The material was submitted to the court record by lawyers supporting the prosecution and quickly became the focal point of a heated legal confrontation. On trial are Greek nationals Giannis Lavranos and Felix Bitzios, along with Intellexa executives Tal Dillian and Sara Hamou.
The controversy centers on three documents, two of which are presented as commercial offers issued by Intellexa for surveillance platforms known as Helios and Nova, dated April 5 and July 1, 2022 respectively. The Helios system is widely reported to be a rebranded version of Predator, a piece of spyware that has been linked to illegal surveillance cases in several countries. The third document is a nine-page Intellexa price list dated February 18, 2021, which was previously published by The New York Times. According to the newspaper, that offer was directed at a Ukrainian intelligence service.
Based on testimony and documents submitted by investigative journalist Eliza Triantafyllou of the outlet Inside Story, the Helios platform was designed to covertly extract data from mobile devices, infecting targets with a single click and operating on both Android and iOS systems. The offer reportedly allowed for four simultaneous infections covering up to 50 targets, restricted to the client’s geographical jurisdiction. It also included round-the-clock technical support and training, with a base price of €4 million.
Additional features were offered at extra cost, including software that would allow the spyware to survive a device reboot, covert infection capabilities for Samsung mobile phones requiring no user interaction, and a proprietary data-analysis platform. These optional services raised the overall cost by several million euros. The offer also allowed clients to expand surveillance beyond their own territory to up to five additional countries, explicitly excluding Israel, the United States, and Greece. Triantafyllou testified that the particular offer presented in court was intended for a country in the Middle East.
Payment terms described in the document required half of the amount upfront, 40 percent upon delivery of the necessary hardware, and the remaining 10 percent after successful installation testing.
The second offer, relating to Intellexa’s Nova platform and reportedly circulated on social media, outlined more extensive capabilities at a significantly higher cost. Nova was described as supporting up to 100 targets with ten simultaneous infections, again using one-click access to extract data from both major mobile operating systems. It included advanced data-analysis tools, such as artificial-intelligence-based filtering and correlation of information. The platform was priced at €8 million, including training for up to ten personnel and one year of full technical support, with optional add-ons and maintenance extensions available at additional cost under similar payment terms.
Defense lawyers for Dillian and Hamou objected to the inclusion of all three documents, arguing that they had been unlawfully obtained and that reading them into the record would invalidate the proceedings. They questioned their authenticity and claimed the prosecution relied on screenshots allegedly originating from Intellexa’s internal systems, which the defense said could not be independently verified.
The prosecutor countered that the documents had been submitted as part of published journalistic investigations or directly by the prosecution’s supporting counsel. He argued that while their precise origin from Intellexa’s systems had not been established, this alone did not justify excluding them, especially as they were not the sole evidence in the case and would be evaluated freely by the court.
The defense insisted that, according to testimony by journalists involved in reporting on the spyware affair, the documents constituted leaks from Intellexa and were therefore illegal to use. In response, prosecution-side counsel Zacharias Kesses said that two of the documents were already known to Dillian and Hamou, as they had been leaked to The New York Times. He argued that the term “leak” was journalistic, adding that the documents were submitted with employee consent, were not unlawfully obtained, and there was no indication that those involved had not consented to their publication.
After further exchanges, one of the defense lawyers withdrew the objection, stating that he intended to raise the matter before the European Court of Human Rights on the grounds of a fair-trial violation. He argued that allowing the documents to be read would preserve the issue for future legal review. Ultimately, the court rejected the objections and ruled that the documents would remain part of the case file.
The hearing also featured testimony from Giorgos Karathanasis, a computer engineer and expert witness acting as a technical adviser to Tal Dillian. Karathanasis sought to undermine the credibility of technical analyses produced by Citizen Lab, the internationally respected research group that has documented the use of Predator spyware. His testimony drew sharp questioning from the bench and the prosecution, particularly after it emerged that his written report included critical commentary sourced from posts on X, formerly known as Twitter. Both the prosecutor and the presiding judge openly questioned the academic seriousness of relying on social media content in a technical expert report.
The trial is now entering its final phase. After defense lawyers informed the court that none of the four defendants would testify, judges scheduled February 6 for the prosecutor to present his formal recommendation. Closing arguments by the lawyers on both sides are expected to follow in the subsequent hearings.
