Poland's National Prosecutor's Office formally asked the United States on July 27, 2026 to extradite former justice minister Zbigniew Ziobro, who fled to America in May after Hungary's newly elected government moved to strip the political asylum his predecessor had granted him. Ziobro faces 26 alleged offenses in Poland; the extradition request itself covers 19 of them, chief among them leading an organized group inside his own ministry and abusing his office as both justice minister and prosecutor general (Notes From Poland).
The charge sheet filed by prosecutors when they sought to lift Ziobro's parliamentary immunity in October 2025 is specific about one transaction: a 25 million zloty transfer from the Justice Fund — money statutorily earmarked to compensate crime victims — routed to Poland's Central Anti-Corruption Bureau for what the filing calls "special operational techniques" (Prokuratura Krajowa). Polish reporting has long identified that transaction as the financing mechanism for the Bureau's 2017 purchase of NSO Group's Pegasus spyware. A parliamentary and Senate-commissioned review later found Polish security services deployed "end device operational surveillance" against 578 people between 2017 and 2022, a list that came to include opposition politicians, their lawyers, and journalists (Notes From Poland).
The Case for Tighter Controls
The strongest argument against Israel's export regime is exactly what Poland now alleges: a tool licensed for counterterrorism and serious-crime investigation ended up pointed at a governing party's domestic political rivals, inside a NATO and EU member state, financed by diverted victim-compensation funds. If Pegasus can be misused this badly by a European democracy's own justice minister, critics argue, no end-user declaration is worth much and the burden should fall on the seller to restrict sales far more aggressively than it has.
That argument has already reshaped Israeli policy once. Sales require a license from the Defense Export Control Agency (DECA) under the Defense Export Control Law of 2007, which weighs national security, foreign policy, international commitments, and human rights among nine statutory considerations (DECA, Israel Ministry of Defense). After the 2021 Pegasus Project revelations and reporting that Israeli police used the tool on protesters without proper authorization, the ministry cut its approved list of cyber-export destinations from 102 countries to 37, dropping Saudi Arabia, the UAE, Mexico, and Morocco (The Record). Poland — a fellow democracy under the pre-2021 list — was never the kind of buyer that restriction was built to screen out, which is the real lesson here: export controls filter regime type, not what a minister does with a tool once it's inside a friendly government's own security services.
Where the Accountability Actually Belongs
Poland's extradition request is, in effect, a demonstration that the export-control framework worked as designed — and that the failure was domestic.
DECA's licensing regime cannot audit a foreign justice ministry's internal fund transfers, vet whether a purchase order was approved through legitimate channels, or police how a democratically elected government uses a lawful national-security tool against its own opposition. That is squarely a matter of Polish institutional design — court-ordered surveillance warrants, parliamentary oversight of the Anti-Corruption Bureau, and controls on a discretionary victims' fund that, on prosecutors' own account, a single minister could redirect toward a spyware purchase with minimal friction. Poland's current government is now doing the right thing by prosecuting that failure through its own courts and seeking Ziobro's return, rather than treating it as grounds to demand Israel unilaterally revoke a license granted to a NATO ally in 2017.
The vendor itself is separately facing consequences that have nothing to do with export licensing. NSO Group is under a permanent US federal injunction, issued October 17, 2025, barring it from targeting WhatsApp, after a jury found it liable for the 2019 intrusion that compromised roughly 1,400 accounts; the court ordered NSO to destroy any code built against Meta's platforms, though it cut the jury's $167 million punitive award to $4 million (The Times of Israel). Between that injunction, DECA's post-2021 country list, and now a criminal extradition case aimed squarely at the government official who allegedly misdirected public funds to buy the tool, the accountability architecture around Pegasus is arguably functioning across all three layers it needs to: courts punishing the vendor's own conduct, export law narrowing who can buy, and domestic prosecution reaching the official who misused a lawful purchase.
The policy risk is conflating those layers. Treating Ziobro's alleged fraud as proof Israel's licensing regime is broken invites a response — blanket sanctions on the entire lawful cyber-intelligence export sector — that would not have stopped a sitting justice minister from misappropriating his own country's crime-victims fund, and would strip legitimate democracies of tools genuinely needed against terrorism and serious crime. The tighter, more proportionate response is the one already underway: let Washington rule on extradition, and let Polish courts do what DECA licensing was never designed to do.