● Covered by 1 source · 1 reportMedium impact1 negative
Polish PM states spyware manufacturer accessed data harvested by former government
Key points
- Polish investigation found NSO Group had technical access to data.
- Former Polish government's CBA lacked full control over Pegasus system.
- NSO Group controlled the infection module and administrative passwords.
- Data was transmitted outside Poland via foreign IP addresses.
Investigation Reveals Spyware Manufacturer Access
Polish Prime Minister Donald Tusk announced that an investigation into the use of Pegasus spyware by the previous government revealed the manufacturer, NSO Group, had technical access to harvested data. Tusk described the operation as a significant scandal in Polish history since the fall of communism.
Lack of Control by Polish Authorities
The National Prosecutor's Office stated that the Central Anti-Corruption Bureau (CBA), which operated the spyware program, did not have full control over the Pegasus system. The server module responsible for infecting mobile devices remained under NSO Group's exclusive control. Additionally, the CBA did not possess passwords for many administrative accounts.
Data Transmission and External Access
The investigation found that data collected by the spyware was sent outside of Poland through an anonymizing network using foreign servers and IP addresses. This setup provided NSO Group with "technical access" to information gathered from operational inspections. NSO Group also provided updates and technical support remotely, maintaining full access to the system and the ability to modify its software and configuration during these operations.
Uncertainty Regarding Actual Data Access
While NSO Group had technical access, Polish investigators cannot definitively confirm if the company "actually obtained access to materials from specific operational inspection." NSO Group has not responded to requests for comment regarding these findings.
Broader Implications
This development follows Tusk's earlier announcement in February 2024 that Pegasus was used to target a "very long" list of victims, including his own wife and daughter, and devices belonging to over 50 individuals. The findings underscore concerns about the security and sovereignty of data when third-party spyware is employed by government agencies.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Polish Prime Minister Donald Tusk announced that an investigation found the spyware manufacturer NSO Group had technical access to data collected by the former Polish government's use of Pegasus spyware. The Central Anti-Corruption Bureau (CBA) lacked full control over the system, with NSO Group maintaining exclusive control over the infection module and access to administrative privileges, raising concerns about data security and potential foreign access to sensitive information.