Italy’s foreign intelligence agency, AISE, has temporarily suspended the use of Israeli cyber firm Paragon’s spyware following a high-profile hacking scandal involving an investigative journalist. The revelation, first reported by Haaretz, has intensified scrutiny over the use of surveillance technology by Italian authorities and strained relations with Israel, a close ally in intelligence cooperation.
Paragon’s spyware, known as Graphite, was reportedly used by two Italian clients: AISE and the national police. However, according to Haaretz, only the foreign intelligence service—seen as the prime suspect in the hacking affair—has been blocked from using the spyware. The freeze comes as Italian lawmakers hold hearings with intelligence chiefs before a special parliamentary committee investigating the breach.
The controversy erupted after WhatsApp disclosed a cyberattack that affected around 100 users, including journalists and social activists. One of the victims, Italian investigative journalist Francesco Cancellato, confirmed that his phone had been targeted after receiving a warning from WhatsApp. Cancellato is known for his reporting on the ties between Italian Prime Minister Giorgia Meloni’s party and neo-fascist movements, sparking suspicions that the surveillance was politically motivated.
Other victims include an Italian immigrant aid activist and two refugees from Sudan and Libya, raising further concerns over potential human rights violations. While the Italian government has denied any involvement in the journalist’s surveillance, it admitted that several phones with Italian numbers had been targeted. Authorities have hinted that another Paragon client could be responsible for the alleged misuse.
Paragon, which markets itself as a human rights-focused company with technology aimed at combating terrorism and serious crime, has cut off Italy’s access to its spyware pending the investigation, according to reports from Haaretz and The Guardian. The Israeli Ministry of Defense, which regulates spyware exports, has declined to comment on whether it will revoke Italy’s export license following the incident.
This marks the first time Paragon has faced allegations of abuse related to its spyware. The company has demanded that Italian authorities clarify whether there was a violation of the software’s terms of service.
The case also casts a shadow over the historically close intelligence relationship between Italy and Israel. In a separate incident two years ago, a Mossad agent and two Italian intelligence officers died when a boat capsized on Lake Maggiore, reportedly after an Iran-linked operation.
Meanwhile, Italy’s tough stance on immigration has added another layer of complexity. According to Il Giornale, one of the alleged hacking victims, refugee David Yambio, was suspected of involvement in a criminal network facilitating illegal immigration—an accusation that could allow authorities to justify lawful interception. However, in the case of Cancellato, there appears to be no legal justification, fueling speculation of politically motivated espionage.
“I mistakenly believed I lived in a democratic country where journalists weren’t spied on,” Cancellato told Haaretz. “They could have admitted someone went rogue or that a foreign entity was responsible. Instead, they chose silence.”
Paragon is reportedly awaiting the outcome of both the Italian parliamentary investigation and a separate inquiry by the country’s national cyber authority before deciding on any future cooperation with Italy.
