Spyware Document Pool

Spyware is one of the most serious threats to fundamental rights, democracy and civic space across Europe. This document pool brings together EDRi’s analysis, advocacy, research, and curated third-party resources as part of our push for a full EU-wide ban on spyware.

By EDRi · January 19, 2026

Contents

 

Spyware use continues to spread across Europe in a climate of institutional inaction and normalisation. Despite repeated scandals in at least 14 Member states, and clear evidence of human rights violations, neither the European Commission nor States have introduced any red lines. Victims lack effective remedies, commercial vendors operate with complete impunity, and the European spyware market is thriving, often through public money.Journalists, activists, human rights defenders and civil society have mobilised in response. This document pool brings together the essential resources to understand, track, and challenge spyware in Europe and internationally.

1. What is Spyware?

For many of us, spyware means a software that can secretly get everything from your phone: your messages, photos, contacts, location, microphone, camera, and browsing history, without you ever knowing. These tools turn a personal device into a constant surveillance instrument, following you in your private life, work, and relationships. Spyware developers use systems vulnerabilities.

A clear, rights-based definition of spyware is essential for regulating it. Below is EDRi’s technical definition, anchored in what spyware does, rather than what it is marketed as.

Spyware can be defined as any software that meets the following cumulative conditions:

  • It compromises the integrity of the device;
  • Its deployment is primarily facilitated by exploiting existing or created vulnerabilities;
  • After installation, its operation (i.e. giving commands) is performed either automatically or remotely;
  • It can be targeted to individual or groups, or deployed indiscriminately;
  • In addition, software that serves to install spyware as defined above equally falls into the definition;

In addition to its core characteristics, spyware must be defined by what it enables. It is spyware if it enables at least one of the following:

  • Accessing and monitoring the device (real-time data) to observe activity, intercept communications, track location, etc.
  • Gathering or processing user data (historical data), such as retrieving messages, call logs, browsing history, stored files, biometric information, etc.;
  • Exfiltrating data for the purpose of sharing that information with a third party;
  • Controlling or manipulating the device, such as activating microphones or cameras, altering system settings, de-activating security features, etc.;
  • Altering or fabricating information, modifying, deleting, or fabricating messages, files, or logs to obscure or alter – or even plant – evidence.

2. EDRi’s call for a ban on spyware

In 2025, the EDRi network adopted a comprehensive position calling for a full ban on spyware in the European Union. The paper outlines the legal, technical and human-rights bases for this demand.

Check our position paper clicking on the image or here.

 

Why spyware violates human rights?

Spyware is incompatible with human rights because its intrusive, covert access to a person’s device exposes massive amounts of information and compromises the device’s integrity. This makes it impossible to satisfy the fundamental-rights requirements of necessity and proportionality, and impossible to subject its use to effective oversight.

Its deployment, as the commercial market behind it, is opaque by design, preventing meaningful scrutiny, accountability, or the ability for people to know they were targeted and to seek redress.

Spyware violates, among others, the rights to privacy and data protection, and creates chilling effects on freedom of expression, association, and civic participation. These harms are systemic and cannot be mitigated or controlled. As a result, the use of spyware is fundamentally irreconcilable with human-rights obligations.

Our main demands

We have listed a comprehensive list of demands to EU policymakers that can be summarised in three categories:

