Poland’s Pegasus scandal has exposed a weakness beyond the controversial choice of surveillance targets: the state did not retain complete control over the system processing the information it collected. Findings reported on 14 October 2026 indicate that NSO Group, the Israeli maker of Pegasus, had technical access to data gathered while opposition politicians and other citizens were being monitored.
The findings do not establish that NSO Group obtained material from any particular surveillance operation. They do show that information passed through servers controlled by the manufacturer, while Poland’s Central Anticorruption Bureau lacked full control over how the system operated. That distinction is central to the case: a possible route to sensitive information has been identified, but a specific transfer has not been proved.
Prime Minister Donald Tusk called the affair one of the biggest scandals in Poland’s history since the fall of communism. The controversy now combines two separate questions. Why was Pegasus used against opposition figures and other citizens during the rule of the Law and Justice party, or PiS? And how much control did Polish institutions have over the technical infrastructure behind the operation?
The vulnerability was built into the system
Pegasus is designed to penetrate targeted devices and extract information from them. In the Polish arrangement described by the reported investigation, the resulting data did not remain within an entirely self-contained system operated only by national authorities. It moved through servers under NSO Group’s control, giving the company technical access to the information passing through the infrastructure.
Technical access is not the same as confirmed possession. The findings do not show that NSO Group read or retained particular conversations, messages, contact lists or investigative files collected from named targets. Nor do they demonstrate that the company passed such material to a foreign intelligence service. What they reveal is a gap between formal state responsibility for surveillance and practical control over the software and servers that handled its output.
That gap matters even without evidence of a completed data leak. A surveillance system can expose more than the private communications of its targets. Its records may also reveal whom the authorities are investigating, which operations are under way, what methods are being used and how security services organise their work. Control of the data route is therefore part of the security of the operation itself.
In this case, the Central Anticorruption Bureau was not in a position to control every aspect of the system’s functioning. The arrangement created a potential channel through which highly sensitive information could become accessible outside the immediate authority of the Polish state. The reported findings identify that structural risk; they do not turn it into proof that specific files left Polish control.
A technical issue rooted in a political dispute
The infrastructure question cannot be separated from the circumstances in which Pegasus was used. During the period when PiS governed Poland, the software was deployed against opposition politicians and other citizens. The reported findings therefore add a national-security concern to an already contested debate over whether state surveillance powers were used in political competition.
The available information does not establish that every operation had a political motive. It does, however, raise questions about who approved the surveillance, how targets were selected and what safeguards were applied. For people who were monitored, the immediate issues are privacy and the protection of their communications. For the state, the concern extends to the confidentiality of its own investigative priorities and operational methods.
The reported involvement of PiS members in arranging the technical access gives the issue additional political weight. It does not, by itself, prove that NSO Group or any foreign service received surveillance files. The narrower and better-supported conclusion is that a politically sensitive surveillance programme relied on an infrastructure that Polish authorities did not fully control.
What the new findings change
Coverage published on 14 October, including by the specialist outlet The Record, shifts the focus of the Pegasus affair. The first question was largely about the people targeted and the legality of monitoring them. The second is about the conditions under which a foreign technology company became part of a state system collecting exceptionally sensitive information.
That is a question of more than ownership or procurement. A government can retain legal responsibility for an operation while depending on an outside supplier for the software, servers and data flows that make it possible. In practice, authority over the surveillance programme may then be divided: Polish officials decide how the tool is used, but a foreign company remains embedded in the mechanism that processes what the tool produces.
For national security agencies, that division creates a difficult standard of accountability. It is not enough to know who is authorised to deploy surveillance. Officials must also be able to establish who can access the resulting information, where it is processed and whether the supplier can intervene in the system’s operation.
The reported investigation has answered only part of that question. It points to technical access and incomplete state control, not to a proven transfer of data from specific operations. Whether further inquiries establish that concrete material was actually obtained outside the Polish authorities’ control remains unresolved. The immediate consequence is already clear: Poland’s surveillance safeguards depended not only on its own institutions, but also on the design and control of software supplied from abroad.
