Paragon Solutions (Germany) GmbH has its registered address in Hamburg. It has been active since 24 July 2024, and its activities cover the “wholesale” and “information technology” sectors, according to the German business registry.
It is unclear what the full extent of the German company’s activities are, whether it has any local employees as the postal address points to a website offering virtual company offices, or whether it has had any contact with the German or other European states.
A Freedom of Information request submitted by Euractiv to the German Interior and Home Affairs Ministry did not reveal any communication between Paragon and the German state. However, the ministry said it was “not obliged to obtain information that is not yet available.”
Paragon did not immediately reply to Euractiv’s request for comment.
Recent targets
Last week, Meta announced that 90 users of its popular messaging app WhatsApp, were allegedly targeted by spyware from Paragon Solutions.
The affected individuals – journalists and members of civil society – were notified of a potential breach by WhatsApp, which said it had “high confidence” that they had been targeted and may have been compromised. This is the first public report of the deployment of Paragon’s technology.
The first individual to come forward as a target following the revelations was Francesco Cancellato, an Italian investigative journalist known for exposing young fascists in Prime Minister Giorgia Meloni’s party.
Subsequently, Husam El Gomati, a Sweden-based Libyan activist and outspoken critic of Italy’s involvement in Libya, also came forward.
Finally, Luca Casarini, the founder of the Italian NGO “Mediterranea Saving Humans,” who has been a vocal critic of Italy’s alleged complicity in the abuses suffered by migrants in Libya, was confirmed as a victim on Wednesday.
It is not clear where the rest of Paragon’s targets are based, but WhatsApp said they were in “more than two dozen countries, including in Europe.”
The Italian government, for its part, issued a statement on Wednesday denying the targeting and claiming that WhatsApp said that the users in question were based in no less than 13 EU member states (Austria, Belgium, Cyprus, Czech Republic, Denmark, Germany, Greece, Latvia, Lithuania, the Netherlands, Portugal, Spain, and Sweden), according to their country phone codes.
Paragon did not accept Italy’s explanation and decided not to reinstate access to the two Italian customers and to terminate all relations with the country with immediate effect.
Commission inaction
Paragon’s establishment in the EU and its targeting of European journalists and civil society come almost two years after a European Parliament inquiry committee (PEGA) revealed that several EU countries – including Greece, Spain Hungary, and Poland – had illegally purchased spyware to monitor journalists, activists, and political opponents.
The committee called for the adoption of EU-wide rules to prevent abuse. However, more than twenty months later, the European Commission has failed to propose any such legislation.
“The establishment of Paragon in an EU country is a troubling consequence of the European Commission’s failure to rein in the spyware industry and take decisive action against fundamental rights abuses, despite repeated calls from the European Parliament and civil society,” said Silvia Lorenzo Perez, Director of the Security, Surveillance and Human Rights Programme at CDT Europe, which is leading a civil society coalition to combat spyware abuse across the EU.
“The Commission’s inaction appears to be creating a pull factor, attracting surveillance firms that exploit the advantages of the single market to trade their tools within the EU with minimal oversight,” she added.
Europe: a hub for international hacking talent
Indeed, in recent months, places like Italy and Barcelona have emerged as major European hubs for the development of such technology, attracting international hacking talent who cite little oversight and tax benefits as reasons for moving.
Paragon’s establishment in Germany adds to this trend. The company was acquired in December 2024 by US private equity giant AE Industrial Partners for $900 million and hired WestExec Advisors, a lobbying firm with strong ties to the Biden administration, to advise on its approach to US and European markets.
“I think it shows that Paragon is looking to seriously establish itself in the EU market or that it is already established there. Business-wise it’s easier for compliance,” said Natalia Krapiva, Senior Tech-Legal Counsel at Access Now, a member organisation of the same coalition.
Being based in the EU allows seamless sales to EU member states. It also gives these companies access to EU export licences to third countries, such as the one Intellexa obtained from the Greek government to export Predator spyware to Madagascar.
“By setting up in the EU, these companies gain unrestricted access to the bloc and benefit from looser export controls, making it easier to sell their products abroad, clearly undermining global efforts to curb the proliferation of invasive surveillance technology,” Lorenzo Perez said.
The Commission’s own report on the implementation of the EU Dual-Use Regulation shows a staggering 94.78% increase in export licences for cyber-surveillance from 2021 to 2022.
“The longer the EU delays action, the greater the risk of becoming a safe haven for spyware companies,” Lorenzo Perez added.
The European Commission did not immediately reply to Euractiv’s request for comment.
[DE]
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,'script',
'https://connect.facebook.net/en_US/fbevents.js');
fbq('init', '307743630704587');
fbq('track', 'PageView');