Threat intel

On October 12, Poland's National Prosecutor's Office published findings from experts at the forensic research bureau of the Internal Security Agency (ABW). Their conclusion: the Central Anti-Corruption Bureau (CBA), which bought and ran NSO Group's Pegasus spyware from 2017, "did not have full control over the Pegasus system". The CBA lacked passwords for some accounts with administrative privileges, and the server module that infects phones "remained under the manufacturer's exclusive control".

The prosecutors' statement also says data from the system left Poland through an anonymising network of servers in several countries, run by NSO and outside the CBA's control, using foreign IP addresses. For anyone who runs vendor-managed software that touches sensitive data, this is a rare official, forensic description of what it looks like when the customer operates a system but the supplier still administers it.

What the prosecutors and ABW experts found

The findings come from an investigation running since 2024 and were announced by National Prosecutor's Office spokesman Przemysław Nowak. As reported, they cover four areas.

• Administration. The CBA did not hold passwords for some accounts with administrative privileges on its own installation.
• Infection. The server-side component that delivers the exploit to target phones was under NSO's exclusive control.
• Egress. Data was routed through what the prosecutors call an anonymising network, with servers in various parts of the world managed by the manufacturer. The experts identified the foreign IP addresses the system used to send data.
• Maintenance. Technical support and updates were done over a remote connection, and the manufacturer could change the software and its configuration.

From this the prosecutors conclude that NSO had "technical access" to material from operational surveillance. They are explicit about the limit: the experts did not determine whether NSO actually obtained material from any specific operation. Nothing published so far shows that NSO read or copied a particular target's data.

Who said what

The political claims go further than the forensic findings, and they need separating.

Prime Minister Donald Tusk called the affair "a crime against the state" and "one of the biggest scandals in Polish history since the fall of communism". He said it is "beyond any doubt" that NSO cooperates with Israeli intelligence and that data on Polish citizens was transferred to the Israeli side. That is his assertion. It is not in the prosecutors' findings, and Berliner Zeitung notes that no public evidence was given that Israeli agencies accessed the data.

Law and Justice (PiS), which was in government when Pegasus was bought, says the tool was needed to fight serious crime and protect national security and was used only with court approval. Former CBA head Ernest Bejda, one of those charged, denies the allegations and says the system stayed under CBA control. NSO did not respond to The Record's request for comment.

On the criminal side, prosecutors charged former ABW head Piotr Pogonowski and former Military Counterintelligence Service (SKW) head Maciej Materka in February 2026 with failing in their official duties, for allowing Pegasus to be used while knowing it lacked the required IT security accreditation. Each faces up to three years in prison, and both deny wrongdoing. Bejda has been charged with the same offence. Separately, a parliamentary committee found that the CBA never obtained IT security accreditation for Pegasus and that courts authorising surveillance were not told the tool could take over a phone's entire contents.

Why the architecture matters

On paper the CBA operated Pegasus. The ABW findings describe something closer to a managed service. The part that does the most sensitive work, infecting a phone, ran on infrastructure only the vendor controlled. Collected data passed through a vendor-run relay network before it reached the customer. The vendor connected remotely for support and updates and could change the code. The customer could not even inspect every admin account on its own installation.

None of that requires bad intent from a vendor to be a problem. It means the customer cannot prove where its data went, cannot rule out access, and cannot audit the system it is legally responsible for. The same pattern shows up in ordinary IT: remote monitoring agents with vendor-held admin accounts, appliances that phone home for "telemetry", SaaS connectors whose relay servers sit in another jurisdiction, and support contracts that include standing remote access.

What to do if you deploy vendor-managed or sensitive tooling

Each item below maps to one of the gaps the ABW experts described.

Hold every admin credential

Inventory every privileged account on the system, including vendor service accounts and break-glass accounts set at installation. The organisation, not the supplier, should hold the passwords or keys, ideally in a vault with dual control, and rotate them after every vendor session. If the vendor refuses to hand over an admin account, write that refusal down as a risk acceptance signed by whoever owns the data.

Allow-list and log egress

Put the system behind a firewall policy that permits outbound traffic only to named destinations, and log every flow, with DNS queries, to a log store the vendor cannot reach. Alert on connections to anonymising networks (Tor entry nodes, commercial VPN ranges) and to IP addresses outside the countries in your contract. The Polish experts identified the foreign IP addresses in a forensic review years later; you want that list in real time.

Write audit rights into the contract

The contract should give you the right to inspect the full system, including any server components the vendor hosts; name the countries where data may be processed or relayed; require notice before remote sessions; and require session recording for every vendor login. Remote support should be a session you open and close, through a jump host you control, never standing access. In Poland, the vendor's update sessions came with the power to change software and configuration.

Keep a kill switch and test it

Know how to cut the system off from the vendor (a firewall rule, a revoked certificate, a disabled account) without losing your own data, and rehearse it. Keep an exportable copy of logs and collected records under your control so that cutting the vendor off does not also cut off your evidence.

Protect people likely to be targeted

Executives, lawyers, journalists and staff working on sensitive cases should run the hardened phone modes. On iPhone that is Lockdown Mode (Settings, Privacy & Security, Lockdown Mode, Turn On & Restart). On Android 16 it is Advanced Protection (Settings, Security & privacy, Advanced Protection, then Device protection), which blocks sideloading and 2G connections and tightens Chrome. Both break some features, so test before rolling out.

For suspected compromise, Amnesty International's Mobile Verification Toolkit (MVT) checks iOS backups and Android devices against published indicators, including Amnesty's Pegasus set. mvt-ios download-iocs fetches the public indicators, and mvt-ios check-backup --output /path/to/output/ /path/to/backup/ analyses an encrypted iTunes or Finder backup. The MVT documentation says the tool is for investigators, not self-assessment, and a match is a lead to verify by hand, not proof of infection.

The wider lesson

Risk reviews for supplier tools usually ask whether the vendor is trustworthy. The Polish findings show a more useful question: what can the vendor do on this system without us knowing? If the answer includes unmonitored egress, admin accounts you cannot open or code changes you cannot see, the vendor shares control of the system with you.

Our compliance and audit readiness work maps vendor access, contracts and data flows for systems like these, and our safeguarding and hardening team sets up egress controls and hardened devices for high-risk staff. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: The Record, Notes from Poland, Brussels Signal, Berliner Zeitung, xyz.pl, Forklog, Notes from Poland, February 2026 charges, Al Jazeera, MVT documentation, EFF on Android Advanced Protection.