EU funds are flowing into spyware companies, and politicians are demanding answers
(2025/10/02)
- Reference: 1759406564
- News link: https://www.theregister.co.uk/2025/10/02/eu_spyware_funding/
- Source link:
An arsenal of angry European Parliament members (MEPs) is demanding answers from senior commissioners about why EU subsidies are ending up in the pockets of spyware companies.
The group of 39 politicians referred to recent investigations that revealed countries such as Italy, Greece, Hungary, and Spain have funnelled millions of taxpayer euros at a time to help support commercial spyware-makers' finances.
They wrote: "According to these findings, entities such as Intellexa, Cy4Gate, Verint and Cognyte – whose technologies have been linked to unlawful surveillance of journalists, human rights defenders and political actors in the EU, as well as in third countries with dreadful human rights records – have benefitted from public financing, including EU programmes.
[1]
"This raises serious questions about the governance, transparency, and accountability of the Union's funding mechanisms. In the light of the scandals uncovered in Italy, Greece, Poland, Hungary, and Spain, among others, and of the recommendations of the PEGA inquiry, it is deeply troubling that the Union is directly or indirectly enabling tools that erode democracy, fundamental rights, and the rule of law."
[2]
[3]
MEPs cited investigative journalism from [4]Follow The Money , which revealed in September that institutions such as Spain's public-funded Centre for the Development Of Industrial Technology (CDTI) handed over €1.3 million (c $1.5 million) to now-shuttered spyware peddler Mollitiam Industries.
Funding findings
According to FTM, EU science research program Horizon 2020 awarded €1.74 million (c $2 million) to projects that involved Innova, which supplied surveillance tools to Italian prosecutors' offices.
The European Regional Development Fund and the European Social Fund also funded Innova around €41,350, and the former additionally doled out around three-quarters of the money for a project run by Movia between 2019-2021, a company that develops the Spider spyware.
Various other EU programs have contributed funds to other spyware companies, such as Area, Memento Labs (formerly [5]Hacking Team ), and Negg Group, FTM claimed.
Perhaps most controversially, the European Commission awarded a €60,000 (c $70,500) contract to France-based Nexa Technologies in 2015. At the time, Nexa was part of the Intellexa Alliance of spyware companies, which in turn was linked to the Intellexa Consortium, which was previously sanctioned by the US for its involvement in the infamous [6]Predator spyware .
Likewise, Italy's state-owned bank, [7]Mediocredito Centrale , was found to have acted as a guarantor to a €2.5 million (c $2.9 million) loan to Dataflow Security, an Italy-based commercial spyware developer.
FTM said that it did not prove that any of the money, in any of the cases it found, was used to directly fund spyware development, although funding was provided in several instances.
The [8]letter addressed to senior commissioners Henna Virkkunen (Finland), Michael McGrath (Ireland), and Piotr Serafin (Poland) – who oversee tech, justice, and anti-fraud respectively – requested greater transparency over how EU funds were distributed, among other matters.
[9]
Various questions were raised by the MEPs, such as how the European Commission verifies the integrity of the entities that receive EU funds, whether any risk assessments are carried out before investments are made to spyware companies, and how much money in total has been awarded to these organizations.
They also asked for answers on how the Commission plans to ensure its funding mechanisms align with its stances on matters such as human rights and digital resilience, and why it has not implemented the recommendations made by the [10]PEGA inquiry .
The Register approached the European Commission for a response to the letter.
[11]
For the uninitiated, the PEGA inquiry was launched in 2022 following reports of several EU governments using [12]NSO Group's Pegasus spyware a year earlier, and three years after Saudi journalist [13]Jamal Khashoggi's murder .
The results were published in 2023, branding the pervasive spyware use "Europe's Watergate" and a "severe violation of all the values of the European Union."
The [14]report stated: "The spyware scandal is not a series of isolated national cases of abuse, but a full-blown European affair.
"EU Member State governments have been using spyware on their citizens for political purposes and to cover up corruption and criminal activity. Some went even further and embedded spyware in a system deliberately designed for authoritarian rule."
Among the main recommendations made by the PEGA committee were to restrict law enforcement's use of spyware only to exceptional cases, protect sensitive targets like politicians, lawyers, and doctors, and to set the conditions for legal use.
