplementary, deniable tool alongside formal state surveillance apparatuses within parliamentary democracies. This distinguishes the Greek case from earlier Pegasus-related scandals, which largely involved extraterritorial targeting. Secondly, the Archive notes that the Intellexa case demonstrates the limited deterrent effect of corporate and platform-level disruption absent state sanctions: Meta's 2022 takedown of Predator-linked accounts and infrastructure did not halt the spyware's commercial operation, and it took roughly fifteen additional months of continued abuse documentation by Citizen Lab and others before the U.S. Treasury imposed sanctions in March 2024. This lag illustrates a recurring enforcement gap the Archive has observed across mercenary spyware cases: platform and civil-society disruption operates on a faster cycle than state sanctions, leaving a prolonged window in which vendors continue operating, often through reconstituted corporate entities. Finally, the Archive assesses that the Greek scandal's political fallout — resignations of the intelligence chief and a senior prime ministerial aide — combined with the subsequent European Parliament PEGA committee inquiry, signals growing institutional recognition within the EU that commercial spyware proliferation is a governance failure requiring regulatory rather than purely reactive responses, though as of this record's publication no binding EU-wide spyware export control had been enacted.