To Executive Vice-President for Tech Sovereignty, Security and Democracy, Henna Virkkunen
To Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, Michael McGrath
To Commissioner for Budget, Anti-Fraud and Public Administration, Piotr Serafin

Brussels,

Subject: EU funds misused for spyware companies

Dear Executive Vice-President,
Dear Commissioners,

We are writing to you to express deep concerns following the recent revelations by investigative journalists that European Union subsidies, alongside national taxpayer funds, have directly financed companies implicated in the development, deployment and export of spyware. According to these findings, entities such as Intellexa, Cy4Gate, Verint and Cognite—whose technologies have been linked to unlawful surveillance of journalists, human rights defenders and political actors in the EU, as well as in third countries with dreadful human rights records —have benefitted from public financing, including EU programmes.

This raises serious questions about the governance, transparency and accountability of the Union’s funding mechanisms. In the light of the scandals uncovered in Italy, Greece, Poland, Hungary and Spain, among others, and of the recommendations of the PEGA inquiry, it is deeply troubling that the Union is directly or indirectly enabling tools that erode democracy, fundamental rights and the rule of law.

We therefore request full transparency and concrete explanations on the following points:

• How does the Commission currently verify the integrity, ownership structures and human rights compliance of companies that receive EU funds?
  
• Were any warnings, risk assessments or intelligence shared with the Commission before subsidies were granted to spyware or intrusive surveillance software firms such as Cy4Gate, Cognite, or Intellexa-linked entities? If so, why were they disregarded?
  
• Which specific EU programmes, calls or instruments provided financing to these companies?
  
• What was the total amount allocated to such companies, broken down by company and by funding stream, and under which decision-making authority?
  
• Were there any control mechanisms included in the contracts in order to prevent the misuse of funds for spyware development? Were there any end-user exclusion clauses (e.g. human rights impact assessment, dual-use screening) -? If not, why not?

...