We have decided to publish, through reports, all the information that will reach us from the team of experts that is conducting the civil investigation on the phones of our activists, on which the military espionage activity summarized under the name "Paragon case" has been detected. The Italian government has opposed the “Secret of State” to the legitimate questions that the Parliament in the first place, but also all of us and the public opinion, address to know who authorized such an activity, detrimental to constitutional rights and freedoms, and in violation of international conventions, spying on journalists, activists, refugees, and above all, with what motives. We contrast state secrets with sharing and transparency. As in the case of Almasri, which showed the nature of relations with Libya and the cost of innocent lives, the truth will prevail over omerta and lies. This is only the beginning.
SPYING ACTIVITY WITH USE OF THE WORM “GRAPHITE” MANAGED BY PARAGON SOLUTIONS AND IN USE BY THE ITALIAN GOVERNMENT.
Civil investigation in cooperation with THE CITIZEN LAB – University of Toronto
REPORT .01
The analysis of the mobile phone used by Mr Luca Casarini, Italian citizen, Co-founder and Head of mission of Mediterranea Saving Humans, has revealed that in the month of February 2024, thus many months before the identification of the worm Graphite, an entity not yet identified, has carried out a software attack of a “sophisticated” type, with an attempt to force Luca Casarini's accounts, and of which the Meta company has notified. The attack, which has been identified and on which qualitative analysis is being carried out to identify (“tracing”) was most likely carried out according to a precise methodology, a protocol for the construction of what is classically called a “chain of surveillance,” which has as its final outcome the transition from a “spyware” to the more sophisticated military tool “Graphite.”
The civilian investigation, at this first stage, focuses on the detection of two steps involving the attempted compromise of the victim's profile dating back to February 2024 and communicated since the 8th of the same month. The aim of these operations is generally to establish contact with people close to the target, in this case Luca Casarini, through a false profile created using social engineering techniques, sending false communications through messaging platforms including e-mail. The purpose of this activity can range from obtaining sensitive information to targeting individuals with malware to monitor their devices. The analysis of the cyber espionage attack suffered by Luca Casarini in February 2024 can reveal very interesting details about the source, even going as far as to identify the private company to which this type of operation was entrusted. And therefore the possible client.
On the other hand, the presence of Graphite, detected in the victim's phone as early as November 2024 and communicated to the person concerned on January 31, 2025, after careful verification by the Meta company, leaves no doubt that only government agencies are involved. But identifying the origin of this first step in February 2024, the construction of the surveillance infrastructure by means of spyware, is also very important in order to define with certainty the aspects of the operation against Luca Casarini as a whole.
According to the Citizen Lab experts, the type of attack suffered in February 2024 "should be taken very seriously, which is why special attention should be paid to it in the civilian investigation. The presence of this type of attack generally signals that a government is watching you and wants to extend control to people close to you. In this case, it was very good that Meta alerted you, first through Facebook and then through Whatsapp.
We can say that we are holding two pieces of a puzzle that will turn out to be much bigger than we think”.
