Spyware manufacturer had access to data harvested by former Polish government, current PM says

Polish investigators said they found evidence showing a spyware manufacturer harvested data from Polish opposition leaders and other victims and transmitted it to Israel.

Prime Minister Donald Tusk, who ordered the investigation, on Monday called the sprawling spyware operation spearheaded by the country’s previous ruling party “one of the biggest scandals in Polish history since the fall of communism.” He accused Israel-based NSO Group, the spyware manufacturer involved in the scandal, of collaborating with Israeli intelligence services. 

Tusk’s comments came shortly after Poland’s National Prosecutor’s Office said an analysis by the Internal Security Agency (ABW) had found Poland’s Central Anti-Corruption Bureau (CBA) — which ran the spyware program — “did not have full control over the Pegasus system” that NSO Group operated.

“The server module responsible for infecting mobile devices remained under the manufacturer's exclusive control,” the prosecutor’s office said in a press release.

The CBA also did not have passwords to access many accounts with administrative privileges, according to the press release.

“This prevented full verification of the correct functioning of individual system modules, including those responsible for data transmission and storage,” the press release said. 

The data collected by the spyware company’s software was sent outside of Poland by an anonymizing network relying on servers located abroad, prosecutors said. The Polish probe found that data was transmitted via foreign IP addresses. 

NSO therefore had “technical access” to information gathered from operational inspections, the press release said. Updates and technical support were supplied to Polish officials through a remote connection.

“During this work, operational inspections were not interrupted, and the manufacturer had full access to the system, including the ability to make changes to its software and configuration,” the press release said.

Polish investigators cannot say if NSO “actually obtained access to materials from specific operational inspection,” according to prosecutors.

A spokesperson for NSO Group did not respond to a request for comment.

In February 2024, Tusk’s government announced investigators had confirmed Pegasus was used to target a “very long” list of victims. Tusk revealed his own wife and daughter were spied on and that devices belonging to more than 500 others were targeted and, in some cases, infected.

Several former intelligence and security officials are facing charges for facilitating the spyware abuses, which were allegedly paid for by misappropriating a government fund meant to be spent on crime victims.

In a searing critique of the former officials behind the Pegasus deployment, Tusk reportedly said “they paid money for a system that de facto transferred all possible data on Polish citizens, Polish opposition leaders and Polish independent prosecutors…to the Israeli side.”

“This is no longer [just] a scandal… We’re talking about a crime against the state.”

The findings show that countries using spyware have to be worried about operational security, Citizen Lab researcher John Scott-Railton said in an interview with Recorded Future News.

NSO has long promised government customers it can’t access data collected by Pegasus, but Railton said discovery materials made public in a lawsuit WhatsApp filed against the spyware company in 2019 support the Polish government’s claims.

Governments deploying spyware must consider whether their “sensitive information, including information about who they may be targeting, and also their citizens' information, is being exposed to foreign entities,” Scott-Railton said. “This cuts right to the heart of not only the value proposition of acquiring foreign spyware, but also the risks to the government that's wielding it.”