REVEALING - TELEPHONE CONVERSATIONS ARE MONITORED DIRECTLY BY EAVESDROPPERS OF THE KYP AND THE POLICE - THEY THROW OUT CYTA AND OTHER PROVIDERS - THREE BILLS - Filenews 28/2 - by Fanis Makridis
The legislation under promotion and under discussion on legal interconnections, commonly known as real-time interception of telephone communications, throw the providers, i.e. the telecommunications companies, out of the game.
The Cyprus Police and the Cyprus Intelligence Service will be able to "go out" on the device of the target of surveillance, without the need to notify the telephone service companies of the process.
The firework of the '20s
The above lines are the product of "F's" effort to shed light on the much-discussed issue of legal surveillance that has been preoccupying it for years, without having taken shape yet. The much-advertised amendment of the legislation on the confidentiality of private communication in 2020 and the treatment of felonies such as the pre-matching of matches, turned out to be another firework.
The new venture
The new venture, therefore, is inevitably interesting. Consultation between competent bodies has already been underway in recent years, while last Wednesday in a closed-door meeting the amendment of the Constitution was dealt with with the ultimate goal of paving the way for the corresponding differentiations of the two related legislations (see legislation on private communication and on KYP Law).
The half-talks
This effort of ours to be informed about the details of the last period for the activation of legal connections, therefore, was anything but easy. It was accepted with half-heartedness, manifestation of phobic syndromes and other tactics and practices.
It is widely accepted that transparency is not our forte, and that accountability for human freedoms issues is often deliberately and unjustifiably confused with national security.
>> Interconnected with Police-KYP
However, the sealed mouths we were talking about were one side of the coin. A source of "F" explained that the consultation on the amending legislation (see the constitution and two bills) was intense due to fundamental changes in their philosophy.
"The providers will have their subscribers interconnected with the systems of the Cyprus Police and the Cyprus Intelligence Service" was the exact report from a person with full understanding of the developments.
The same official who has knowledge of what is happening, added: "This means that the connection by the KYP and the Police to the target will be done without the need to notify the providers. Subscribers will be legally connected to the two security forces. In a way, providers will be bypassed. They will not be notified of the connection by the Police and the KYP."
>> You won't need to decree the KYP
The other legislative reform that is being attempted has to do with an issue that has already seen the light of day. The provision through the Constitution so that the commander of the Cyprus Intelligence Service can obtain written approval from the Attorney General to start "target" surveillance in case there is a question of national security or security of the Republic of Cyprus, as others prefer to say.
The proposed amendment provides for the addition of the following paragraph (D) to Article 17 of the Constitution: "With the written approval of the Attorney General of the Republic given in accordance with the provisions of the law, the intervention shall also constitute a measure which in a democratic society is necessary only in the interest of preventing and dealing with activities that constitute a threat to the security and sovereignty of the Republic".
>> The new felonies that allow connection
In addition, the scope for surveillance is expanded. In particular, the legal connections extend to other felonies. Until now, surveillance was allowed (theoretically) for the following five offenses: (a) Premeditated murder or homicide, (b) trafficking in adults or minors and offenses related to child pornography, (c) trading, supplying, cultivating or producing narcotic drugs, psychotropic substances or dangerous drugs, (d) offenses related to the currency or banknote of the Republic and (e) corruption offences for which a prison sentence of five years or more is provided for if convicted.
Offenses related to the sexual exploitation or sexual abuse of children (now explicit reference), (2) possession for the purpose of supplying narcotic substances, (3) terrorism and espionage offenses, (4) offenses of illegal trafficking of migrants and aiding illegal entry, transit and stay in the Republic are now added, (5) offences committed via the internet for which, if convicted, there is a prison sentence of five years or more and (6) money laundering offences.
>> The ex post. Update the target
Other issues inevitably enter the frame, as well as the obligation or not of the security forces to inform the target of the connection. That is, the person who, on the basis of the approval of the Attorney General or the court order, is placed under surveillance.
Another source told us that "informing the target cannot be a practice that will yield results if we consider the goal of legal interconnection".
The same person elaborated on his reasoning: "The amendments are aimed at monitoring persons who are being investigated for felonies. For example, when you want to monitor a drug dealer to make controlled arrests and prevent the trafficking of large quantities of drugs, you cannot warn him to change methods and protect himself."
Positions like this were recorded, as "F" is informed during the ongoing consultation on the controversial legislation. Here it should be recalled that in a closed-door meeting in the Parliamentary Committee on Legal Affairs last Wednesday, the legislative amendments under promotion were discussed.
Initially inactive due to technology and serious objections from CYTA - Scepticism given
At least four independent sources of information with good knowledge of the facts confirmed to "F" that the 2020 bill on legal surveillance turned out to be unworkable. Based on what all sides told us under the confidentiality regime, the "involvement" presented by the legislation was accompanied by technological issues, but also reservations that were expressed in a strong way.
"In the first three years, there was indeed a technical issue. Technological arrangements needed to be made by the telephony service providers," one of the officials who spoke to "F" pointed out to us.
At the same time, those who know the details of the consultation of the legislation under promotion, speak of an obvious manifestation of reactions on the part of CYTA (CYTA). One of the issues raised by the semi-governmental organization had to do with the constitutional rights of its clients. Recently, in fact, CYTA's legal position was that with connections without a court order and only with the approval of the Attorney General, the rights of its customers are restricted.
At least two other people spoke to us attributed CYTA's stance to the real risk that CYTA will be targeted by civil lawsuits due to complaining targets of legal connections.
Since 2020...
The only thing that is certain, however, is that the 2020 Law that would have allowed the lifting of the secrecy of private communication, although advertised as a "weapon" against crime, was never implemented. From time to time, various statements were made by people with expertise.
