Courts authorising covert surveillance were not informed of Pegasus’s full capabilities, according to findings from Poland’s parliamentary inquiry presented by its chair, Magdalena Sroka. RMF24 reports that judges questioned by the committee said they had not known the tool could access the entire contents of a phone, including historical data.
In a report published on 12 October, RMF24 quotes Sroka discussing the committee’s report. According to the chair, judges testified that they had been unaware of the extent of access to messages, photographs, contacts and location data. The central issue is therefore what courts knew about the tool’s technical capabilities when they authorised surveillance.
The distinction matters: not being told about Pegasus’s capabilities does not mean courts were unaware of the purpose of the surveillance. The testimony described by Sroka concerns the extent of access to phone data. Nor does the account establish that the finding applies to every court authorisation.
Concerns over the system’s security
Sroka also presented findings concerning IT security accreditation. According to the committee, Pegasus did not obtain the required accreditation, and Poland’s Central Anti-Corruption Bureau (CBA) did not ask the Internal Security Agency (ABW) to carry out the process. The committee’s assessment is that the system was used without meeting requirements under legislation protecting classified information. These are the committee’s findings, not a final court ruling.
A separate issue concerns control over the infrastructure and material obtained from phones. According to the findings cited by Sroka, some infrastructure remained under NSO Group’s control, data was transmitted through foreign IP addresses, and the manufacturer had the ability to access material gathered through covert surveillance. The ability to access that material does not, however, prove that the manufacturer actually did so. We previously covered this issue in our article on findings that the CBA did not have full control over Pegasus.
According to RMF24, the public section of the committee’s report runs to 370 pages. The remaining section is due to be presented during closed committee proceedings. The latest reporting focuses primarily on judicial oversight: according to the committee, judges made decisions without being told the full range of data the system could access.
