Threat Intelligence · Privacy
Polish Government Says Spyware Maker Had Access to Data on Opposition Leaders
Poland's prime minister says a spyware company accessed data on opposition figures and others, raising concerns about privacy and foreign access to sensitive information.
Ross Grant3 min read
The short version
Poland’s government says a spyware company had access to sensitive data collected on opposition leaders and others. The spyware, called Pegasus, was used by the previous government, but the company that made it controlled key parts of the system. This raises concerns about privacy and who can access data collected by surveillance tools.
By the numbers
- 500+people targeted by Pegasus spyware in PolandRecorded Future News
- 2024year the investigation was announced by the current governmentRecorded Future News
What happened?
Poland’s current prime minister says a spyware manufacturer had access to data collected by the previous government using Pegasus. Investigators found that the spyware’s maker, NSO Group, controlled key parts of the system and could access data sent outside Poland. More than 500 people were targeted, including opposition leaders and the prime minister’s family.
Background: Spyware Use in Poland
Poland’s current prime minister, Donald Tusk, has accused the previous government of running a large-scale spyware operation using Pegasus, a product made by Israel-based NSO Group. According to Polish investigators, the operation targeted opposition leaders, independent prosecutors, and others. Tusk called it “one of the biggest scandals in Polish history since the fall of communism.” The investigation was ordered after Tusk’s government took office, following reports that Pegasus had been used against political opponents and even members of Tusk’s own family.
What Investigators Found
The Polish National Prosecutor’s Office said that the country’s Central Anti-Corruption Bureau (CBA) ran the spyware programme but did not have full control over the Pegasus system. The server module responsible for infecting mobile devices was under the exclusive control of NSO Group, not the Polish authorities. The CBA also lacked passwords for many accounts with administrative privileges, which meant they could not fully verify how the system worked or how data was handled.
Investigators found that data collected by Pegasus was sent outside Poland using anonymising networks and foreign servers. This means that NSO Group had “technical access” to information gathered from surveillance operations. Updates and technical support were provided remotely by NSO, and during these sessions, the manufacturer had full access to the system, including the ability to change software and configuration.
Who Was Affected
Tusk’s government said that more than 500 people were targeted, with some devices confirmed as infected. Victims included opposition leaders, independent prosecutors, and members of Tusk’s own family. Several former intelligence and security officials are now facing charges for their role in the abuse of Pegasus, which was allegedly paid for using funds meant for crime victims.
What NSO Group and Experts Say
NSO Group did not respond to requests for comment. The company has previously claimed it cannot access data collected by its customers. However, John Scott-Railton, a researcher at Citizen Lab, said that materials from a lawsuit against NSO support the Polish government’s claims that the manufacturer could access sensitive data. He warned that governments using foreign spyware need to consider the risk that data about their citizens and operations could be exposed to other countries.
What Comes Next
The investigation is ongoing, and Polish prosecutors say they cannot yet confirm if NSO actually obtained specific materials from surveillance operations. The findings have led to criminal charges against former officials and raised questions about the security of using foreign-made surveillance tools. The scandal may also affect Poland’s relationships with technology vendors and its approach to surveillance in the future.
Practical Advice
For ordinary citizens, there is little direct action to take, but the case highlights the risks of unchecked surveillance and the importance of transparency in government technology contracts. For organisations, especially those in government or critical infrastructure, it is a reminder to carefully assess the security and control of any third-party software, especially tools with remote access or data handling capabilities.
Claimed vs confirmed
- Confirmed
NSO Group had access to data collected by Polish authorities using Pegasus.
Polish investigators and the prime minister say NSO Group controlled key parts of the system and had technical access to data.
- Unconfirmed
NSO Group accessed specific surveillance materials.
Polish prosecutors say they cannot confirm if NSO obtained specific materials from surveillance operations.
- Denied
NSO Group cannot access data collected by its customers.
Citizen Lab researcher and Polish investigators dispute this, citing technical findings and legal documents.
The impact
- Money
- The incident could lead to criminal charges and possible fines for former officials. Poland could also face costs related to legal action and changes to surveillance contracts. Under EU GDPR, fines for data breaches can reach €20 million or 4% of annual turnover.
- Reputation
- The scandal has damaged trust in government surveillance and raised questions about the security of using foreign-made tools. It is described as one of the biggest scandals in Poland since the fall of communism.
- Customers
- Over 500 people, including opposition leaders and private citizens, were targeted. Those affected may face privacy risks, and the public is reminded of the importance of oversight in government surveillance.
Why it matters
The case shows the risks when governments use foreign-made surveillance tools. Sensitive information about citizens and political figures may be exposed to outside companies or even foreign governments. It raises questions about privacy, oversight, and the security of national data.
How does it work?
Pegasus is spyware that can infect mobile devices and collect data. In this case, the system’s server module was controlled by the manufacturer, NSO Group, which meant Polish authorities could not fully control or verify the system. Data was sent outside Poland using anonymising networks and foreign servers, giving NSO technical access to the information.
Key points
- Poland’s previous government used Pegasus spyware to target opposition and others.
- Investigators say the spyware maker, NSO Group, controlled key parts of the system.
- Data collected was sent outside Poland, giving NSO technical access.
- Over 500 people were targeted, including political figures and the prime minister’s family.
- The case highlights the risks of using foreign surveillance tools.
Sources
Recorded Future News
Reference
