G is for Greece — The Same Wiretap, Eighteen Years Apart

The Alphabet of Harm, letter G. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: CONTINUES.

The Country That Proves the Point Twice

Most of the letters in this alphabet trace one harm across many actors. Greece does something rarer and more damning: it proves a single modality twice, in one country, eighteen years apart, with the instrument mutating in between exactly the way letter C — C is for Covert Collection — said it would.

In 2004 the instrument was a physical subversion of the lawful-interception hardware every European carrier is legally required to build into its exchanges. In 2022 it was a remote, zero-click phone implant bought as a commercial product from a mercenary vendor. Same target-type — the state's own leadership, its opposition, its press. Same harm — covert surveillance of the people a democracy is least entitled to spy on. Different tool. The eighteen-year gap is not noise; it is a controlled experiment, and the variable that held constant was who got watched.

That is why Greece earns its own letter. It is the case that turns C's abstract "appliance-to-implant mutation" into something dated, national, and concrete. It is the case that shows the harm C documents is not confined to authoritarian regimes or distant scandals — it recurred inside an EU member state, against its own democratic institutions, across two decades, and the people who did it mostly walked away.

1. What the Archive Holds — The System Itself

Before either Greek scandal, the archive holds the thing that was abused. The WikiLeaks Spy Files — the trade documentation of the global lawful-interception (LI) industry — contain the ETSI/TC LI standards overview ("Lawful Interception and Retained Data") and the vendor architectures that implement it: Ericsson's and Nokia Siemens's LI mediation platforms, the LIMA product line, the HI-2 and HI-3 handover interfaces that carry intercepted content and call-data to a Law Enforcement Monitoring Facility.

This matters because of what the Athens Affair actually was. The intruders of 2004 did not "hack Vodafone" in the way that phrase implies. They did not break the carrier's security perimeter. They turned on a capability that was already there — the lawful-interception subsystem the ETSI standard requires Ericsson to build into every AXE exchange. The backdoor was not smuggled in. It was mandated by law, installed by the vendor, and then reached by someone who was never supposed to have the key.

The Spy Files also list Greece (GR) among the participating governments in the lawful-interception ecosystem, alongside the vendors — Ericsson, AQSACOM, VasTech, Nokia Siemens — whose products make state interception a purchasable capability. The country that would suffer the most famous abuse of a lawful-intercept backdoor is in the archive as a customer of the market that builds them.

Method note. The Spy Files are vendor and standards documentation — high reliability for what the LI architecture is and who sells it. They do not themselves attribute the Athens Affair. The link between "the ETSI/Ericsson LI subsystem" in the archive and "the thing the 2004 intruders abused" is drawn from the widely-documented public history of the affair, not from the Spy Files. We keep those two evidentiary layers separate on purpose.

2. 2004–2005 — The Backdoor Turned On the State

The facts of the Athens Affair are, at the level of what happened, uncontested and extraordinary.

Between 2004 and 2005 — spanning the Athens Olympic Games — unknown actors ran rogue software on the lawful-interception subsystem of Ericsson AXE exchanges inside Vodafone Greece. For roughly ten months, about 100 mobile phones were covertly wiretapped. The target list was not criminals or foreign agents. It was the Greek state's own nervous system:

• The Prime Minister, Kostas Karamanlis, and his wife.
• Cabinet ministers, including the ministers of defence, foreign affairs, and public order.
• Senior military and police officers.
• Journalists and civil-society figures.

The intercepted audio was routed out to a set of anonymous prepaid "shadow" phones. The rogue software was sophisticated enough to sit inside the exchange's own intercept machinery — the machinery built to serve lawful warrants — and use it to serve an unlawful one, without generating the usual audit trail.

Two things about the aftermath define the harm.

First: nobody was ever identified. No perpetrator was named, charged, or convicted for ordering or running the operation. The most consequential wiretapping scandal in modern European history has, at its center, an empty chair. It is universally suspected to have been a state-level intelligence operation — the sophistication, the target list, and the clean tradecraft all point that way — but suspicion is not proof, and eighteen years later there is still no proof.

Second: it may have cost a life. As the scandal was breaking in March 2005, Kostas Tsalikidis, a Vodafone Greece network-planning engineer connected to the discovery of the rogue software, was found dead in his apartment. His death was ruled a suicide. His family has contested that ruling for years, and the case was reopened more than once. Whatever the truth, the human cost of the Athens Affair fell — as far as the record shows — on an engineer, and never on the surveillers.

Method note. Attribution of the Athens Affair is LOW confidence by design: the perpetrators were never identified, and any specific state attribution remains inference. The existence, scale, targets, and mechanism of the wiretap are HIGH confidence — they are matters of public record, parliamentary inquiry, and Vodafone's own admissions. We separate the well-established "what" from the unproven "who."

3. The Watchdog at the Wiretapper's Ball

Here the archive does something almost novelistic.