The 39 MEPs asked the European Commission to additionally commit to launching an immediate public review of EU subsidies flowing into spyware companies.
In that review, the politicians specifically requested details on all funds issued and awarded to spyware companies since 2015, a commitment to excluding all spyware vendors from future EU funding instruments, and a follow-up on the PEGA recommendations.
"Citizens of the Union have the right to know whether their taxes are being used to finance technologies that endanger their fundamental rights," they wrote.
[15]North Korea's Lazarus Group shares its malware with IT work scammers
[16]Google pushes emergency patch for Chrome 0-day – check your browser version now
[17]We're number 1! America now leads the world in surveillanceware investment
[18]Who watches the watchmen? Surveillanceware firms make bank, avoid oversight
"As Members of the European Parliament, we expect your full cooperation in ensuring accountability and restoring public trust."
Rebecca White, researcher and advisor on targeted surveillance at Amnesty Tech's Security Lab, said she and Amnesty support the letter, and highlighted the Commission's lack of communication on the matter.
She told The Register : "At Amnesty, we've documented for many years how spyware has enabled human rights abuses in Europe and beyond, and how the surveillance industry is under-regulated and thriving.
"The European Commission has remained silent. These latest allegations should alarm all of us.
"They suggest that not only is the EU failing to put out the fire, they're fanning the flames. We welcome this collective call for transparency and explanations – the Commission can no longer wash its hands of Europe's complicity in the spyware crisis, which is fuelling human rights abuses across the world."
Aljosa Ajanovic Andelic, policy advisor at European Digital Rights (EDRi), echoed the MEPs' request for a ban on spyware.
He said: "The lack of action by the Commission when it comes to spyware is appalling and dangerous. In fact, not only have they not done anything to stop the proliferation of shady spyware vendors in the EU, they actually used EU taxpayers' money to directly fund the industry. This has to stop, and we are calling for a full ban on commercial spyware in the EU."
"As the largest digital rights network in Europe, our position is firm: the use of spyware is inherently incompatible with fundamental rights, and therefore should be banned, as well as the market of private companies that are profiting from human rights violations." ®
Get our [19]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.ftm.eu/articles/spyware-industry-eu-subsidies-surveillance-concers
[5] https://www.theregister.com/2015/07/08/hacking_team_response/
[6] https://www.theregister.com/2024/09/17/predator_spyware_sanctions/
[7] https://youreurope.europa.eu/business/finance-funding/getting-funding/access-finance/en/content/mediocredito-centrale-spa
[8] https://x.com/HNeumannMEP/status/1973321519548997804/photo/1
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/05/09/pega_commitee_report/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/09/19/pegasus_spyware_met_police_complaint/
[13] https://www.theregister.com/2021/03/01/in_brief_security/
[14] https://www.europarl.europa.eu/doceo/document/A-9-2023-0189_EN.html#_section2
[15] https://www.theregister.com/2025/09/25/lazarus_group_shares_malware_with_it_scammers/
[16] https://www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
[17] https://www.theregister.com/2025/09/11/us_surveillanceware_investment/
[18] https://www.theregister.com/2025/09/02/commercial_surveillanceware_safe/
[19] https://whitepapers.theregister.com/
The group of 39 politicians referred to recent investigations that revealed countries such as Italy, Greece, Hungary, and Spain have funnelled millions of taxpayer euros at a time to help support commercial spyware-makers' finances.
They wrote: "According to these findings, entities such as Intellexa, Cy4Gate, Verint and Cognyte – whose technologies have been linked to unlawful surveillance of journalists, human rights defenders and political actors in the EU, as well as in third countries with dreadful human rights records – have benefitted from public financing, including EU programmes.
[1]
"This raises serious questions about the governance, transparency, and accountability of the Union's funding mechanisms. In the light of the scandals uncovered in Italy, Greece, Poland, Hungary, and Spain, among others, and of the recommendations of the PEGA inquiry, it is deeply troubling that the Union is directly or indirectly enabling tools that erode democracy, fundamental rights, and the rule of law."
