View from Brussels: Pegasus wings clipped
The EU is cracking down on data privacy breaches and this week moved a step closer to banning the controversial Pegasus spyware. It risks upsetting intra-EU relations even further.
Last year, it emerged that the Israeli-developed Pegasus spyware has been used by national governments within Europe to snoop on activists, journalists and politicians, in what was a clear breach of privacy principles.
Originally designed to combat terrorism, Pegasus has since been used to hack into phones, listen to conversations and download photos of everyday people. Heads of state and military officials have also been targeted.
This week, the European data protection supervisor (EDPS) - the EU’s cyber watchdog - said that Pegasus should be banned because it is “incompatible with our democratic values”, given its ability to spy undetected through smartphone cameras, microphones and so on.
“The mounting evidence shows that highly advanced military grade spyware like Pegasus has the potential to cause unprecedented risks and damages not only to the fundamental freedoms but also to democracy and the rule of law,” the EDPS report warns.
It adds that a full ban on the spyware should be the course of action taken and confirms that a number of the EU’s 27 member states have reportedly purchased and used Pegasus in the past. Hungary and Poland are thought to be among the spyware’s clients.
The Pegasus revelations last year, coupled with the EDPS findings, have prompted EU policy-makers and politicians to demand action against both the firm that developed it and the governments that contracted its services.
A majority of members of the European Parliament are now in favour of launching a full-blown inquiry into the scandal, which will probably oblige government officials to give evidence in front of EU lawmakers sometime in the future.
The European Peoples’ Party group, the largest in the Parliament, has already announced its own fact-finding mission to Poland to investigate the claims of spying in situ. The trip is scheduled for early March.
“It is crucial that such technology is not used illegally or arbitrarily. The disturbing examples in Poland and Hungary are appalling,” said EPP civil liberties spokesman Jeroen Lenaers, who also criticised the “flagrant violation of key democratic principles”.
“The illegal tapping of political opponents and journalists is not only against EU law; it is also against fundamental EU values,” he added.
At an MEP debate in Strasbourg on the issue, French minister Clement Beaune said that “the use of surveillance software can only be the exception. This kind of surveillance constitutes such a severe intrusion into private life that it can only be used under the strictest conditions."
France currently chairs EU Council meetings and will set the agenda for the next six months, so Paris is well placed to keep spyware matters high up the list of priorities.
EU justice commissioner Didier Reynders also urged governments to broker an agreement on the e-Privacy Directive, a long-pending set of rules that are designed to govern these issues. However, national interests and MEPs have clashed frequently during talks.
It is ultimately the responsibility of governments to investigate data breaches and malpractice, so for the moment the EU’s power to punish any guilty parties is limited. But Reynders insists “the EU will act” if it suspects national authorities are not doing their job.
This is where relations between the institutions in Brussels and national capitals could be stretched even further.
Ties with the likes of Hungary and Poland are already frosty, as disputes over rule of law fundamentals, access to pandemic-recovery funds and even energy policy continue to be a daily occurrence.
Indeed, Hungary’s data regulator says that Pegasus can be used if it is a matter of national security. The law that governs that issue has been contested by EU officials, so any inquiry into the spyware is almost certain to kick the hornet’s nest a bit.
It is probably in everyone’s best interests if the looming investigation casts as wide a net as possible, as there are strong indications that Hungary and Poland are not alone and that other countries were at least in the early stages of becoming Pegasus clients.
Both Budapest and Warsaw have played the victim card a lot: whether it is Polish officials buying billboards to blame the spike in energy prices on EU climate policies or Hungarian politicians ranting that Brussels bureaucrats want to replace everyone with migrants.
An inquiry as important as this needs to steer clear of an ‘us vs them’ narrative that (perhaps) guilty government leaders will be all too keen to publicise.
Sign up to the E&T News e-mail to get great stories like this delivered to your inbox every day.