Spyware scandal rocks Polish government

Several members of political opposition groups in Poland have produced evidence that they were hacked by Pegasus spyware, raising alarming questions about the Polish government’s use of the software.

The most alarming case involved the leader of Poland’s Civic Platform party, Senator Krzysztof Brejza, whose phone was compromised a total of 33 times in the six months leading up to the 2019 election, as reported by the Associated Press. During the campaign, Polish state media published damaging text messages obtained from Brejza’s phone, leading to concerns that spyware had been used.

The compromises were discovered by Citizen Lab, a spyware research group based at the University of Toronto, which has done extensive work on Pegasus. Citizen Lab previously found evidence linking the Pegasus spyware to the killing of Jamal Khashoggi and a separate campaign against a New York Times journalist.

In the Polish case, Citizen Lab also found evidence of spyware compromises targeting a lawyer representing Polish opposition groups and a prosecutor involved in a case against the ruling Law and Justice party. In both cases, traces of Pegasus spyware were found on the targets’ devices.

Despite the evidence, the Polish government has steadfastly denied any use of spyware, either for intelligence gathering or domestic surveillance. “The Pegasus system is not used by the Polish services,” the Deputy Defense minister said recently, as reported by Politico Europe. “It is not used to follow or investigate anyone in our country.”

Still, the scandal is likely to have significant consequences for Poland’s standing in the European Union and build the case for further technical protections against Pegasus. In November, Apple filed a federal lawsuit against NSO Group (which develops and sells Pegasus), seeking a permanent injunction against the company’s use of Apple products and services. Amazon Web Services has blocked all accounts linked with NSO Group, and the US Treasury Department has moved to block exports or other transactions with the company, calling it a threat to “the rules-based international order.”