[2]
[3]
MEPs cited investigative journalism from [4]Follow The Money , which revealed in September that institutions such as Spain's public-funded Centre for the Development Of Industrial Technology (CDTI) handed over €1.3 million (c $1.5 million) to now-shuttered spyware peddler Mollitiam Industries.
Funding findings
According to FTM, EU science research program Horizon 2020 awarded €1.74 million (c $2 million) to projects that involved Innova, which supplied surveillance tools to Italian prosecutors' offices.
The European Regional Development Fund and the European Social Fund also funded Innova around €41,350, and the former additionally doled out around three-quarters of the money for a project run by Movia between 2019-2021, a company that develops the Spider spyware.
Various other EU programs have contributed funds to other spyware companies, such as Area, Memento Labs (formerly [5]Hacking Team ), and Negg Group, FTM claimed.
Perhaps most controversially, the European Commission awarded a €60,000 (c $70,500) contract to France-based Nexa Technologies in 2015. At the time, Nexa was part of the Intellexa Alliance of spyware companies, which in turn was linked to the Intellexa Consortium, which was previously sanctioned by the US for its involvement in the infamous [6]Predator spyware .
Likewise, Italy's state-owned bank, [7]Mediocredito Centrale , was found to have acted as a guarantor to a €2.5 million (c $2.9 million) loan to Dataflow Security, an Italy-based commercial spyware developer.
FTM said that it did not prove that any of the money, in any of the cases it found, was used to directly fund spyware development, although funding was provided in several instances.
The [8]letter addressed to senior commissioners Henna Virkkunen (Finland), Michael McGrath (Ireland), and Piotr Serafin (Poland) – who oversee tech, justice, and anti-fraud respectively – requested greater transparency over how EU funds were distributed, among other matters.
[9]
Various questions were raised by the MEPs, such as how the European Commission verifies the integrity of the entities that receive EU funds, whether any risk assessments are carried out before investments are made to spyware companies, and how much money in total has been awarded to these organizations.
They also asked for answers on how the Commission plans to ensure its funding mechanisms align with its stances on matters such as human rights and digital resilience, and why it has not implemented the recommendations made by the [10]PEGA inquiry .
The Register approached the European Commission for a response to the letter.
[11]
For the uninitiated, the PEGA inquiry was launched in 2022 following reports of several EU governments using [12]NSO Group's Pegasus spyware a year earlier, and three years after Saudi journalist [13]Jamal Khashoggi's murder .
The results were published in 2023, branding the pervasive spyware use "Europe's Watergate" and a "severe violation of all the values of the European Union."
The [14]report stated: "The spyware scandal is not a series of isolated national cases of abuse, but a full-blown European affair.
"EU Member State governments have been using spyware on their citizens for political purposes and to cover up corruption and criminal activity. Some went even further and embedded spyware in a system deliberately designed for authoritarian rule."
Among the main recommendations made by the PEGA committee were to restrict law enforcement's use of spyware only to exceptional cases, protect sensitive targets like politicians, lawyers, and doctors, and to set the conditions for legal use.
The 39 MEPs asked the European Commission to additionally commit to launching an immediate public review of EU subsidies flowing into spyware companies.
In that review, the politicians specifically requested details on all funds issued and awarded to spyware companies since 2015, a commitment to excluding all spyware vendors from future EU funding instruments, and a follow-up on the PEGA recommendations.
"Citizens of the Union have the right to know whether their taxes are being used to finance technologies that endanger their fundamental rights," they wrote.
[15]North Korea's Lazarus Group shares its malware with IT work scammers
[16]Google pushes emergency patch for Chrome 0-day – check your browser version now
[17]We're number 1! America now leads the world in surveillanceware investment
[18]Who watches the watchmen? Surveillanceware firms make bank, avoid oversight
"As Members of the European Parliament, we expect your full cooperation in ensuring accountability and restoring public trust."
Rebecca White, researcher and advisor on targeted surveillance at Amnesty Tech's Security Lab, said she and Amnesty support the letter, and highlighted the Commission's lack of communication on the matter.
She told The Register : "At Amnesty, we've documented for many years how spyware has enabled human rights abuses in Europe and beyond, and how the surveillance industry is under-regulated and thriving.