On 17/10/2022, the well-known criminologist, Elias Stefanou, speaking on Katia Savva's show (Alpha Cyprus) and answering a specific question, had said: "There are two issues. Real communication (note: in real time), that is, listening, watching when someone is talking to someone else, which is essential communication. And the second is who spoke to whom, for how long, without seeing content. The first, i.e. real communication, so that the authorities can monitor criminal elements, this has been passed as legislation but I am not aware of it being implemented. At least I did not become aware of any request for this. A machine should have been bought and so on... The second one that was cancelled by the Supreme Court..."
On 23/11/2022, moreover, Mr. Stefanou had analyzed the issue again on the online show Legal Matters, as a guest of his colleague Christoforos Christofis. Mr. Elias Stefanou had said: "For us, the safeguards were much stricter until 2010 due to the Human Rights Treaty. Then amendments were made due to necessity. And there is the possibility – which I still understand to be implemented – of substantial monitoring of communication. Still for technical reasons it was not implemented. I understand that the Three-Member Committee has been appointed. Legally there is the possibility. It's a technical issue, I understand. Or at least I didn't see any applications. In this context, there are specific offenses. Beyond that, who spoke to whom, when, for how long, these data of movement and position, external communication as we say, are only in offenses where the sentence exceeds five years in prison. If we have offenses under five years old, you can't."
On 14/12/2022, moreover, the Attorney General, Giorgos Savvidis, speaking on the occasion of match manipulation cases, said that it is very difficult to prove such cases in the Courts and pointed out that the greatest weapon in the fight against this type of crime will be the legal surveillance of telephone conversations, where satisfactory testimony can be ensured which will lead the cases to court, as was the case in similar cases in Greece, Italy and Spain. He added that unfortunately it has not yet been possible to use the legislation passed in 2020 to allow such surveillance to take place. Finally, the senior officer of the Police, Giannakis Georgiou, was asked to tell the parliamentary committee on Institutions why the legislation amended from 2020 and governing legal surveillance (real-time interception) is not being used. He replied that the providers (telephone companies) do not have the appropriate technological infrastructure and added that the issue will be settled soon. In other words, it threw the ball for the first time to the companies that provide telephony services...
The effort to establish a legislative framework
The effort to establish a legislative framework to overcome any concerns that have been going on for years. Now what is being attempted is to amend Article 17 of the Constitution, but also to amend the two relevant laws. That of the Protection of the Privacy of Private Communication (Interception of Conversations and Access to Recorded Content of Private Communication) and that of the Cyprus Intelligence Service. The bill to amend Article 17 of the Constitution was approved by the Council of Ministers on 13/2/2026 ("The Twentieth Amendment of the Constitution Law of 2026"). It was discussed in the parliamentary committee on legal affairs last Wednesday in a closed-door meeting. In order to amend the Constitution of the Republic of Cyprus, a vote in the House of Representatives is required by a majority of at least two-thirds of the total number of MPs (38 votes in favour).
Alexis Mavros: "The issue of supervision is just as critical as the issue of technological capability"
In addition to the legislation on legal surveillance, there is also the technical part. "F" spoke with the expert, Alexis Mavros (CFCE – Certified Forensic Computer Examiner (IACIS) – MSc Computer Forensics). We asked for his positions on the occasion of the amending legislation under promotion. The well-known forensic analyst, in addition to what he said about the technical aspect of the whole issue, raised the issue "in terms of independent control and full audit of use, which makes the issue of supervision as critical as the issue of technological capability".
His positions in detail:
"In any legislative framework that regulates the interception of communications, it is necessary to clarify with absolute technical clarity which method is applied and what its limits are. Monitoring through a telecommunications provider and monitoring through mobile device vulnerability exploitation tools are two technologically different mechanisms, with substantial differences in the point of intervention, the range of access and the level of control. This distinction is crucial because it impacts both the ability to collect findings and ensure transparency and accountability.
>> The classic interconnection through providers takes place at the network level and allows the collection of voice traffic (where there is no end-to-end encryption), SMS, call metadata (CDRs) and cell data. Its technological range is limited, as it does not provide access to the device's operating system, nor to stored files or encrypted application content. However, it is characterized by high traceability, a clear chain of custody and the possibility of independent control, elements that enhance its evidential stability.
>> In contrast, mobile vulnerability exploitation tools operate at the device level and provide a clearly stronger technological means of gathering findings, allowing access to pre- or post-encryption application content, stored data, and features such as microphone, camera, and geolocation. In terms of scope and operational effectiveness, they are a stronger tool. At the same time, however, this same power creates a serious challenge in terms of independent control and full audit of use, which makes the issue of supervision as critical as the issue of technological capability."
Lifting of journalistic secrecy by decision of the Prosecutor or the KYP
The concern of the journalistic family is a given about the latest developments. In the last period, there has been a trend through the promotion of texts/draft legislation, which make the operators of the printed and electronic press worry about the protection of their sources and not only. These are pieces of legislation that give rise to legitimate concerns that they will result in irreparable damage to the freedom of the press. What took place on April 9 last (2025) at a meeting of the parliamentary committee on Institutions is characteristic. There it was found that the European Media Freedom Act, which will be adopted by the Republic of Cyprus by legislation, instead of guaranteeing freedom of the press, puts the journalist at the mercy of the executive power. The report of the president of the Union of Cyprus Journalists, Giorgos Frangos, was indicative, who said that by decision of a State official, journalistic secrecy will be lifted. "The controversial bill, which has not yet come to Parliament and we will discuss it for the first time on the 15th of the month, provides for the lifting of confidentiality for journalists by decision of a single person, the Attorney General or the head of the KYP," Mr. Frangos had said characteristically, causing a sensation.
