An extract from “The Enemy Inside, the Paragon Case, Spies and Regime Methods in Giorgia Meloni’s Italy” by Francesco Cancellato, published by Rizzoli on November 11, 2025.
This surveillance system continues to expand its reach into opposition figures and political operatives. The discovery marks another chapter in what appears to be an increasingly systematic targeting of Democratic Party-affiliated individuals and consultants.
Francesco Nicodemo, a seasoned communications professional with deep roots in Italian politics, has become the latest confirmed victim of Paragon Graphite spyware.
Nicodemo’s background speaks to his potential value as a surveillance target. He previously served as national communications director for the Democratic Party between 2013 and 2014 during the Renzi administration, eventually overseeing digital communications at Palazzo Chigi.
In January 2021, he co-founded Lievito, a communications agency that has worked on thirteen election campaigns in 2024 alone, primarily for center-left candidates seeking office across Italy.
The discovery of Paragon on his device came through an unexpected channel a WhatsApp message that Nicodemo initially dismissed as phishing.
The message was followed by calls from a number with a U.S. prefix (+1), which he also ignored. It wasn’t until researcher John Scott Railton from Citizen Lab reached out directly that Nicodemo grasped the severity of the situation.
Upon seeing coverage of other spyware victims, particularly journalist-focused reporting on the broader surveillance campaign, he realized he was not experiencing a random cyberattack.
Paragon Graphite Spyware Surveillance
Despite understanding relatively quickly that he was under surveillance, Nicodemo chose silence for nearly a year. His hesitation stemmed from two primary considerations.
What makes Nicodemo’s case particularly notable are the technical and contextual details. He had switched from Android to iPhone just days before the spyware was detected, meaning the compromised device was powered down and unused sitting in his home, over a thousand kilometers away from Vienna, where he was located when initially contacted.
First, he did not view himself as sufficiently prominent not a politician, activist, or journalist to warrant public attention or claims of importance.
Second, and more significantly, he remained genuinely puzzled about the motive. He had never worked on immigration policy or engaged in journalism, raising the fundamental question: Why him?
The answer, however, appears increasingly apparent within the broader context of political opposition surveillance.
Nicodemo’s work directly intersected with sensitive political operations: he managed digital communications for Democratic Party parliamentary groups and maintained frequent contact with senior party officials while coordinating election campaigns.
The timing is particularly revealing. In the months preceding late January 2025, his agency oversaw regional elections in both Liguria and Umbria.
The Umbria campaign proved especially significant Perugia elected left-wing candidate Vittoria Ferdinandi as mayor after a decade of center-right governance, directly opposing the preferred candidate from Giorgia Meloni’s Brothers of Italy party.
Conversations downloaded from Nicodemo’s compromised device likely contained messages from numerous Democratic Party candidates, parliamentarians, and mayors individuals whose communications would prove valuable to those seeking intelligence on opposition political strategy.
After months of deliberation, Nicodemo decided to speak publicly, motivated by two considerations.
He maintains faith in democratic institutions and security services while simultaneously fearing potential abuse of private citizens.
More pragmatically, the election campaigns he consulted on are now concluded, eliminating any temptation to weaponize his situation for political advantage. The time for transparency, he believes, has arrived.
His case reinforces a troubling pattern: Paragon surveillance appears deliberately targeted at individuals involved in opposition election campaigns and political communications infrastructure.
As the investigation continues, each new victim provides additional evidence of what critics describe as systematic targeting of Democratic Party operations and personnel.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.