After the Athens Affair, Greece did what wounded democracies do: it built an institution. The ADAE — the Authority for the Assurance of Communication Security and Privacy — was established to oversee lawful interception and to make sure the 2004 abuse could never recur. It is, in its origin, the antibody: the watchdog created precisely because the lawful-intercept backdoor had been turned against the nation.

And then you find ADAE in the Spy Files — presenting at ISS World Prague, October 2008, the surveillance industry's flagship trade conference, the event the press nicknamed "the wiretappers' ball." ADAE's talk was titled, in the program, a "Security framework for an LI/DR Infrastructure." It shares that program with the vendors it was ostensibly there to guard against — including Amesys, whose session was frankly titled "From Lawful to Massive Interception: Aggregation of Sources," and HackingTeam, pitching "Remote Control System v5.1" — the implant-era product line before the implant era had a name in the headlines.

This is not hypocrisy, exactly. A regulator should understand the market it regulates. But the image is the whole thesis of letter C compressed into one conference program: the oversight body born from the abuse of the lawful-intercept backdoor, standing in the exhibit hall where the next generation of backdoors is being sold. The dual-use tension is not a slippery slope you have to imagine. It is a line in a 2008 agenda.

4. 2022 — The Implant on a Journalist and an MEP

Eighteen years after the AXE exchanges, the harm recurred. The instrument had mutated.

In 2021–2022, Greece produced its own chapter in the global mercenary-spyware scandal — quickly named "Predatorgate." The Cytrox/Intellexa "Predator" spyware — a zero-click phone implant sold as a commercial product — was tied to the phones of:

• Thanasis Koukakis, a financial journalist investigating banking and corruption.
• Nikos Androulakis, leader of the opposition PASOK party and, at the time, a sitting Member of the European Parliament.

Citizen Lab documented Predator infections and, in some cases, Predator/Pegasus co-infection on the same devices — two separate mercenary implants on one dissident's iPhone. The involvement of the Greek national intelligence service (EYP) in surveillance of Androulakis, and the environment that allowed Predator to operate, drove resignations at the top of the intelligence apparatus and the prime minister's office, and became a centerpiece of the European Parliament's PEGA inquiry into spyware abuse across the EU.

Look at the two target lists side by side. 2004: the Prime Minister, his ministers, the opposition, the press. 2022: the leader of the opposition, the press. The category of victim is stable across eighteen years — the political opposition and the journalists who scrutinize power. Only the tool changed: from a subverted carrier-intercept appliance to a bought-off-the-shelf phone implant.

Method note. The Predator infections of Koukakis and Androulakis are HIGH confidence — forensically documented by Citizen Lab, corroborated by the EU PEGA report and Google TAG. The precise chain of state responsibility — exactly who authorized what, and how EYP's activity related to Intellexa's commercial operation — was contested in Greek politics and courts and is treated here as MEDIUM. The distinction matters: the implant on the phones is proven; the full command chain behind it is partly still argued.

5. The Mutation, Named

Set the two scandals against letter C's central claim and they line up joint-for-joint.

This is precisely the appliance-to-implant mutation letter C traced through the Spy Files: the collection point moved from the carrier's hardware into the victim's pocket, and the tooling moved from bespoke intrusion to a purchasable product. Greece is the rare place where you can watch that migration happen within one national jurisdiction, with the target-type pinned in place as a control. The modality did not end. It re-armed.

6. Why the Backdoor Is a Permanent Liability

The Athens Affair should have permanently settled a debate that keeps being reopened: whether a communications backdoor can be reserved for authorized users only.

The 2004 intercept did not require breaking cryptography or defeating Vodafone's defenses. It required reaching a capability that the law itself demanded exist — the ETSI lawful-interception subsystem, present by mandate in every compliant exchange. A backdoor built for lawful warrants is still a backdoor. Its existence is an attack surface. Whoever can reach it can use it, and the feature cannot tell an authorized operator from an intruder wearing the same interface.

Every argument since — for mandated key escrow, for "responsible" client-side scanning, for "exceptional access" that only the good guys can use — runs into the AXE exchanges of 2004. The mandated intercept feature was the vulnerability. Not a flaw in the implementation; the intercept feature working exactly as designed, for the wrong hands. Greece is the canonical, dated proof that a lawful-access mechanism is a standing liability for as long as it exists, no matter who is supposed to hold the key.

7. The Caught Column Is Nearly Empty

Across this alphabet we track a "caught column" — who actually faced consequences. In Greece, twice over, it is thin to the point of emptiness.

2004: Perpetrators never identified. No convictions for ordering or running the wiretap. Vodafone Greece was fined by regulators over the security failures, years later — a corporate penalty, not an accounting for the operation. The one death connected to the case was an engineer's, ruled a suicide his family has spent nearly two decades disputing. The surveillers: unknown, uncharged, unpunished.

