Poland’s Central Anti-Corruption Bureau (CBA) did not have full control over Pegasus, and the system’s manufacturer had the technical ability to access material gathered through covert surveillance, RMF24 reports. The broadcaster cites a statement from the National Prosecutor’s Office on findings by experts from the Internal Security Agency (ABW). Prosecutors stress, however, that the experts’ reports do not establish whether the manufacturer actually accessed data from specific surveillance operations.
According to the findings reported by RMF24, the CBA did not hold passwords for some administrator accounts, while certain parts of the system remained under the manufacturer’s control. These included the server module responsible for infecting mobile devices, which the manufacturer controlled exclusively. Prosecutors said the bureau’s lack of access to parts of the infrastructure meant it could neither fully control how Pegasus operated nor independently verify how data was collected, transmitted and stored.
Data passed through servers abroad
The experts also found that data transmitted by the system left Polish territory. It travelled through an anonymising network comprising servers in different parts of the world. The manufacturer managed that network, which was outside the CBA’s control. RMF24 reports that the experts identified foreign IP addresses used to transmit data.
The manufacturer’s capabilities extended beyond managing this network. Technical support and updates were carried out remotely, without suspending ongoing surveillance operations. According to the statement cited by RMF24, the manufacturer had full access to the system during this work and could change its software and configuration, giving it the technical ability to access the material collected.
The distinction matters: finding that the system allowed such access is not proof that the manufacturer used it. Similarly, the fact that data passed through foreign servers does not establish that it was disclosed to unauthorised parties. The prosecutors’ caveat concerns precisely what the experts’ reports do not resolve — whether the manufacturer actually accessed material from specific surveillance operations.
Findings in an ongoing investigation
The capabilities described show how extensive the information collected through Pegasus could have been. According to the statement reported by RMF24, the software could be installed on Android and iOS devices without the user’s knowledge or consent. It enabled access to data, as well as use of the phone’s microphone and cameras.
RMF24 says the investigation began on 18 March 2024. It covers the legality of covert surveillance, the collection and use of information, and the system’s security and functionality. According to the broadcaster, seven people have been charged and the investigation remains ongoing. Charges and findings presented during an investigation do not amount to a final court determination of guilt.
