Citizen Lab published the first forensic confirmation of Paragon's mercenary iOS spyware Graphite on June 12, 2025, developed by the Israeli company Paragon, documenting the targeting of journalists and migrant activists in Italy. The Italian government and its external intelligence service admitted to using Paragon products after initial denials, with a parliamentary intelligence oversight committee confirming in June 2025 that at least two migrant activists were among the targets. The case marks a turning point in the technical verifiability of a spyware market that has diversified beyond NSO Group.
- Citizen Lab, University of Toronto, published the report "Graphite Caught First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted" on June 12, 2025, authored by Bill Marczak and John Scott-Railton.
- The Graphite spyware, developed by Israeli firm Paragon, represents the first forensic confirmation of this vendor's mercenary iOS spyware operating against civilian targets in Italy.
- Journalists and migrant activists were identified as targets: approximately 90 people were notified in late January 2025 of probable targeting with Graphite in 2024, and in March 2025 Citizen Lab forensically confirmed an additional Italian migrant activist as a target.
- The parliamentary intelligence oversight committee confirmed in June 2025 that the Italian government used Graphite against at least two identified migrant activists, forcing an admission after initial denials.
The Technical Proof That Forced the Government Admission
Citizen Lab's forensic research surpassed the threshold of mere reporting. The June 12, 2025 report documents the first technical confirmation of Paragon Graphite on iOS devices, with an explicit title: "Graphite Caught First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted." Authors Bill Marczak and John Scott-Railton traced an evidentiary path that made institutional denial unsustainable.
In February 2025, The Guardian reported that a journalist and two migrant activists were among the approximately 90 people notified of probable targeting with Graphite in 2024. In March 2025, Citizen Lab identified an additional Italian migrant activist with a device confirmed as targeted using Graphite. This progression — from mass notifications to individual forensic confirmation — built a chain of evidence that the parliamentary intelligence oversight committee validated in June 2025, confirming government use against at least two migrant activists.
"Graphite Caught First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted" — Bill Marczak and John Scott-Railton, The Citizen Lab at the University of Toronto, June 12, 2025
Paragon and the Diversification of the Spyware Market Beyond NSO Group
Paragon Solutions is an Israeli company operating in the mercenary spyware segment for governments and intelligence agencies. Citizen Lab's forensic confirmation documents that the market has structurally diversified: Paragon is not an epiphenomenon of NSO Group but an independent actor with comparable technical capabilities, at least in iOS targeting.
The significant finding is not merely Graphite's existence, but its forensic detectability. Citizen Lab extracted concrete evidence from compromised iOS devices, demonstrating that alternative vendors to NSO Group also leave identifiable technical traces. This has implications for the global market: the assumption that smaller or less-documented actors operate with technical impunity collides with the reality of academic forensic research.
The Denial Mechanism and Parliamentary Pressure
The Italian government and external intelligence service admitted to using Paragon products but initially denied surveillance of journalists and activists. The sequence is significant: the admission came only after the convergence of three pressure lines — the mass notification of approximately 90 people, Citizen Lab's forensic confirmation, and parliamentary questioning.
The intelligence oversight committee operated as a second-degree verifier, confirming in a parliamentary setting what the government source had previously denied. This delay between denial and confirmation measures the fragility of democratic oversight mechanisms over intelligence operations, in a context where commercial surveillance technology is acquired under contractual secrecy that evades public debate.
The Decline in Freedom House Score and the Italian Regulatory Context
Freedom House recorded the consequent deterioration: Italy's internet freedom score declined in the state surveillance category, dropping from 3 to 2. This downgrade is not a rhetorical assessment but a quantitative penalty based on verifiable events, with direct citation of the Citizen Lab report in Freedom House documentation.
The Italian regulatory context of the period broadens the reading without conflating facts. In the same timeframe, the Italian Data Protection Authority fined OpenAI approximately 15 million euros for GDPR violations, and the Piracy Shield mechanism imposed IP blocks with maximum 30-minute timelines, generating incidents such as the temporary blocking of Google Drive. These events, documented by the context sources, outline an Italian digital ecosystem characterized by rapid regulatory interventions and broad administrative powers, with oversight that often intervenes ex post.
Why This Matters
The dossier does not specify the exact forensic techniques employed by Citizen Lab to detect Graphite, nor the initial infection vector. No public indicators of compromise emerge, nor details on the specific role of the external intelligence service relative to other apparatuses. The source does not document government contracts, amounts, or specific legal authorizations for Paragon's acquisition.
The brief does not specify whether Graphite is present in other countries beyond Italy, nor the status of notifications to the remaining targets among the approximately 90 people initially alerted. No infrastructural overlap emerges linking Paragon to NSO Group or other documented Israeli vendors. On the exact extent of targeting, the dossier documents point forensic confirmations but does not quantify whether the campaign is limited to the identified cases or encompasses a broader universe.
What the dossier documents is nevertheless unequivocal: a democratic European Union government used mercenary spyware against journalists and civilian activists, denied the operation, and was forced into admission by a combination of technical notifications, academic research, and parliamentary oversight. This sequence defines a paradigm of hybrid accountability, where democratic control functions only when independent research generates incontrovertible evidence.
Frequently Asked Questions
Is Graphite technically similar to Pegasus?
The dossier does not specify Graphite's techniques, vectors, or architecture in comparison to Pegasus. The source documents only the forensic existence of the product and iOS targeting, without implementation details.
Were all 90 notified individuals confirmed as actual targets?
No. The approximately 90 notifications in late January 2025 concerned probable targeting in 2024. Citizen Lab forensically confirmed individual cases subsequently, but the dossier does not document mass forensic confirmation for the entire group.
Did the Italian government admit to spying on journalists?
The parliamentary confirmation in June 2025 explicitly concerns at least two migrant activists. The dossier does not document an equivalent government admission regarding the journalists identified as targets, despite the Citizen Lab report's title.
Information is based on the cited advisory and current as of publication.
Sources
- https://freedomhouse.org/country/italy/freedom-net/2025
- https://thehackernews.com/2024/12/italy-fines-openai-15-million-for.html
- https://www.techradar.com/vpn/vpn-privacy-security/italy-to-require-vpn-and-dns-providers-to-block-pirated-content
- https://www.techradar.com/vpn/vpn-privacy-security/italy-to-require-vpn…
- https://freedomhouse.org/reports
- https://freedomhouse.org/report/freedom-world
Information is based on the cited source and current as of publication.