- summary
- In early 2025 WhatsApp notified about 90 users that Paragon's Graphite spyware had targeted them, including Italian journalists and activists. Citizen Lab confirmed Graphite infections on the phones of Mediterranea's Luca Casarini and Beppe Caccia, and on the iPhone of Fanpage journalist Ciro Pellegrino. The parliamentary security committee COPASIR confirmed on 5 June 2025 that Italian intelligence had used Graphite against Casarini and Caccia, justifying it on national security grounds, including alleged facilitation of illegal immigration; it found no evidence of government use against Cancellato. Who targeted the journalists remains unestablished.
- country
- Italy
- date text
- 12/2024
- entities
- Italian intelligence services AISE/AISI (confirmed for Casarini and Caccia by COPASIR); operator against journalists unestablished
- entity type
- Security Apparatus
- id
- 1161
- name
- Italian intelligence services AISE/AISI (confirmed for Casarini and Caccia by COPASIR); operator against journalists unestablished
- role
- actor
- Luca Casarini and Giuseppe 'Beppe' Caccia of the migrant rescue NGO Mediterranea Saving Humans; journalists Francesco Cancellato (director) and Ciro Pellegrino (Naples bureau he…
- entity type
- CSO; Individual — Journalist
- id
- 1162
- name
- Luca Casarini and Giuseppe 'Beppe' Caccia of the migrant rescue NGO Mediterranea Saving Humans; journalists Francesco Cancellato (director) and Ciro Pellegrino (Naples bureau head) of Fanpage.it
- role
- target
- Italian intelligence services AISE/AISI (confirmed for Casarini and Caccia by COPASIR); operator against journalists unestablished
- sources
- citation
- https://www.amnesty.org/en/latest/news/2025/06/italy-new-case-of-journalist-targeted-with-graphite-spyware-confirms-widespread-use-of-unlawful-surveillance/
- url
- https://www.amnesty.org/en/latest/news/2025/06/italy-new-case-of-journalist-targeted-with-graphite-spyware-confirms-widespread-use-of-unlawful-surveillance/
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Security Apparatus Enforcement
- label
- Security Apparatus Enforcement
- code
- TC-20
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- channels
- Zero-click spyware (Paragon Graphite) via WhatsApp and iOS
- civic response
- Targets went public after WhatsApp notifications; Citizen Lab forensics and press reporting kept the case open. | Outcome: the agencies suspended and then terminated the Paragon contract; Paragon cut ties with Italy after the government declined its offer of an audit.
- consequence category
- Operational Suppression
- created at
- 2026-09-25T12:58:49.874898+00:00
- date precision
- month
- escalation
- 5
- harm track
- Track 3 — Operational Suppression
- id
- ITA-001
- institutional consequence
- Data seizure/exposure; Chilling effect; Surveillance of civil society justified by oversight body
- notes
- Coded Sep 25 2026. Date = period before WhatsApp's notifications (Jan 2025). State use confirmed by COPASIR only for the Mediterranea founders; do not claim state use against the journalists. Graphite, not Pegasus.
- occurred on
- 2024-12-01
- response ids
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T12:58:49.874898+00:00
- version
- 1
The public research collection