Poland's current government says an investigation found that NSO Group, the Israeli maker of Pegasus spyware, had technical access to data collected by the previous administration's surveillance program. The National Prosecutor's Office said the Central Anti-Corruption Bureau did not have full control over the system; the server module responsible for infecting mobile devices remained under NSO's exclusive control.
Data was sent outside Poland through anonymizing networks and foreign IP addresses, and NSO provided updates via remote connections without interrupting operations. Prosecutors said the manufacturer had full access to the system and could change its software and configuration. However, they could not determine whether NSO actually obtained materials from specific inspections.
Prime Minister Donald Tusk described the operation as one of the biggest scandals since the fall of communism and accused NSO of collaborating with Israeli intelligence. The investigation previously confirmed Pegasus was used against more than 500 people, including Tusk's wife and daughter. Several former officials face charges related to the abuses.
Citizen Lab researcher John Scott-Railton said the findings show governments using foreign spyware must consider whether sensitive information is exposed to foreign entities. He noted that discovery materials in a WhatsApp lawsuit against NSO support the Polish government's claims, despite NSO's assurances that it cannot access Pegasus data.