A prominent activist in Italy has informed the International Criminal Court (ICC) that his mobile phone underwent surveillance as he provided confidential information to the ICC about torture victims in Libya. The Citizen Lab at the University of Toronto has confirmed that David Yambio, the founder of Refugees in Libya, became a target of mercenary spyware at a time when he was in contact with The Hague. The attack took place around June 2024, according to researchers.
Yambio has alerted the ICC to the attack and urged court members to check their phones for spyware. The ICC’s Office of the Prosecutor did not comment on the matter as it relates to ongoing investigations.
This development raises concerns about whether a government agency, equipped with military-grade spyware, might have been attempting to interfere with ICC proceedings by tracking individuals who advocate for and provide information about torture victims. It will likely place pressure on Giorgia Meloni, Italy’s Prime Minister, who has faced scrutiny over the use of spyware in her government following revelations that several Italian activists and journalists received warnings from WhatsApp, indicating their phones had been targeted.
Meloni’s government has faced criticism for releasing a Libyan citizen, Osama Najim, who is wanted by the ICC for war crimes. Najim is the director of a detention center in Mitiga, Tripoli, accused of arbitrary detention, torture, and abuse.
The Citizen Lab report also reveals that several associates of Yambo, including two close friends of Pope Francis, were targeted by hacking software intended for use in investigations of terrorism and other serious crimes.
Researchers have not yet determined the exact type of spyware used against Yambio but continue their investigation. They have confirmed that the software targeting other activists was developed by Paragon Solutions, an Israeli surveillance technology company now owned by a US financial investor.
The Italian government has acknowledged its past client relationship with Paragon but denies being behind surveillance attacks on journalists and activists. Paragon has suspended its contract with Italy due to alleged breaches of its rules, which prohibit the use of spyware against journalists or civil society members.
WhatsApp revealed in January that 90 of its users, including civil society members and journalists, were targeted by government clients of Paragon. The spyware, called Graphite, can hack into phones and access messages and conversations, even those over encrypted apps like WhatsApp or Signal.
Apple notified Yambio of a possible attack in November, and his phone was examined by experts at Cyber Hub-AM and The Citizen Lab.
Apple confirmed the development of a fix to the security flaw exploited in the attack against Yambio, stating that attacks of this nature are “extremely sophisticated, cost millions of dollars to develop, and are used to target specific individuals because of who they are or what they do.”
The Citizen Lab investigation uncovered several other countries as potential Paragon clients, including Australia, Canada, Denmark, Cyprus, Singapore, and Israel.
Senior Citizen Lab researcher, John Scott-Railton, suggested that the revelation of new information about Paragon clients raises questions about the deployment of spyware, the use of gathered information, and compliance with domestic laws.
Paragon US Executive Chair, John Fleming, stated in response that the company has a limited understanding of the information provided and cannot offer a comment at this time. The company maintains a zero-tolerance policy for violations of its terms of service.
MEP Hannah Neumann, who investigated spyware abuse within the EU, highlighted the ongoing issue of spyware abuse in Europe, noting a pattern of denial, deflection, and lack of justice for victims. She advocated for stronger European rules and victim protection measures to address the issue.
Source: https://www.theguardian.com/world/2025/mar/19/italian-activist-david-yambio-alerts-icc-spyware-attack