"The European Commission has remained silent. These latest allegations should alarm all of us.
"They suggest that not only is the EU failing to put out the fire, they're fanning the flames. We welcome this collective call for transparency and explanations – the Commission can no longer wash its hands of Europe's complicity in the spyware crisis, which is fuelling human rights abuses across the world."
Aljosa Ajanovic Andelic, policy advisor at European Digital Rights (EDRi), echoed the MEPs' request for a ban on spyware.
He said: "The lack of action by the Commission when it comes to spyware is appalling and dangerous. In fact, not only have they not done anything to stop the proliferation of shady spyware vendors in the EU, they actually used EU taxpayers' money to directly fund the industry. This has to stop, and we are calling for a full ban on commercial spyware in the EU."
"As the largest digital rights network in Europe, our position is firm: the use of spyware is inherently incompatible with fundamental rights, and therefore should be banned, as well as the market of private companies that are profiting from human rights violations." ®
Get our [19]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.ftm.eu/articles/spyware-industry-eu-subsidies-surveillance-concers
[5] https://www.theregister.com/2015/07/08/hacking_team_response/
[6] https://www.theregister.com/2024/09/17/predator_spyware_sanctions/
[7] https://youreurope.europa.eu/business/finance-funding/getting-funding/access-finance/en/content/mediocredito-centrale-spa
[8] https://x.com/HNeumannMEP/status/1973321519548997804/photo/1
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/05/09/pega_commitee_report/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aN6hmW4KChDrPPUN0b_7FQAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/09/19/pegasus_spyware_met_police_complaint/
[13] https://www.theregister.com/2021/03/01/in_brief_security/
[14] https://www.europarl.europa.eu/doceo/document/A-9-2023-0189_EN.html#_section2
[15] https://www.theregister.com/2025/09/25/lazarus_group_shares_malware_with_it_scammers/
[16] https://www.theregister.com/2025/09/18/google_emergency_patch_chrome_0_day/
[17] https://www.theregister.com/2025/09/11/us_surveillanceware_investment/
[18] https://www.theregister.com/2025/09/02/commercial_surveillanceware_safe/
[19] https://whitepapers.theregister.com/
Yet Another Anonymous coward
But if they had official backdoors they wouldn't have to pay for all this spyware - it's a great saving to taxpayers
"Backdoors" Is Always Misdirection
Anonymous Coward
@Paul_Crawford
Quote: "...pushing for backdoors..."
I'm fed up with this type of misdirection.
NSO/Pegasus and Paragon/Graphite are dropped on a target, and then EVERYTHING on the target is available to the snoops IN PLAIN.
Note: Even if the user is using Signal. Signal only protects messages IN TRANSIT.
See: https://www.theregister.com/2025/08/21/apple_imageio_exploit/
Quote: "...the point of targeted operations is to make sure victims never notice..."
A wise user drafts plain text material OFF LINE. A wise user encrypts OFF LINE. A wise user use private encryption (see Daniel Bernstein for details).
Ditto for decryption.
So....everything on any network is encrypted with private encryption.....no plain text anywhere.
....hence the chatter about "backdoors" is moot!
Re: "Backdoors" Is Always Misdirection
Paul Crawford
Well one can discuss the nature of the path: a backdoor, an unsecured window, or a vent that can be crawled up, but the end result is largely the same. Unwanted entry.
The latest wheeze for "client side scanning" might not be a direct weakening of a cryptographic algorithm but it still weakens the cryptographic system. The acid test which shows the true nature is how it is not to be applied to politicians, etc, even when the plebs are assured it will only be used against bad people. I can think of at least one UK MP who was a paedophile so there is a good argument for applying it to MPs first.
Re: "Backdoors" Is Always Misdirection
Doctor Syntax
There's a good argument for applying anything to them before they foist it onto the rest of us.
Spy
elsergiovolador
By the way, it is very easy to catch a spy.
Just put a Nagra SN or Uher reel 2 reel machine and Beyerdynamic headphones in the park and watch them come.
"The European Commission has remained silent. These latest allegations should alarm all of us."
Would this be the same commission pushing for backdoors in to cryptography to "think of the children!!!" by any chance?