Suing spyware in Europe: news from the front! (39c3)

In 2022, CitizenLab contacted a member of the Spanish non-profit Irídia to tell them that one of their members had likely been hacked with Pegasus spyware. The target, a lawyer, had been spied on by the Spanish government in 2020 because he represented a Catalan politician who was in prison. His phone was infected with Pegasus during the COVID-19 lockdown, on the same day he was having an online meeting with other lawyers working on the case. Irídia and the lawyer (Andreu) decided to take the case to court. A few years later, he met with Data Rights and invited them to join forces and bring in partners from across Europe to increase the impact. This collaboration led to the creation of the PEGA coalition in May 2025. This talk goes over the status of the case and work we have done across Europe to bring spyware use in court. Despite the European Parliament’s PEGA investigation in 2023, spyware scandals in Europe continue to grow, with little real action to stop or address them. Many EU countries were — or still are — clients of the world’s major spyware companies. As a result, nothing changes except the number of victims targeted by these technologies. Worst, offices or clients in the EU is useful for spyware companies' sales pitch. So, the EU is a growing hub for this ominous ecosystem! With no real political will to act, members of the PEGA investigation say the only hope for change is to take these cases to court — and that’s exactly the path we’ve chosen! Irídia’s case is one of the flagship cases in the EU, both for its depth and for what it has achieved so far. We will review the current status and implications of the case, examining issues that range from state responsibility to the role of the spyware company behind Pegasus — in its creation, sale, and export — which maintains a strong presence within the EU. After that, we will take a step back to look at what is happening across Europe. We will highlight the most significant cases currently moving forward, as well as some of the PEGA coalition’s strategies for driving accountability, strengthening safeguards, and ensuring remedies. The coalition’s mission goes beyond legal action — it aims to prevent the devastating impact of spyware and push for systemic change. Licensed to the public under http://creativecommons.org/licenses/by/4.0 about this event: https://events.ccc.de/congress/2025/hub/event/detail/suing-spyware-in-europe-news-from-the-front