The Italian founder of the NGO Mediterranea Saving Humans, who has been a vocal critic of Italy’s alleged complicity in abuses suffered by migrants in Libya, has revealed WhatsApp informed him his mobile phone was targeted by military-grade spyware made by the Israel-based company Paragon Solutions.
Luca Casarini, an activist whose organisation is estimated to have saved 2,000 people crossing the Mediterranean to Italy, is the most high profile person to come forward since WhatsApp announced last week that 90 journalists and other members of civil society had probably had their phones compromised by a government client using Paragon’s spyware.
The work of the three alleged targets to have come forward so far – Casarini, the journalist Francesco Cancellato, and the Sweden-based Libyan activist Husam El Gomati – have one thing in common: each has been critical of the prime minister, Giorgia Meloni. The Italian government has not responded to a request for comment on whether it is a client of Paragon.
Like other spyware vendors, Paragon sells its spyware to government agencies, who are meant to use it to track criminals. The company has said it sells its spyware only to democratic countries. It has declined to comment on WhatsApp’s allegation that its spyware was used to target journalists and activists residing in two dozen countries, some within Europe.
Under the Biden administration, Paragon agreed a $2m contract with US Immigration and Customs Enforcement (ICE), but the deal was put on hold after questions were raised about the arrangement’s compliance with an executive order that restricted the use of spyware by the federal government, in case its use represented a “significant counterintelligence or security risk”.
The executive order has not been rescinded by the Trump administration.
Neither Paragon nor ICE commented on the status of the contract.
Paragon has a US office in Chantilly, Virginia. John Fleming, a former CIA veteran, is executive chair of Paragon US.
For now, the focus is on whether Italy has used the spyware.
“It has become clear; Italy has a Paragon problem. Given the cases that have already quickly come forward, it’s time to ask: who was the customer? And how far do these cases go?,” said John Scott Railton, a senior researcher at the Citizen Lab at the University of Toronto, which tracks digital surveillance of civil society.
A person close to Paragon declined to comment on the identify of its clients but said it “would not deny” that Italy was a client.
Casarini has been a prominent activist figure in Italy for decades, but in an interview with the Guardian said his primary focus was now the maritime rescue NGO he founded in 2018. He was on a train heading to Bologna, he said, when he got a “ping” on his phone from WhatsApp. He joked that he initially wondered why Mark Zuckerberg – whose Meta owns WhatsApp – was messaging him. He was one of 90 people to get the alert that he had been targeted by an unknown assailant using military-grade spyware.
When Paragon’s hacking software, which is called Graphite, successfully infects a phone, it can access all its information, including encrypted messages sent via Signal and WhatsApp. WhatsApp has said targets were added to chat groups and sent malicious PDFs. They did not need to click on anything to be infected, it would have happened automatically, experts say.
“This is a war against solidarity, activism, against helping migrants,” he said, adding that he was already facing a trial for alleged “illegal” aid to migrants.
While he was surprised at the severity of the alleged surveillance attempt against him, Casarini also expressed defiance.
“I want that them to know that they can find me. But I can also find them. We can organize to defend ourselves, to protect ourselves against authoritarian activity,” he said.
Recently, he has spoken out against the Italian government’s decision last month to allow a Libyan general accused of war crimes and wanted by the international criminal court, Osama Najim, to return home on an Italian secret service flight, in what critics have said was an attempt to shield alleged abuses committed in Libya in connection to the country’s migrant pact with Italy.
WhatsApp has not publicly identified how long the targets may have been under surveillance. The targeting was discovered in December and was then shut down.
