Over the past several days, Greece’s high-profile trial into illegal surveillance using the Predator spyware has entered a particularly revealing phase, with testimony and judicial decisions shedding light on how the system allegedly operated, who may have benefited from it, and how it was financed.
At the centre of recent proceedings was the testimony of investigative journalist Tasos Telloglou, a senior reporter with Inside Story and Greece’s ANT1 television network. Appearing at the 23rd hearing, Telloglou told the court that Predator was not used in a limited or incidental manner, but rather functioned as what he described as “a system for controlling the machinery of government.” According to his account, surveillance extended beyond individual targets to include ministers and other key figures, suggesting a coordinated operation with deep institutional reach.
Telloglou outlined the business and personal connections linking the defendants in the case: Yiannis Lavranos, described as the real force behind the private security company Krikel; Felix Bitzios; Tal Dilian; and Sara Hamou, the latter three associated with the Intellexa group, which developed and marketed Predator. He testified that Bitzios had known Lavranos since at least 2018 and that, through these ties, both men had access to Grigoris Dimitriadis, then secretary general to the Greek prime minister and one of the most powerful figures in the prime minister’s office.
Asked whether surveillance material could have reached Dimitriadis, Telloglou said that Greece’s National Intelligence Service routinely briefs political leadership on surveillance findings. He added that the intelligence service’s former head, Panagiotis Kontoleon, was fully aware of what was taking place. In his view, it would have been implausible for Dimitriadis, whom he described as highly capable, to carry out his role without knowledge of the monitoring.
The journalist also told the court that intercepted material from surveillance operations ended up in the hands of Lavranos, and that copies of intelligence data were physically transferred from the intelligence service to Krikel’s offices, allegedly by police officers acting as couriers. While he said he had personally seen surveillance material and elements of the Predator system in use, he stressed that decisions about who would be targeted were made within Greece.
Telloglou explained that his investigation into Predator began with the discovery of hundreds of malicious internet domains used to infect targets’ devices. Together with fellow journalist Eliza Triantafyllou, he identified 310 such domains, 42 of them using Greece’s national “.gr” suffix, a concentration he said was highly suspicious given the country’s relatively small internet footprint.
His testimony also touched on the international dimension of the Predator affair, focusing in particular on the export of related surveillance technology to Sudan. Telloglou described the case as emblematic, noting that while the exported system was not the full Predator package, it was capable of extracting data from Wi-Fi networks. According to his account, the technology ultimately reached a militia linked to Sudan’s powerful Rapid Support Forces, with evidence pointing to the United Arab Emirates as the likely source of financing. The testimony was framed against the backdrop of Sudan’s ongoing civil war and documented atrocities against civilians.
Following Telloglou’s appearance, the court ordered the compulsory attendance of two senior Krikel executives as witnesses at a hearing scheduled for early January, signalling a tightening focus on the company’s internal role.
The following hearing, the 24th and final session of 2025, produced another major development. Judges ordered the full transaction history of a prepaid Mastercard allegedly used to finance the sending of Predator-infected text messages. The card was issued by the National Bank of Greece in the name of Emilios Kosmidis, a private individual who testified that he had no involvement in the operation.
Prosecutors argue that the card was used to pay for SMS messages containing malicious links sent to opposition leader Nikos Androulakis and at least 25 other people. Until now, investigators had examined only a narrow window of transactions in September 2021. The court’s decision to request the complete transaction record aims to clarify who controlled the card and how the spyware campaign was funded.
Evidence presented to the court shows that the card was topped up with 500 euros at an ATM in the Athens suburb of Aghia Paraskevi, located close to a facility of Greece’s National Intelligence Service. Payments from the card were then made to an SMS service provider during the period when the spyware messages were sent.
Kosmidis denied activating or using the card, claiming it had been sent to him years earlier as a promotional gift and that he later lost track of it. He said he only learned of its alleged role in the Predator affair after being contacted by a journalist, and that repeated attempts to obtain transaction records from the bank were unsuccessful. The presiding judge warned him explicitly that he could face criminal charges if he failed to provide convincing evidence of non-involvement, stressing that the card registered in his name had been used in a serious illegal operation.
His account was challenged by lawyers for the civil claimants, who cited official bank statements indicating that such prepaid cards were issued in person, already activated, and only after identity verification, contradicting Kosmidis’ claims. Despite these contradictions, he stood by his testimony.
Together, the hearings of the past days have painted an increasingly detailed picture of an alleged surveillance network that combined private companies, intelligence structures and political power, while also highlighting unresolved questions about responsibility, funding and oversight. With further witnesses expected in early 2026, the trial appears to be moving toward a more direct examination of how Predator was deployed and who ultimately controlled it.