  1. Full ban on spyware. In particular, the European Commission should propose a full ban on the development, production, marketing, sale, export, and use of spyware, as a matter of urgency.
  2. Legally robust definition of spyware. This ban must be based on a clear and enforceable definition of spyware, focused on its core characteristics and functionalities rather than its marketing or intended use. Only such a comprehensive approach can prevent abuse, ensure legal certainty, and uphold the fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union.
  3. Comprehensive scope covering all actors. The prohibition must cover all public and private actors operating within the EU or subject to its jurisdiction. It should not be limited to tools used by states in law enforcement or national security contexts, but must also encompass commercial spyware marketed for other uses, including corporate or private surveillance.
  1. Total ban on commercial spyware. The European Commission must prohibit the development, production, marketing, sale, export, and use of commercial spyware by private companies, as demanded by civil society organisations working in digital rights.1
  2. Ban on the vulnerabilities and exploits market. The EU Commission should enforce a ban on the commercial trade of vulnerabilities for any purpose other than strengthening systems’ security. In parallel, it should mandate the responsible disclosure of vulnerability research findings, through a uniform reporting process, and forbid outsourcing vulnerability research use by states for offensive purposes to private for-profit vendors.
  3. Protections for ethical cybersecurity research and responsible disclosure. The EU should invest in research institutions and initiatives that focus on cybersecurity for public good, prioritising digital rights, privacy, and democratic security. At State level, whistleblower protections should be expanded, and governments and industry actors should establish strong incentives, such as well-funded bug bounty programmes, for ethical disclosure of security flaws to developers. Security researchers must be free from criminal and civil liabilities when they do research and when they share vulnerability information with software vendors and other security researchers.
  4. End financial incentives driving spyware proliferation. European Member States must prohibit public procurement from commercial spyware vendors, and ban public and private investment in spyware companies at any level of their corporate structures.
  5. Targeted sanctions against commercial spyware actors. The High Representative of the Union for Foreign Affairs and Security Policy and the Council should immediately agree on the following sanctions: ban entry for third-country nationals and entities involved in the commercial spyware industry, including executives and investors; targeted visa removals – for those already based in Europe – and travel bans for those based elsewhere; asset freezes to both companies and individuals, including EU citizens working abroad; blacklist those vendors involved in any spyware scandal; and ban exports to any country from any commercial spyware company based in the EU.
  6. Accountability for vendors, investors, and enabling states. Commercial spyware vendors must face legal consequences for enabling human rights abuses. Investors who knowingly fund these firms must also be held liable. Foreign states that facilitate spyware export and deployment for repressive purposes must face diplomatic and economic sanctions.
  7. Mandate retrospective transparency: Commercial spyware vendors, their clients, and their investors must be subject to mandatory, retrospective public disclosure of all its owners/shareholders, contracts, sales, and end-user agreements.
  1. Full access to legal and non-legal remedies for all victims
    1. EU Member States must ensure that all legal and non-legal remedies outlined in this chapter are accessible to any individual affected by spyware, regardless of nationality or status. This includes:
    2. Legal remedies: the right to know, the right to data protection and information on storage, judicial redress, independent investigation, compensation, and guarantees of non-repetition.
    3. Non-legal remedies: psychological support, protection mechanisms for asylum seekers, public awareness campaigns, and facilitated access to victim support
  2. Remove judicial barriers for existing victims
    1. The Council of the EU and Member States must mandate binding obligations for prosecutors to investigate spyware complaints by victims, remove discretionary inaction, and ensure support to courts with specialised units or independent investigators equipped to handle such complex cases
    2. Establish independent, adequately resourced independent investigative bodies to examine spyware abuse cases beyond political influence, and to avoid victims having to hand their devices to authorities they might not trust.
    3. Guarantee support for victims already entangled in lengthy, obstructed or stalled legal proceedings, including expedited review, procedural support, and access to digital forensics assistance, and reform jurisdictional rules to allow EU-based victims to bring transnational spyware cases, especially where vendors operate across multiple states.
  3. Ensure political accountability and structural reform
    1. The EU Commission must push for the enforcement of the PEGA Committee recommendations. It should particularly urge EU Member States to conduct immediate, independent, transparent and impartial investigations of any cases of unlawful surveillance, if needed with the impulse of their State prosecutors, under the threat of application of the Rule of Law mechanism in case it is not enforced;
    2. The EC should require Member States to provide full transparency in public procurement and deployment of spyware tools by Member States, including mandatory public reporting on spyware use.
    3. Member States affected by scandals should convene Parliamentary Inquiry Committees with enough powers to assess the scale, cost, and legal grounds of state use of spyware, as well as public procurement details.
    4. Member States should also reform secrecy laws that shield unlawful surveillance data – basic for the victims right to know – behind “secrecy” justifications, particularly when used to deny remedies to victims.
    5. Member States should hold enabling public officials politically accountable for the scandals perpetuated across Europe through removal from public service.
  4. Protect HRDs, journalists, lawyers and CSOs

The 11 rules for state hacking

If state hacking were ever to be permitted in Europe, it would need a strict, enforceable framework to prevent human rights abuses. Hacking is an extremely intrusive power: it can access, alter, delete or fabricate information inside a device, making it far more dangerous than traditional surveillance.

