An inquiry by Polish authorities has uncovered that NSO Group, the Israeli spyware vendor, maintained technical control over information collected through a covert surveillance programme run by the country's former ruling administration. The findings have prompted Prime Minister Donald Tusk to characterise the operation as "one of the biggest scandals in Polish history since the fall of communism."
According to Poland's National Prosecutor's Office, analysis conducted by the Internal Security Agency (ABW) determined that the Central Anti-Corruption Bureau (CBA), which administered the spyware initiative, lacked complete oversight of the Pegasus system operated by NSO. The prosecutor's statement noted that "the server module responsible for infecting mobile devices remained under the manufacturer's exclusive control."
The CBA was also unable to obtain passwords granting access to numerous accounts with administrative functions. This limitation meant that "full verification of the correct functioning of individual system modules, including those responsible for data transmission and storage," could not be performed, according to the prosecutor's office.
Information gathered through the spyware was routed outside Poland via an anonymizing network using foreign servers, prosecutors revealed. The investigation identified that data travelled through foreign internet protocol addresses, granting NSO what prosecutors described as "technical access" to material obtained from the surveillance operations. Remote connections were used to deliver software updates and technical assistance to Polish officials.
"During this work, operational inspections were not interrupted, and the manufacturer had full access to the system, including the ability to make changes to its software and configuration," the prosecutor's office stated. However, investigators acknowledged they cannot determine whether NSO "actually obtained access to materials from specific operational inspection."
In February 2024, Tusk's administration disclosed that Pegasus had been deployed against a "very long" roster of targets. The Prime Minister revealed that his own wife and daughter were monitored, and that more than 500 other individuals had their devices targeted, with some experiencing successful infections.
Multiple former intelligence and security officials are now facing prosecution for enabling the spyware abuses. The operation was allegedly financed through the misappropriation of public funds designated for victim support services.
Tusk has characterised the scheme in stark terms, stating that officials "paid money for a system that de facto transferred all possible data on Polish citizens, Polish opposition leaders and Polish independent prosecutors…to the Israeli side," and declared: "This is no longer [just] a scandal… We're talking about a crime against the state."
The revelations underscore the operational security hazards governments face when deploying foreign surveillance software, according to John Scott-Railton, a researcher at Citizen Lab. NSO has consistently assured government clients that it cannot access data collected by Pegasus, yet court documents released in WhatsApp's 2019 lawsuit against the company support Poland's conclusions.
Scott-Railton cautioned that governments must evaluate whether "sensitive information, including information about who they may be targeting, and also their citizens' information, is being exposed to foreign entities." He added: "This cuts right to the heart of not only the value proposition of acquiring foreign spyware, but also the risks to the government that's wielding it."
