Polish investigators found that the Central Anti-Corruption Bureau (CBA) did not fully control the Pegasus spyware system it operated. Key infrastructure remained under manufacturer NSO Group’s control, while surveillance data traveled outside Poland through servers abroad and foreign IP addresses, according to National Prosecutor’s Office findings reported by The Record.
Prosecutors said NSO had “technical access” to information collected during operational surveillance. That finding establishes the company’s ability to reach the system, but not that it viewed or obtained material from particular operations. Investigators said they could not determine whether NSO accessed data from any specific operational inspection.
CBA lacked control of infrastructure and administrator accounts
An analysis by Poland’s Internal Security Agency (ABW) found that the CBA did not have complete control over its Pegasus deployment.
The server module used to infect mobile devices remained exclusively under the manufacturer’s control. The CBA also lacked passwords for many accounts with administrative privileges, limiting its ability to verify how individual modules handled data transmission and storage.
NSO delivered updates and technical support through remote connections. Prosecutors said operational surveillance continued during that work while the manufacturer had full system access, including the ability to alter software and configuration.
The collected information was routed outside Poland through an anonymizing network that relied on foreign servers. Investigators also identified transmissions through foreign IP addresses. The prosecutors’ reported findings do not establish that those routes delivered specific surveillance materials to NSO or to Israeli authorities.
Devices belonging to more than 500 people were targeted
In February 2024, Prime Minister Donald Tusk’s government announced that investigators had confirmed Pegasus was used against a “very long” list of targets. Tusk said his wife and daughter had been spied on. He also said devices belonging to more than 500 other people were targeted and, in some cases, infected.
The figure therefore refers to more than 500 people whose devices were targeted. It is not a count of confirmed infections or cases in which information was obtained.
On Monday, Tusk described the operation run under the previous ruling party as “one of the biggest scandals in Polish history since the fall of communism.” He accused NSO Group of collaborating with Israeli intelligence services and alleged that data concerning Polish citizens, opposition leaders and independent prosecutors had been transferred to the Israeli side.
Those accusations are broader than the prosecutors’ technical conclusion. The official findings, as reported, show foreign data routes, vendor-controlled components and NSO’s capacity to access the system. Investigators could not establish that NSO obtained material from specific surveillance operations.
Former officials face charges over Pegasus abuses
Several former Polish intelligence and security officials face charges for allegedly facilitating abuses involving the spyware. Prosecutors allege that the operation was financed by misappropriating a government fund intended to support crime victims.
NSO Group did not respond to The Record’s request for comment.
Citizen Lab researcher John Scott-Railton told the publication that the findings raise operational-security concerns for governments using commercial spyware. He said material disclosed through WhatsApp’s lawsuit against NSO, filed in 2019, supports the Polish government’s claims and conflicts with NSO’s longstanding assurances that it cannot access data collected by Pegasus customers.
Vendor access creates risks for governments and surveillance targets
The findings expose a security problem for agencies purchasing foreign spyware: the customer may be unable to verify how the system operates when the supplier controls infection infrastructure, administrator credentials, software updates or remote support.
That arrangement can place both surveillance data and information about selected targets within reach of a foreign vendor. It can also prevent the operating agency from independently auditing data routes, storage components and configuration changes.
For the people targeted in Poland, the investigation does not show that every attempted compromise succeeded or that NSO accessed each person’s information. It does show that the CBA could not fully inspect or control the surveillance platform it used against them.