Below are 11 essential safeguards that any state hacking power must comply with to even be considered human-rights-compatible. You can download here our full position paper on State Access to encrypted data.

1️⃣ Meet the “quality of law” requirements

Hacking must be explicitly provided for by law that is clear, accessible, publicly available, and sufficiently precise; it must specify narrowly under which circumstances hacking is allowed.

2️⃣ Demonstrate strict necessity and proportionality

Authorities must show that hacking is the least intrusive means to achieve a legitimate aim; target(s), device(s), and data must be individually identified ex-ante, and the intrusion must be proportionate to the seriousness of the crime.

3️⃣ Prohibit unrestricted or bulk hacking

Hacking operations must target specific individuals/devices; bulk or mass hacking (of many devices/users) must be banned, and operations should be limited in time and scope.

4️⃣Ensure adequate safeguards for privileged or sensitive communications

Hacking must not undermine rights attached to confidentiality: e.g. legal privilege (lawyers), medical confidentiality, journalistic sources, etc.

5️⃣Judicial authorisation with full information

Authorisation must be given by an independent judge or court, with access to all relevant technical and operational details required to assess legality, necessity and proportionality.

6️⃣Strict targeting and minimisation of collateral impact

The operation must be carefully tailored: only the specified device/account/data should be targeted; data belonging to third parties must be protected, and any non-relevant data must be excluded or deleted.

7️⃣Transparency and accountability, including post-operation remedies

There must be oversight mechanisms, audit trails, reporting obligations, and the possibility for affected individuals to seek redress (judicial or other) if rights are violated.

8️⃣Prohibition of altering, fabricating or deleting data

Hacking tools must not be allowed to modify, falsify or erase data on the device, as this undermines evidentiary integrity and due-process rights.

9️⃣Time-limited operations and strict expiration of scope

The hacking operation must have a clear time frame; once the authorised goal is achieved, any further access must be terminated.

🔟No targeting of critical infrastructure or service providers

Hacking must be limited to the user’s device/account — states must not weaponise cybersecurity vulnerabilities at systemic level or mandate providers to weaken security.

1️⃣1️⃣ Protection of the security of encryption and the general public’s safety

Exploiting vulnerabilities or zero-days must be regulated carefully — the risk of broader harm (for example from making vulnerabilities public or available) must be weighed, ensuring that state hacking does not undermine overall cybersecurity.

DOCUMENT REPOSITORY

A repository of relevant documents for working on spyware. You'll find the work of EDRi members, as well as technical and human rights reports, and official documents. Send us a document if you think it should be featured here!

Spyware in the European Union

Europe has entered a new political term with no meaningful changes: spyware is still unaddressed and unregulated at the EU level. The previous Parliament issued strong calls for action with the PEGA Inquiry Committee. Yet the European Commission has so far declined to act, leading to growing number of scandals, spyware normalisation and people in the EU unprotected against this threat.

A broad coalition of civil society and journalism organisations called on the EU institutions to urgently end their political inertia on spyware. In an open letter of 3 September 2024, we demanded a full ban on the production, sale and use of commercial spyware. The letter warns that spyware undermines democratic values by enabling secret surveillance, generating a chilling effect, undermining journalims and activism, and shielding human rights abuses from any meaningful oversight or accountability.

Read our statement here:

Joint statement on the use of surveillance spyware ine the EU and beyond

The PEGA Committee, in 2021-2023, exposed the scale of spyware abuses across the EU, demonstrated the lack of willingness of national systems to prevent rights violations, and called for both legislative action and enforcement.

Institutional documents

EDRi analysis & commentary

The European Media Freedom Act (EMFA) was intended to protect journalists from surveillance. The general prohibition of the use of spyware on journalists in its article 4 was paired with very broad exceptions that, in practice, has legalised the use of spyware against journalists on very vague claims, like public safety or some petty crimes.

