Italian Spyware Probe Clears Intelligence Agency, Questions Remain
Rome, March 5, 2026 – An investigation into the use of the Pegasus-like spyware, Graphite, by Italian intelligence agencies has cleared the Internal Security Agency (AISI) of directly targeting journalist Francesco Cancellato, director of Fanpage.it. However, the probe continues into who may have been responsible for the unauthorized surveillance, raising questions about potential foreign involvement and the broader use of the controversial software.
The Investigation
The investigation was prompted by concerns over the simultaneous targeting of three individuals in December 2024: pro-migrant activists Luca Casarini and Giuseppe Caccia, and journalist Francesco Cancellato. AISI had previously acknowledged using Graphite to monitor Casarini and Caccia, citing legitimate efforts to combat migrant trafficking and operating with authorization from relevant authorities, including the Undersecretary of Security and the General Prosecutor’s Office of Rome. However, the agency denied any involvement in the surveillance of Cancellato, whose reporting had included investigations critical of the ruling Fratelli d’Italia party.
Prosecutors Sergio Colaiocco (Rome) and Claudio Onorati (Naples) conducted unannounced inspections at AISI headquarters, seeking computer logs to verify whether the agency’s Graphite server had been used to target Cancellato. According to a statement from the Prosecutor’s Office, the analysis of the server “did not allow us to detect traces of operations referable to Cancellato,” effectively confirming the agency’s denial.
Paragon and Potential Foreign Involvement
The investigation has focused on Paragon, the Israeli company that developed Graphite. Italian authorities have attempted to obtain information from Paragon regarding the software’s use, but the company has not responded to requests for information. Paragon has publicly stated that it only sells Graphite to state entities, including Italian security agencies.
If Paragon’s claim is accurate, the potential infection of Cancellato’s phone would have required the involvement of a foreign government or entity. The purpose of such surveillance remains unclear, and prosecutors continue to investigate.
Conflicting Reports and Technical Glitches
The investigation has been complicated by conflicting reports. “Intelligence sources” contacted by Ansa news agency suggested a possible technical glitch with Graphite in December 2024, which may have caused a temporary system failure and subsequent reactivation of all monitoring activities on December 14th. This could explain the simultaneous targeting of multiple individuals.
However, a report from the Parliamentary Services Control Committee (Copasir) indicates that institutional surveillance of Casarini ended in May 2024, while prosecutors determined that data was still being exfiltrated via Graphite as late as December 2024. This discrepancy raises further questions about the extent and duration of the surveillance operations.
Government Response
Undersecretary for Security Alfredo Mantovano has expressed confidence in the ongoing investigation and affirmed the full cooperation of Italian agencies with prosecutors. He stated the government awaits the investigation’s conclusions “with serenity.”
The investigation remains ongoing, with prosecutors continuing to seek the identity of those responsible for the attempted unauthorized access and interception of communications targeting Francesco Cancellato.