Key witness’ phone and evidence sent to Europol in Drousiotis case

Evidence linked to Makarios Drousiotis’ deposition, including a mobile phone belonging to lawyer Nikos Clerides’ former client, ‘Sandy’, as well as more than 130 disputed digital files, has been sent to Europol’s cybercrime laboratories for forensic examination, as authorities seek to establish whether allegations involving senior figures are supported by authentic material.

The decision was taken by cabinet on Wednesday following a briefing on the progress of the police investigation and the nature of the evidence collected to date.

The material, largely consisting of screenshots of alleged messages and spreadsheet files, will be analysed by the European cybercrime centre, a specialised unit responsible for digital forensics and cybercrime investigations.

Justice Minister Costas Fitiris said that “the evidence that has been secured will be sent immediately to Europol for forensic examination” and confirmed that further decisions would be made once the findings are returned.

“Based on the results, I will return with a new update to the cabinet,” he said, adding that any decision on the appointment of an independent investigator would follow the technical assessment.

A key element of the evidence is the mobile phone attributed to ‘Sandy’, which, according to information reported in Phileleftheros, has been secured by authorities and will be examined alongside the files.

Specialists have stressed that access to the original device is essential for verifying digital material as evidence relies on extracting data directly from the hardware in order to identify whether files have been altered, created or transferred.

Furthermore, cybercrime specialists speaking to local media stressed that even when content is moved between devices, traces of its origin and modification can often be recovered.

Without such examination, screenshots alone cannot provide conclusive proof of authenticity.

The presence or absence of ‘metadata’, including timestamps and user identifiers, is considered central to determining whether the material reflects genuine communications.

Reports indicate that the dataset exceeds 150 items in total, although the material formally submitted by journalist Makarios Drousiotis consists of 137 files accompanied by a written memorandum.

Some of the screenshots reportedly lack clear time references, while others do not definitively identify the participants in the exchanges.

Analysts say that such gaps complicate verification unless supported by forensic extraction from the originating devices.

The case stems from allegations made public by Drousiotis, who has claimed that the material points to the existence of a network involving corruption and other criminal conduct.

In a recent statement, he accused state authorities of attempting to undermine the investigation.

“From the first day I published my article, the presidential office, the legal service and the police set up a well-orchestrated operation of doubt, misinformation and confusion,” he alleged.

He added that the information he published “requires immediate and careful investigation by independent professionals”.

Drousiotis also criticised the response of the executive, stating that assurances from President Nikos Christodoulides that the case would be investigated are “false and fabricated”.

He has maintained that the process should be handled by independent investigators rather than existing structures and has questioned whether the current framework ensures impartiality.

The government has rejected the allegations and disputed specific claims made in connection with the case.

In particular, officials have denied that ‘Sandy’ has been employed at the presidential office.

Speaking on CyBC on Thursday, deputy government spokesperson, Yiannis Antoniou, said that checks had been carried out and that “no woman with the information that refers to the identity of this particular woman has been employed, at least during the current administration”.

Antoniou stated that “there are serious contradictions” in the narrative presented and suggested that the process would clarify the situation as evidence is examined.

Fitiris defended the decision to refer the material to Europol, stating that external analysis reduces the possibility of accusations of bias and ensures that the findings are based on technical expertise.

Additional scrutiny has been directed at specific elements within the files, amongst which is a screenshot of what appears to be an Excel spreadsheet listing financial transactions, including an entry referring to a €250,000 payment involving a company named PJSC BIO MED SKLO.

Politis reported that corporate registry searches confirm that a company with that name exists and operates as a glass manufacturer in Ukraine, with links to a Greek-owned industrial group that maintains a corporate presence in Cyprus.

Financial professionals who reviewed the screenshot have noted that the format does not correspond to standard banking documentation.

They indicated that the image appears to show a manually created list rather than an official account statement, raising questions about how the data was compiled and whether it reflects actual transactions.

The position of ‘Sandy’ herself remains uncertain, as her now former lawyer Clerides has alleged that she had retracted her previous statements against Michalakis Christodoulou and various members of the apparent ‘Rosicrucian’ brotherhood “under duress and external pressure”.