Institutional documents

EDRi analysis & commentary

Despite known abuses, EU money has repeatedly flowed to spyware companies through programmes such as Horizon, the EDF, or EIF. Investigations revealed that some of the beneficiaries were spyware vendors. Alongside its inaction, therefore, the Commission has directly fueled the spyware market with EU tax-payers money.

Investigations that revealed the issue

Institutional documents

Despite Commission’s inaction, the European Parliament continues the work: the LIBE Committee has devoted hearings to the topic, several MEPs keep pushing the topic into plenary debates, and the creation of a spyware-focused Interest Group marks a new phase of political scrutiny.

Institutional documents

Spyware scandals in European countries

Each country has experienced unique spyware scandals, from illegal targeting of journalists, political opponents, human rights defenders, migrants, business leaders, or prosecutors. In this section you’ll see news and reports on countries, to illustrate how systemic, cross-border, and normalised spyware abuse has become in Europe.

At least 65 Catalan politicians and public officials were targeted with Pegasus spyware by Spanish authorities. Investigations revealed that the spyware was deployed without judicial authorization, specifically against members of the Catalan independentist movement, including activists, journalists, lawyers and politicians. 4 years after, victims have found no justice in a judicial system that is posing many obstacles.

In a scandal known as “Predatorgate”, dozens of journalists, politicians, and entrepreneurs were targeted by the Greek secret services, with evidence of at least 92 people being targeted with Predator. Judicial inquiries are still ongoing, while spyware use has tried to be legalised in the country.

The Órban administartion has used Pegasus spyware in hundreds of cases, according to official reporting, targeting journalists, political opponents, and activists. Notably, German MEP Daniel Freund was a victim, leading to a lawsuit against the Hungarian government. The scale and scope of deployment illustrate systemic misuse and serious risks to political rights and privacy.

According to Whatsapp, Citizen Lab and IrpiMedia, Italian authorities used Paragon spyware to surveil journalists, political figures, and business executives. Reports indicate dozens of targets affected, with misuse extending beyond national security purposes.

At least tens of high-level officials, judges, and opposition figures were targeted with commercial spyware, including Pegasus and RCS Lab tools, reportedly deployed by Polish government agencies. The Polish Senate declared such use illegal in 2023, yet enforcement remains limited, and judicial proceedings are still ongoing, as well as a committee of inquiry.

Slovak authorities reportedly purchased Pegasus spyware, though public reporting does not detail specific targets or numbers, nor any use has been registered.

State authorities deployed Novispy and Cellebrite forensic extraction tools against journalists, human rights defenders, and opposition figures. At least 5 targets were affected, with the aim of monitoring activism and political dissent. Victims are being denied justice.

The spyware commercial market

The spyware market

The commercial spyware market has grown rapidly over the past decade. This market is now worth billions of euros, driven by the sale of these tools to governments, law enforcement agencies, and sometimes private actors.

Its growth is fueled by an ecosystem that combines technological sophistication with near-total opacity, allowing companies to operate across borders and evading accountability. This makes spyware a highly profitable yet extremely dangerous sector, where abuses remain hidden until uncovered by researchers or investigative journalists.

  • The global spyware industry is estimated to be worth on the order of 12 billion euros per year.
  • More than 80 governments have contracted commercial spyware, according to the UK’s cybersecurity agency.
  • Growing proliferation: in 2023, there were at least 49 distinct vendors, along with dozens of subsidiaries, partners, suppliers, holding companies, and hundreds of investors across the supply chain.
  • 56 of the 74 governments identified by the Carnegie Endowment procured commercial spyware from firms either based or connected to Israel.
  • The Israeli firm Paragon was
    acquired in 2024 by an investment firm in a deal worth up to
    900 million euros.

The vulnerabilities market

The buying and selling zero-day vulnerabilities is closely link to the spyware market, as these flaws allow spyware to bypass security protections and operate undetected.

