A new investigation by Inside Story reveals that, despite promises of oversight and accountability, the Greek government has yet to implement key measures required by Law 5002/2022. The law was introduced following public outrage over revelations that Greece’s National Intelligence Service (EYP) had used the Predator spyware developed by Intellexa in illegal surveillance operations. It was intended to establish clear rules governing the use of powerful surveillance tools by intelligence and law enforcement agencies. Yet nearly three years later, much of the regulatory framework remains unimplemented.
Law 5002, adopted in December 2022, laid out a legal foundation for the procurement and use of spyware by agencies such as Greece’s National Intelligence Service, the Hellenic Police, and the Counter-Terrorism Unit. Its provisions included mandatory oversight by the country’s independent privacy watchdog ADAE, the drafting of a list of spyware tools permitted for use, and the issuance of a presidential decree to formalize the process. It also required that public-facing information about spyware use be made available through EYP’s official channels.
However, reporting by journalist Eliza Triantafyllou shows that none of these steps have been completed as of mid-2025. The body responsible for drafting the list of spyware—the Coordination Committee on Cybersecurity—was only established after significant delays and has not delivered on its core mandate. In a June 2025 letter to ADAE, the committee’s chairman, Thanos Dokos, stated that compiling a list of specific spyware products was not possible. He cited the unpredictability of the surveillance tech market and the complexity of monitoring such tools as key obstacles.
At the same time, ADAE’s president, Christos Rammos, resigned upon the conclusion of his five-year term. Although Greek law requires that a new head of ADAE be appointed by Parliament’s Conference of Presidents, no replacement has yet been named. This leaves a crucial oversight body without leadership at a time when surveillance practices remain under scrutiny.
Responding to Inside Story’s questions, the Greek government said that the delays in applying the law were due to fast-evolving international cybersecurity challenges. It also noted that a draft presidential decree has already been submitted to the relevant authorities. According to government sources, the Coordination Committee is now operating in line with updated legal guidelines, and officials argue that describing the technical characteristics of spyware—rather than listing brand names—is sufficient for regulatory compliance.
The revelations add to growing concerns among journalists, human rights observers, and legal experts about the lack of transparency surrounding Greece’s surveillance apparatus. Despite passing a law that promised oversight, the country has yet to demonstrate how that oversight actually works in practice.
With key elements of Law 5002 still dormant, and with leadership gaps in essential institutions, the use of spyware by Greek authorities remains shrouded in secrecy—raising uncomfortable questions for a European democracy still grappling with the legacy of past surveillance scandals.
