EU Parliament Faces Reckoning Over Spyware Targeting Its Own Members

The discovery, detailed by the University of Toronto’s Citizen Lab, marks the first time a member of the PEGA Committee—the body established to probe spyware abuses—has been publicly identified as a victim during their tenure. Forensic analysis shows the infection occurred in October 2022, coinciding with the committee’s intense investigation into the illicit use of surveillance tools across Europe. Further infections were tracked as recently as last year.

This incident has reignited criticism regarding the European Union's failure to implement the committee's 2022 recommendations. Amnesty International and a coalition of digital rights organizations labeled the breach a "rule of law emergency," arguing that current protections remain largely performative. Elina Castillo Jiménez of Amnesty’s Security Lab stated that the targeting of an elected official demonstrates a fundamental inadequacy in the system, noting that if an MEP is not safe from surveillance, the broader public remains entirely vulnerable.

While the European Parliament maintains that it provides cybersecurity screening tools for lawmakers, critics like former MEP Sophie in 't Veld argue that such measures have failed to break the legislative deadlock. With reports suggesting that even top-level officials, including Parliament President Roberta Metsola, have been targeted, researchers warn that the current lack of accountability invites further exploitation. John Scott-Railton of Citizen Lab cautioned that without immediate, tangible reform, the cycle of infections will continue, leaving officials to attend high-level meetings unaware that their devices are being turned into digital spies.