The vulnerabilities market is dangerous because:

  1. It magnifies risk: A single zero-day can compromise millions of devices. Once a vulnerability is found, the risk is anyone can exploit it.
  2. It drives innovation in spyware: Spyware vendors continuously adapt their tools to exploit newly discovered vulnerabilities.
  3. It lacks accountability: Vulnerabilities are traded secretly, with minimal regulation, creating an ecosystem with no rules that poses a risk to all of us.
  4. Concentration multiplies risk: Many people are using only two OS (Android and iOS), and some apps are globally used (Whatsapp, Gmail…). Once someone breaks into one of these systems, they can have access to hundreds of millions of devices.
  • A 0-day vulnerability costs, via brokers, between 5 and 7 million dollars for exploits targeting iPhones; up to 5 million for Android phones; up to 3 and 3.5 million for Chrome and Safari respectively; and 3 to 5 million dollars for WhatsApp and iMessage. 
  • In 2024 the Google Threat Analysis Group reported that
    20 out of the 25 vulnerabilities found on their products (Android, Gmail), in 2023 were used by Spyware vendors to perform their attacks. 
  • As of June 2025, more than 21,500 new vulnerabilities had already been published (133 new vulnerabilities per day).

Even though at least 14 EU countries are reported to have used commercial spyware, regulation in Europe remains entirely absent. Apart from international initiatives like the Pall Mall Process, which seeks to curb spyware proliferation (but is insufficient and non-biding) no binding EU-wide legislation exists.

Technical Reports and investigations on particular spyware

Market reports:

Investigations and journalistic revelations.

 

Pall Mall Process

US Government executive order

 

The human rights effects of spyware

Spyware infringes on multiple fundamental rights, as highlighted in EDRi’s 2025 position paper. The rights most commonly affected are:

  • Right to privacy and data protection: the device infiltration and compromise exposes communications, location, and sensitive information.
  • Freedom of expression, association, and assembly: spyware targets journalists, activists and all types of people, creating a direct harm and a secondary chilling effect on civil society.
  • Rule of law and fair trial: unauthorized surveillance undermines rule of law and can affect judicial processes.
  • Collective security and democratic stability: widespread use of spyware erodes trust in institutions and democratic processes, and its market, as we’ll see, poses a big threat to our collective cybersecurity.

4. Terminology

  • Attack vector: a method or “way” used to deliver spyware to a target, such as malicious links, decep tive ads, physical access or a particular vulnerability.
  • Brute force: A method of circumventing security protections by systematically and automatically attempting all possible combinations of credentials, passwords, access codes, or other authentication factors until access to the device is gained.
  • Bug bounty: a bug bounty programme is a deal offered by websites, organisations, governments and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.
  • Commercial spyware vendors: private companies that develop and provide offensive cyber capabilities (enabling disruption or surveillance) for profit. They are also referred to as “commercial surveillance vendors” or “cyber mercenary firms”, which may offer a variety of surveillance technologies including (or not) spyware. Hence we use the specific term of “commercial spyware vendors” for the purpose of this paper in order to designate those among the industry that sell spyware as a commercial product.
  • Exploit: a segment of code or a program that maliciously takes advantage of vulnerabilities or security flaws in software, often used to install spyware.
  • Intrusion-as-a-Service: a commercial model in which private actors sell intrusion capabilities – including spyware – on demand.
  • Logging: the process of recording any activity on a device. Spyware often disables or avoids logs to make its presence and use undetectable.
  • Mandated encryption backdoor: a deliberately inserted vulnerability that allows third-party access to encrypted data – undermining trust and security for all users.
  • Remote access: the capability to monitor or control a device from afar, without direct physical contact with the device.
  • Telemetry: data collected by software or systems – such as location or usage stats – often repurposed for surveillance without clear user consent.
  • Vulnerability: a software vulnerability is a structural or design flaw present in a software application that can be exploited by attackers to compromise the security and functionality of the system, network or data with which it interacts.
  • Zero-days: security vulnerabilities that hackers can use to attack systems. The term “zero-day” refers to the fact that the vendor or developer is not yet aware of the flaw and therefore had “zero days” to fix it.

5. Contact us

Aljosa Ajanovic Andelic

Aljosa Ajanovic Andelic (He/Him)

Policy Advisor

E-Mail: firstname [dot] secondname [at] edri [dot] org
PGP: 0D52 2E7C 890B 02F4 5831 3EDB 41A4 E260 9190 2B32
Bluesky: @aajanovic.bsky.social