On 12 October 2026, Prime Minister Donald Tusk called the previous government's Pegasus programme "one of the biggest scandals in Polish history since the fall of communism." Poland's National Prosecutor's Office, drawing on an Internal Security Agency (ABW) analysis, found that the Central Anti-Corruption Bureau (CBA) "did not have full control over the Pegasus system." According to The Record, the server module that infects phones "remained under the manufacturer's exclusive control," and the CBA lacked passwords to many administrative accounts. Data left Poland through an anonymising network of servers abroad.
The findings have limits, and they should be stated plainly. Investigators say NSO had technical access to the surveillance material. They have not established that NSO actually pulled data from specific operations. Tusk's further claims, that NSO collaborates with Israeli intelligence and that data was effectively sent to Israel, are political assertions. The reporting does not independently confirm them. NSO did not respond to The Record's request for comment. It has long told government customers that it cannot see data collected with Pegasus. Law and Justice (PiS) maintains that the tool was used only with court approval against legitimately suspected targets, according to Notes from Poland.
The strongest case for tougher rules
The case for aggressive regulation is serious. Spyware of this kind can read messages and email, track location, and switch on a phone's microphone and camera. Reports say hundreds of people were targeted, including opposition figures. If a foreign vendor can reach the output, a government has handed its citizens' most sensitive data to a private company that answers to another jurisdiction. Courts and oversight bodies then cannot audit what actually happened. Advocates who want a moratorium on spyware argue that no safeguard survives this architecture.
What the EU has and hasn't done
The European Parliament's inquiry into Pegasus (the PEGA committee) already named Poland among the problem states. Its recommendation of 15 June 2023 asked for spyware use only under strict conditions, independent investigations of abuse, support for victims, and an EU Tech Lab for forensic analysis. A preliminary call for a moratorium was dropped in favour of conditions. In November 2023, Parliament strongly regretted the Commission's lack of legislative follow-up. A 2026 Parliament resolution repeats that complaint, so the gap is still open.
The one binding EU rule is narrow. Article 4 of the European Media Freedom Act bars installing intrusive surveillance software on journalists' devices. The exceptions need judicial authorisation and a serious-crime threshold. Most of the Act applied from 8 August 2025. It protects one class of target. It says nothing about who operates the tool or who can reach the data.
The lesson is operational, not just legal
The Polish case is usually told as an abuse-of-power story: who was targeted, and whether a court approved it. That matters, but the prosecutors' finding points to a second failure. A warrant requirement, a judge's signature and an oversight committee all assume the state controls the tool. If the operator cannot verify what the system stores or sends, those controls become procedural theatre.
A pro-innovation, pro-speech approach should not respond with a blanket ban on lawful-intercept technology. Police do need to investigate serious crime on encrypted devices, and a ban would push agencies towards less accountable tools. The better response is to make the safeguards concrete and testable:
- Operator control as a procurement condition. Agencies should have to demonstrate administrative control, including credentials and the ability to audit data flows, before a system is used.
- Data-residency and routing rules. Collected material should stay in infrastructure the state controls and can inspect.
- Independent forensic capacity. The EU Tech Lab idea from the PEGA recommendation would let non-partisan experts check claims like these without relying on the government in power.
- Notification and redress. Targets should be told once an investigation allows it, with a real remedy.
Who bears the risk
The lesson reaches beyond Warsaw. Citizen Lab's John Scott-Railton told The Record that governments using spyware must worry about operational security, and that discovery material from WhatsApp's 2019 lawsuit against NSO supports Poland's account. Any government that licenses a commercial intrusion tool carries the same exposure. Its own secrets and its citizens' data can become reachable by the vendor.
The prosecutors' findings are still an investigative conclusion, not a court judgment. Several former intelligence and security officials face charges, and prosecutors allege the programme was paid for by misusing a fund meant for crime victims. The courts will test the technical claims. Brussels should not wait for that. A narrow, enforceable EU standard on operator control, auditability and notification would address the failure the Polish prosecutors have described, without banning investigative tools.