Pegasus in Poland: NSO had access to spyware data

Polish prosecutors say NSO Group kept control over key parts of the Pegasus spyware system that Poland's former government used, and that data collected by the tool was sent abroad through servers outside the country.

The findings come from an analysis by Poland's Internal Security Agency (ABW), the country's domestic counterintelligence service. The National Prosecutor's Office made them public. On Monday, Prime Minister Donald Tusk, who ordered the investigation, called the spyware operation run under the previous ruling party "one of the biggest scandals in Polish history since the fall of communism." He also accused the Israel-based spyware maker of working with Israeli intelligence services.

The operator lacked full control

Pegasus was operated by the Central Anti-Corruption Bureau (CBA), a Polish law enforcement agency that investigates corruption. According to the prosecutors, the CBA "did not have full control over the Pegasus system."

The most important gap involved the part of the system that actually compromises phones. "The server module responsible for infecting mobile devices remained under the manufacturer's exclusive control," the prosecutor's office said in its press release.

The CBA also lacked passwords for many accounts with administrative privileges. Prosecutors said this "prevented full verification of the correct functioning of individual system modules, including those responsible for data transmission and storage."

Data routed through foreign servers

Investigators found that data gathered by the spyware left Poland through an anonymizing network built on servers abroad. The Polish probe traced the transfers to foreign IP addresses.

On that basis, prosecutors concluded that NSO had "technical access" to information collected during operational inspections, the term Polish authorities use for covert surveillance operations.

The company also supplied updates and technical support to Polish officials over a remote connection. Surveillance did not stop while this happened. "During this work, operational inspections were not interrupted, and the manufacturer had full access to the system, including the ability to make changes to its software and configuration," the press release said.

Prosecutors were careful about one point. They cannot say whether NSO "actually obtained access to materials from specific operational inspection." The investigation shows that the access was technically possible, not that it was used in a given case.

NSO Group did not respond to a request for comment from The Record.

A scandal years in the making

The new findings add to a case that has been building for some time. In February 2024, Tusk's government said investigators had confirmed Pegasus was used against a "very long" list of victims. Tusk said his own wife and daughter had been spied on, and that devices belonging to more than 500 other people were targeted, with some of them infected.

Several former intelligence and security officials now face charges for enabling the abuses. The spyware was allegedly paid for with money taken from a government fund meant for crime victims.

Tusk reportedly said the former officials "paid money for a system that de facto transferred all possible data on Polish citizens, Polish opposition leaders and Polish independent prosecutors...to the Israeli side."

"This is no longer [just] a scandal... We're talking about a crime against the state," he added.

Researchers see a wider risk for buyers

John Scott-Railton, a researcher at Citizen Lab, told Recorded Future News that the findings show countries using spyware need to worry about their own operational security.

NSO has long told its government customers that it cannot access data collected by Pegasus. Scott-Railton said discovery materials made public in a lawsuit WhatsApp filed against the company in 2019 support the Polish government's claims.

Governments deploying such tools, he said, must ask whether their "sensitive information, including information about who they may be targeting, and also their citizens' information, is being exposed to foreign entities."

"This cuts right to the heart of not only the value proposition of acquiring foreign spyware, but also the risks to the government that's wielding it," Scott-Railton said.

Our Take

Most of the debate around Pegasus has focused on the people being watched: journalists, opposition figures, activists and their families. The Polish findings shift part of the attention to the customer. If the vendor kept exclusive control of the infection servers, held admin access the buyer could not use, and pushed remote updates during live operations, then the government was not the only party with a view into the surveillance.

This suggests that commercial spyware creates a supply chain problem as well as a privacy one. A state buying such a tool may also be handing a foreign company, and possibly a foreign state, a window into its targets and its methods. That is a risk security teams already know from other third-party software with deep, remote access.

The limits of the evidence matter, though. Prosecutors say the access existed, not that NSO used it for specific cases. It is worth watching whether the Polish investigation produces anything more concrete, how NSO responds, and whether other countries that bought Pegasus start asking the same questions about who else could see their data.