2022: The scandal did produce consequences at the institutional level — the intelligence chief and the prime minister's general secretary resigned, and the affair fed a formal EU parliamentary inquiry that put the entire European mercenary-spyware market under scrutiny. But criminal accountability for the surveillance of Koukakis and Androulakis remained limited, tangled in questions of jurisdiction and state secrecy.

Put together, the two cases deliver an uncomfortable finding: even inside the EU — with a free press, an opposition that can shout, a dedicated communications-privacy watchdog, and a parliamentary inquiry with subpoena power — the people who surveil a democracy's own critics largely escape consequence. Institutions caught the scandal. They did not, in either round, catch the surveillers. The caught column of surveillance-from-within is nearly empty even where the institutions are strong — which is the strongest possible argument that it will stay full of harm.

Not Only Greece — The European Pattern

If Greece were the sole case, a reader could file it as a national failure — one small state, one careless intelligence service, one bad decade. It is not. Greece is the clearest double, but the same modality left fingerprints across the European Union in the same window that produced Predatorgate, and the archive's PEGA report holds them.

The European Parliament's inquiry was not opened because of Greece alone. It was opened because Poland deployed Pegasus against opposition figures, a prosecutor, and a lawyer in the run-up to elections; because Spain's "CatalanGate" saw dozens of Catalan politicians, lawyers and activists targeted with Pegasus and Candiru, and the Spanish prime minister's and defence minister's own phones were later found infected; because Hungary turned mercenary spyware on investigative journalists and media owners. Greece supplied the through-line the committee needed — the country where the harm had a documented ancestor in 2004 — but the committee's finding was continental: mercenary phone-implant surveillance of journalists, lawyers, and the political opposition had become a normal instrument of European statecraft, not an aberration confined to one border.

That widens the verdict rather than softening it. CONTINUES is not a statement about Greek exceptionalism; it is a statement about a modality that, once it exists as a purchasable product, is reached for by whichever state finds its critics inconvenient. Greece is the case that proves the recurrence within one country across eighteen years. The rest of the PEGA docket proves the recurrence across countries within a single election cycle. Same harm, same category of victim — the opposition, the press, their lawyers — read twice, on two different axes, from the same archive. The pattern is not that Greece is unusually bad. The pattern is that the tool travels, and the temptation travels with it.

8. What Our Systems Actually Hold

Honesty about scope. This letter lives in the record, not on our wire. The LSN sensor mesh does not intercept state wiretaps, and it did not catch Predator infecting anyone's phone. A homelab honeypot in Iași is not the instrument that exposes a national intelligence service. It would be a lie to imply otherwise, and this alphabet does not trade in that kind of lie.

Our contribution is real but specific, and it is twofold.

We hold the archive. The ETSI/Ericsson lawful-interception architecture that the Athens Affair abused; the Spy Files that document the market; the ISS Prague program with ADAE standing among the vendors; the EU PEGA report on Predator. The OSINT library is the memory that lets 2004 and 2022 be laid against each other and read as one recurring harm rather than two disconnected scandals. Memory is a defensive capability. A harm that is remembered as a pattern is harder to relaunch as a surprise.

We catch the democratized floor of the same modality. The Predator implant sits at the expensive, state-tier top of the collect-everything modality. But that modality has a cheap floor — the commodity secret-harvest documented in dossier 059A and letter 071C: mass, automated, low-budget collection pushed to the cheapest available operator, hunting credentials and secrets at scale. That floor strikes the LSN edge every day, and our sensors do see it. Greece is the state tier of a harm whose commodity tier lands on our doorstep. The modality is one continuum; only the budgets, and the targets' importance, differ across it.

So the LSN role in letter G is not "we caught the spies." It is: we keep the record that makes the pattern legible, and we hold the line at the democratized end of the same modality the record describes.

9. The Verdict — CONTINUES

Greece does not let us say ENDED, and it does not quite fit MUTATED-and-moved-on. The instrument mutated — appliance to implant — but the harm did not migrate elsewhere or diffuse into something new. It recurred, in the same country, against the same category of victim. That is the definition of CONTINUES.

The 2004 Athens Affair was not a one-off Cold War-flavored aberration that the ADAE and a chastened political class then closed off forever. Eighteen years later, the same democracy surveilled the same kind of people — its opposition, its journalists — with a newer tool. Where the capability exists and the accountability is thin, surveillance-from-within returns. It returns not because of one villain but because the temptation is structural: the tools are available, the targets are the people most inconvenient to power, and the caught column stays empty enough that the expected cost of doing it never gets high.

That is the seed this alphabet plants for the letters still to come — I (I-Soon), M (the archives of the powerful), Q (QUANTUM), V (VasTech), X (XKeyscore). Greece is the small, dated, fully-documented proof of the general law: the harm C describes does not end when a scandal ends. It waits for the next instrument, and the next set of inconvenient people, and it comes back.

Verdict: CONTINUES — proven twice, in one country, eighteen years apart.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. G is for Greece. Next: H.