Speaking during an event with the Luxembourg Times on Monday, Bettel (DP) said that “when we bought it, it was for reasons of state security. If other governments decided to buy this product to spy [on] oppositions, journalists and other people, it’s a scandal,” he said.

The Pegasus spyware was developed by Israeli firm NSO. A leak in July uncovered the global abuse of the cybersurveillance tool, revealing more than 50,000 potential targets, including world leaders, opposition politicians, human rights activists and journalists. Forensic analysis of phones on the leaked list showed evidence that they had been infiltrated.

While Bettel appeared to confirm that Luxembourg had purchased the software, he backtracked in answer to a parliamentary question on Thursday. “The prime minister, minister of state, referred in a general manner to the purchase of such a tool under the given conditions,” the said.

The secret service is allowed to use surveillance tools under certain conditions. For example, a committee of three judges must normally approve surveillance operations followed by the prime minister’s agreement.

“For reasons of security and in order to protect investigations, it’s not possible to publish the details concerning technical equipment,” Bettel said on 28 October.

Already in July, the government had evaded questions by lawmakers who in the wake of the scandal had asked if any Luxembourg institutions are using the tool. The prime minister and the ministers for foreign affairs and interior security that no details on technical equipment could be shared due to security and investigative reasons.

However, the government admitted that nine NSO entities are active in the grand duchy, managing back-office operations. The revelations fuelled calls for national human rights due diligence legislation. Luxembourg currently has an action plan based on voluntary commitments by companies and is waiting on an EU directive for a bloc-wide solution.

The country earlier this month was elected to the UN Security Council for the three year period from 2022 to 2024 and activists from Amnesty International and other groups warned it would hold Luxembourg to account over its lack of human rights obligations for businesses.

“When it comes to the role of those countries that are hosting the legal entities, they are also profiting from the profit that was made spying on journalists, political opponents, human rights defenders,” told Delano in July. Panyi is a Hungarigan investigative journalist who was hacked with the Pegasus software. “Every country should consider what kind of activities it tolerates to be registered on their soil,” he said.

NSO has denied wrongdoing, saying it sells the software only to vetted clients with the aim to fight crime or terrorism.