From August 2004 to March 2005, more than 100 mobile phones on Vodafone Greece’s network were illegally monitored, including numbers used by Prime Minister Kostas Karamanlis, cabinet officials, opposition politicians, military leaders, Athens mayor Dora Bakoyannis, and an employee of the U.S. Embassy. Attackers exploited Ericsson AXE lawful-interception functionality without Vodafone’s interception-management system, installing roughly 6,500 lines of PLEX code and a rootkit that concealed software changes and bypassed normal audit logs. Calls were duplicated to 14 anonymous prepaid phones, making the operators difficult to identify.
The intrusion was discovered after a January 24, 2005 software failure; Ericsson identified the rogue code on March 4, and Vodafone general manager George Koronias ordered it removed on March 8, before investigators could trace the interceptors. Network planning manager Kostas Tsalikidis was found dead on March 9; a prosecutor linked his apparent suicide to the scandal, while his family alleged murder, and the Greek Ministry of Justice reportedly classified the death as murder in 2019. Greek regulators fined Vodafone €76 million in December 2006 and another €19 million in October 2007. Greek investigators later issued an arrest warrant for alleged NSA operative William George Basil, but responsibility was never adjudicated in court; a European court found in 2017 that the investigation into Tsalikidis’s death was inadequate.
