Who watches the (data) watchers? Lessons from Italy’s Equalize case

Italy has recently been rocked by a major scandal involving severe data privacy violations. Although investigations are ongoing, the case already highlights critical lessons that other countries, including Japan, should consider when reflecting on their own data security practices.

Equalize and its alleged crimes

At the center of the case is Equalize, a Milan-based private intelligence firm led by Carmine Gallo, former police officer renowned for his successful career against organized crime in Northern Italy[1], and Enrico Pazzali, former Chief Executive Officer at Fiera Milano S.p.a. (one of Italy’s largest exhibitions organizers) and entrepreneur with previous prestigious roles and political connections[2]. On paper, Equalize operated like other investigation agencies: researching firms or individuals for private or corporate clients to uncover backgrounds and hidden information, and assess potential business risks. In Italy, such private investigative work is legal but strictly regulated[3]: for example, it is forbidden to collect information inside private residences or through unlawful access to secured computers[4]. While Italian data privacy regulations are less strict than those of other European countries[5], they broadly conform to the European Union’s General Data Protection Regulation, often considered the world’s toughest privacy law[6].

Equalize, however, allegedly ignored these regulations. Press reports indicate that from at least October 2022[7], Equalize accessed multiple databases run by Italian official administrative and governmental entities, including the National Institute for Social Security, the Revenue Agency[8], and the National Register of the Resident Population of the Ministry of the Interior[9]. Equalize also reportedly accessed the “Interagency Investigation System” (Sistema d’Indagine or SDI in Italian)[10], a database shared among law enforcement branches containing records on charges, suspects, passports, etc.[11], and linked to databases of other agencies, like the Department of Motor Vehicles[12]. Allegedly, Equalize also accessed the Bank of Italy’s “Suspicious Transaction Reports” (SOS), mandatory reports issued by financial entities for transactions possibly linked to illegal activities[13]. This data (possibly around 15 terabytes[14]of it) was ostensibly used by Equalize and at least 5 colluding firms[15] to compile illegal dossiers and satisfy clients’ requests. Hypotheses on the uses of these dossiers include extortion or blackmail[16], influence over official decisions, manipulation of investigations and trials[17], and leaks to investigative journalists[18].

Local and foreign actors involved

A complete list of Equalize’s clients is under investigation, but current defendants include personnel of Luxottica (a leading eyeglass manufacturer and retailer) and Barilla (a major pasta producer) among other top firms[19]. Also suggested are ties to organized crime and intelligence services[20]. Reports also hint at foreign clients, including intelligence agents of Israel’s Mossad allegedly seeking Equalize’s help to monitor actors in Russia and then share intelligence with contacts in the Vatican[21]. While the clients’ requests often had personal or internal corporate motivations, the roster underscores Equalize’s influence.

The list of alleged victims is equally high-profile, including Italian celebrities, journalists, local politicians and industry leaders[22], as well as Italy’s President Sergio Mattarella (whose e-mail address was reportedly breached or cloned), President of the Senate Ignazio La Russa, and former Prime Minister Matteo Renzi[23].

How did Equalize gain access to data?

Access to restricted data was allegedly enabled by IT consultant Nunzio Calamucci, who also led the team behind the “Beyond” platform, a system used to assemble stolen data and distribute it to clients[24] after erasing identifying information like metadata[25] that could expose its origins.

According to police, one of the methods used was a Remote Access Trojan (RAT) installed on a machine connected to the Ministry of the Interior’s network. A RAT is malware that allows remote control of a computer, enabling data theft, keystroke logging, and user monitoring[26]. In other cases, monitoring software was installed on the victims’ computers without their knowledge[27].

Corrupt insiders[28] likely installed RAT on the targeted systems, while several law enforcement officers allegedly accessed the highly regulated[29] SDI on Equalize’s behalf[30].
Gallo’s police experience in interagency cooperation[31] and Calamucci’s professional connections to database designers and hosts[32] may have eased access and allowed Equalize to obtain a copy of the data without raising any unauthorized access warnings[33]. Experts also point to a lax security culture where rules were treated as dismissible obstacles rather than safeguards[34].

Not the first case

Equalize’s case has recently begun to merge with probes into a similar, Rome-based clandestine private investigation agency called “Squadra Fiore[35].” Furthermore, other similar cases emerged in 2024. In September, Pasquale Striano, a lieutenant in the Italian Financial Police, was accused of illegally obtaining thousands of financial records and handing them to journalists. He justified his actions as routine for SOS investigations, but prosecutors argued that the volume of downloads (up to 10,000 files per day) suggested otherwise[36]. In October, former banker Vincenzo Coviello was accused of illegally accessing the account information of thousands of VIP clients. Authorities were alarmed that his access, seemingly driven by personal curiosity, continued unobstructed for months[37].

Lessons to learn

While the Equalize case is influenced by Italy’s unique context, it can offer valuable lessons in data security for other countries, including Japan.

The first lesson echoes an old question: who watches the watchmen? In Italy, authorities responsible for safeguarding sensitive data, including law enforcement, appeared to fail, be corrupted, or dismiss warnings as mere nuisances. Ensuring strong checks and balances is vital to uphold integrity standards for those working around sensitive data. While Italian intelligence authorities have now issued stricter access control and system design guidelines[38], other countries should preemptively act to avoid similar scandals, and consider designing failsafes for scenarios in which the watchmen go astray.

Another lesson concerns the sharing of sensitive data. As Japan and other countries champion initiatives like “Data Free Flow with Trust” (DFFT) to promote international data sharing and collaboration[39], incidents like this case underscore the need for strong domestic data safeguards when demanding trust with international data. In terms of personal data, in Japan, the Act on the Protection of Personal Information (APPI) covers data subjects’ rights as well as requirements for business operators[40]. However, APPI enforcement mechanisms have been criticized as too weak to effectively incentivize better data security in businesses[41], and while strengthening amendments have been proposed, they are still under consideration[42]. Establishing secure practices and apt consequences for violations is crucial to foster a reliable global framework for data sharing: without a strong domestic foundation, the credibility and safety of initiatives like DFFT might be undermined.

The final lesson concerns the risk of the so-called “revolving doors,” where individuals move between roles in the public sector, such as government agencies, and positions in the private sector, particularly within related industries. This practice offers benefits, such as increases in networking potential, lobbying power, and access to government funding for the hiring firms[43]. Furthermore, “revolving doors” seem nearly inevitable in specialized fields like cyber security, given increasing demand for experts vis-a-vis their limited supply, and a return to the public sector after private sector work can provide diversified experience and skills[44]. However, this phenomenon can raise concerns about conflicts of interest[45] and, in cyber security, voluntary or involuntary transfer of sensitive information[46]. Thus, rules balancing risks reduction and flexibility must be created; they will depend on local contexts and laws, but examples include restrictions on transition periods and client access for individuals moving between public and private sector, as well as strict data management upon employees’ departures. Italy lacks regulations on “revolving doors[47],” which possibly contributed to Equalize’s alleged violations. Japan should be better prepared, given the enactment of laws in the 2000s to curb the similar practice of amakudari (meaning "descent from heaven”), where retired senior bureaucrats are preferentially hired in private sector industries they once oversaw[48]. However, as the scarcity of cyber experts will inevitably lead to a “revolving doors” environment, proper and timely oversight is needed to prevent misuse of sensitive data.

In conclusion, a country's approach to data privacy must balance flexibility and oversight, and cases like Equalize can help us learn how to strengthen regulations and prevent violations.

(2025/03/28)