Poland launches inquiry into previous government’s spyware use

Poland has launched an investigation into its previous government’s use of the controversial spyware Pegasus, with a parliamentary inquiry under way and the possibility of criminal charges being brought against former government officials in future.

Adam Bodnar, Poland’s new justice minister, told the Guardian that in coming months the government would notify people who were targeted with Pegasus. Under Polish law, they would then have the possibility of seeking financial compensation, and becoming party to potential criminal proceedings.

“There is a decent chance that within a couple of months we’ll have quite extensive knowledge how this equipment was used and for what purpose,” said Bodnar.

On the possibility of future legal action, he added: “We don’t know who will be accused … if the investigation goes into the direction of accusing some persons, some ministers or officers of the security services.”

Pegasus is a powerful tool designed by Israeli company NSO Group. It is capable of taking control of a target’s mobile phone, accessing data from secure messaging apps and even turning the device into a recorder.

In 2021, a consortium of media outlets, including the Guardian, accessed a data leak that showed thousands of phone numbers that were targeted by Pegasus in various countries. It also revealed that the spyware tool had been used against media and civil society in numerous places, including in Hungary under the prime minister, Viktor Orbán.

Later that year, a separate investigation by the University of Toronto’s Citizen Lab revealed the use of Pegasus in Poland, including against targets linked to the Civic Platform party, then in opposition and now the main party in the governing coalition after parliamentary elections last October. The alleged targets included MEP Krzysztof Brejza, who at the time was running an election campaign for Civic Platform.

After the coalition, led by Civic Platform’s Donald Tusk, won Poland’s parliamentary elections last autumn, the new government promised to investigate alleged abuses of office by the rightwing nationalist Law and Justice (PiS) administration. The new authorities have replaced the management of state-controlled television, and set in train moves that could lead to the governor of the central bank, PiS ally Adam Glapiński, being removed from his post.

The parliamentary commission on Pegasus has begun amid widespread speculation of who else may have been targeted by the software. Magdalena Sroka, the MP heading the parliamentary commission, said after the first meeting of the panel: “Too long we’ve been lied to about Pegasus by PiS and we’re going to get to the bottom of it now.”

Bodnar – a lawyer and former human rights ombudsman appointed by Tusk as justice minister – said the full list remained confidential for now, but added that it included many more well-known peoplethan the few political figures already named. “This list is significantly more extensive than the list that has been made public already, a lot of other interesting public people,” he said.

Because Pegasus may also have been used in legitimate criminal investigations, it would be inappropriate simply to release a list of targeted numbers, said Bodnar. “You cannot just give away this data, even if the spyware is illegal,” he said.

Instead, the justice ministry and intelligence services plan to make a judgment on cases that appear to have been politicised or abusive and inform people individually by letter that they had been targeted. Then the person can make a decision themselves on whether to go public with the information or join in future legal action over the surveillance.

The legal side of the use of Pegasus also requires further investigation. Experts say that while court orders for surveillance were usually obtained, judges were not given full information about what exactly they were signing off on.

Bodnar said: “Apparently all those requests for using Pegasus had court authorisation, but most probably the courts didn’t know what kind of equipment would be used … They were authorising this but they did not know that [it involved] a programme that doesn’t have proper authorisation, and the data is going to Israel.”

Wojciech Klicki, a lawyer and activist with the Panoptykon Foundation, noted that judges would typically not even see the name of the person for whom they were approving a court order for surveillance.

“The system is constructed in a way that encourages judges to make automatic approvals of surveillance requests,” he said, during a recent panel discussion on the topic. “In the past couple of years the Warsaw district court saw a couple of dozen surveillance applications being submitted every day,” he added.

Polish authorities are believed to have stopped using Pegasus in 2021, around the time the Guardian and others publicised details of the spyware, including revelations that the numbers targeted by clients were also logged by NSO Group, creating a potential security breach.

The parliamentary inquiry is calling several key figures from the previous PiS government to give testimony, and has already taken testimony from PiS chairman Jarosław Kaczyński.

Klicki said that while it was important to uncover abuses of the past, he hoped the parliamentary commission would also tackle improving the legal framework long term. “It is equally important to look into the future … Otherwise we will forget that these technologies are evolving,” he said.

Additional reporting by Katarzyna Piasecka