Second Italian journalist allegedly targeted with ‘mercenary spyware'

The Guardian

01-05-2025

A second Italian journalist whose news organisation exposed young fascists within the prime minister Giorgia Meloni's far-right party was targeted with sophisticated 'mercenary spyware', according to an Apple notification received by the reporter.
Ciro Pellegrino is the second reporter at the investigative news outlet Fanpage to fall victim to an alleged spyware attack, after his editor-in-chief, Francesco Cancellato.
Cancellato revealed in January that he had received a notification that he had been targeted with software produced by the Israel-based Paragon Solutions, a company that had a client relationship with the Italian government at the time.
Pellegrino is the sixth individual in Italy to have been subjected to spyware allegedly deployed by state actors, after Cancellato and four other civil society members and activists.
The others are Luca Casarini and Beppe Caccia, the Italian founders of the NGO Mediterranea Saving Humans, who are vocal critics of Italy's alleged complicity in abuses suffered by migrants in Libya; Father Mattia Ferrari, a chaplain on a migrant rescue ship owned by the NGO, who had a close relationship with Pope Francis; and David Yambio, an Italy-based human rights activist.
Pellegrino told the Guardian: 'On Tuesday evening I received a notification from Apple informing me that it had detected a mercenary spyware attack targeting my device. I couldn't believe it. I thought it was a prank. It's the first time anything like this has happened to me. It's a horrible feeling.
'Why have I been targeted? I've been asking myself that ever since the notification arrived. I will – and we will – ask that question publicly of anyone who has the authority and the duty to answer. An answer is owed … to everyone who has an interest in knowing who, in this country, has torn to shreds the clear boundary between security and surveillance, between legality and abuse.'
Pellegrino, who has been critical of Meloni's government on social media, contacted researchers at the University of Toronto's Citizen Lab, which tracks digital surveillance of civil society actors and helps to identify the kinds of spyware used in such attacks. Cancellato, Casarini, Caccia, Ferrari and Yambo were allegedly targeted with the military-grade Paragon software.
Citing a person familiar with the matter, the Guardian reported in February that Paragonhad terminated its client relationship with Italy.
It is not yet clear when Pellegrino's mobile phone was attacked or whether Paragon was used in his case. Like other spyware vendors, Paragon sells its cyberweapon to government clients who are supposed to use it to prevent crime. The company has said that under its terms of service, government clients are not permitted to target journalists or other members of civil society.
A Paragon spokesperson said: 'Paragon requires all users of our technology to adhere to terms and conditions that preclude the illicit targeting of journalists and other civil society leaders. While we are not able to discuss individual customers, we have a zero-tolerance policy for violations of our terms of service.'
In March during a classified meeting with Copasir, the Italian parliamentary committee for national security, Alfredo Mantovano, a cabinet undersecretary, admitted his government had approved the use of Paragon to spy on members of a humanitarian NGO because they were allegedly deemed a possible threat to national security.
Copasir is investigating whether the secret services breached the law in using Paragon Solutions to monitor activists and journalists, and is expecting to report on its findings soon.
John Scott-Railton, a senior researcher at the Citizen Lab, said he believed the Italian government, a confirmed former Paragon user, was 'in a good position' to know whether the spyware had been used to target Pellegrino because it would have kept logs of deployments.
'The Paragon affair is not over for Italy, and now is a critical moment for clear and transparent official communication,' Railton said.