By Raphael Satter and Christopher Bing
BRUSSELS/WASHINGTON - (Reuters) - Senior officials at the European Commission were targeted last year with spy software designed by an Israeli surveillance firm, according to two EU officials and documentation reviewed by Reuters.
Among them was Didier Reynders, a senior Belgian statesman who has served as the European Justice Commissioner since 2019, according to one of the documents. At least four other commission staffers were also targeted, according to the document and another person familiar with the matter. The two EU officials confirmed that staffers at the commission had been targeted but did not provide details.
The commission became aware of the targeting following messages issued by Apple (NASDAQ:AAPL) to thousands of iPhone owners in November telling them they were "targeted by state-sponsored attackers," the two EU officials said. It was the first time https://www.reuters.com/technology/how-saudi-womans-iphone-revealed-hacking-around-world-2022-02-17 Apple had sent a mass alert to users that they were in government hackers' crosshairs.
The warnings triggered immediate concern at the commission, the two officials said. In a Nov. 26 email reviewed by Reuters, a senior tech staffer sent a message to colleagues with background about Israeli hacking tools and a request to be on the lookout for additional warnings from Apple.
"Given the nature of your responsibilities, you are a potential target," the staffer said in the email, reviewed by Reuters.
Reuters was unable to determine who used the Israeli spyware to target Reynders and his Brussels-based colleagues, whether the attempts were successful, and, if so, what the hackers might have obtained as a result.
Reynders and his spokesman David Marechal did not return repeated messages. European Commission spokesman Johannes Bahrke declined comment. Apple declined comment.
Security researchers have said the recipients of the warnings were targeted between February and September 2021 using ForcedEntry, an advanced piece of software that was used by Israeli cyber surveillance vendor NSO Group to help foreign spy agencies remotely and invisibly take control of iPhones. A smaller Israeli spyware vendor named QuaDream also sold a nearly identical tool to government clients, Reuters previously reported https://www.reuters.com/technology/exclusive-iphone-flaw-exploited-by-second-israeli-spy-firm-sources-2022-02-03.
NSO said in a statement that it was not responsible for the hacking attempts, saying the targeting described by Reuters "could not have happened with NSO's tools."
The company, which faces a number of overlapping lawsuits and was recently blacklisted by U.S. officials over alleged human rights abuses, said it supported an investigation into the targeting and called for the establishment of global rules to govern the spyware industry.
QuaDream, which keeps a lower profile, did not return repeated messages.
IT experts examined at least some of the officials' smartphones for signs of compromise but the results were inconclusive, according to the two EU sources, who spoke on condition of anonymity because they weren't authorized to speak to the press.
Reuters has not been able to determine whether the commission is still investigating the matter.
News of the targeting comes as the European Union is beginning to follow the United States in taking a harder look at spyware merchants like NSO.
The European Parliament is set to launch a committee of inquiry to investigate the use of surveillance software in European member states on April 19, according to Sophie in 't Veld, the EU lawmaker who championed the committee's creation.
In 't Veld told Reuters she had been unaware that European Commission officials were targeted, calling the news "dynamite."
"We really have to get to the bottom of this," she said.
The committee was formed in the wake of reports that senior opposition politicians in Poland had their phones hacked with Israeli spyware and that prominent critics and investigative journalists in Hungary had also been targeted.
Polish officials and a Hungarian ruling party lawmaker have acknowledged that their respective governments purchased NSO software, although both nations have denied wrongdoing in relation to allegations of domestic espionage.
It was important not to jump to conclusions about who might be responsible, said Kenneth Lasoen, a research fellow at the Clingendael Netherlands Institute of International Relations.
The EU “are a very high profile target for multiple actors,” Lasoen said. “Brussels is a true nest of espionage.”