Human rights group confirms that Polish senator was hacked by spyware

Amnesty International stated that it has independently confirmed that the powerful spyware of an Israeli company was used to invade a Polish senator who was running for the opposition’s 2019 parliamentary campaign.

The Associated Press reported last month that the Citizen Lab, an Internet surveillance organization at the University of Toronto, discovered that Senator Krzysztof Brejza and two other Polish government critics were invaded by NSO’s Pegasus spyware.

A global media consortium discovered dozens of high-profile cases last year in which NSO Group malware was used to eavesdrop on journalists, politicians, diplomats, lawyers, and human rights activists from the Middle East to Mexico.

Polish hackers were considered particularly shocking because they did not occur in authoritarian countries, but in EU member states.

The leaders of the legal and judicial departments denied knowing about the hacking, and sometimes ridiculed the findings of the report, and refused to launch an investigation.

NSO Group did not disclose the identity of its customers, but stated that it only sells Pegasus to the government to combat terrorism and other serious criminal activities. Spyware allows its operators to erase everything from instant messages and contacts to photos, and turn microphones and cameras into real-time spying tools.

Polish Prime Minister Mateus Morawiecki called the Citizen Lab-Associated Press investigation results “fake news” and suggested that foreign intelligence agencies could conduct espionage — the idea was refuted by critics, they said No other government would be interested in Poland’s three goals.

John-Scott Railton, a senior researcher at Citizen Lab, said, “If (Polish government leaders) really believe that this may be the behavior of a foreign service agency, then not conducting an investigation would be the most irresponsible behavior.”

The Citizen Lab determined last month that the senator’s cell phone was hacked 33 times by Pegasus hackers in 2019, most of which was an opposition campaign launched in Brejza to overthrow the government led by the Ministry of Law and Justice.

The text messages stolen from Breza’s phone were tampered with and broadcast on state-controlled television. As part of the slander campaign when the election was fierce, the populist ruling party continued to win by a narrow margin. Brejza compared these actions with the tactics used by Russia against Kremlin critics and opposition leader Alexei Navalny.

Donncha O’Cearbhail, an expert at the Amnesty International Security Laboratory, said that he confirmed the findings of the Citizens Laboratory after receiving the original copy of the Brejza phone provided by Canadian researchers. Amnesty uses independently developed tools and methods for forensic analysis.

Brejza told the Associated Press that he believes that the real victims of hacking are Polish voters, who have been “deceived” by law and justice and “deprived of the right to fair elections.”

The two other Polish targets identified by the Citizen Lab are Roman Giertych, a lawyer representing opposition politicians in politically sensitive cases, and Ewa Wrzosek, an independent-minded prosecutor.

Last month, Wrzosek formally requested the Warsaw District Attorney’s Office to investigate the hacking of her mobile phone. The office refused, saying Wrzosek refused to hand over her mobile phone to justify its decision.

She said that she did not give up the phone because she did not trust the prosecutor’s office and wanted to participate in the evaluation of the device. “According to the law, this is my right,” Wrzosek told The Associated Press.

In November, the Israeli financial newspaper Calcalist reported that the country’s Ministry of National Defense has drastically reduced the list of countries to which Israel-produced spyware can be exported. The newspaper did not say that Poland was one of the countries removed from the list, but it was not among the approved countries mentioned in the report.

Hungary is another EU member, and Pegasus of the NSO Group is confirmed to be used against non-criminals and is not on the shortened list.

The Israeli Ministry of Defense stated that Calcalist’s report was inaccurate, but did not elaborate.


Josef Federman of Jerusalem and Frank Bajak of Boston contributed to this report.