Polish senators draft law to regulate spyware after anti-Pegasus testimony

Senate commission plans reform after hearing how NSO software used against government critics

Polish senators plan to draft a law that would regulate the use of surveillance technology in the country, after hearing testimony of how the invasive Pegasus spyware has been used against a number of government critics.

Poland is the latest country where Pegasus, a surveillance tool developed by Israeli company NSO, appears to have been used for political purposes. Pegasus allows the operator to take control of a target’s mobile device, to access all data even from encrypted messaging apps, and to turn on audio or video recording.

Gabriela Morawska-Stanecka, deputy speaker of the senate and a member of a commission set up to investigate the allegations, described Pegasus as a “cyberweapon” and said the way it had allegedly been used in Poland was completely inappropriate.

Related: What is Pegasus spyware and how does it hack phones?

“It should only be used for the most serious crimes such as terrorism,” she said, in an interview in her senate office. “It shouldn’t be the case that you can’t feel safe in your own home, your own bathroom or your own bedroom.”

The Polish Pegasus scandal was first reported last month by the Associated Press, after an investigation by the University of Toronto’s Citizen Lab, which found Pegasus had been used against at least three people, including opposition senator Krzysztof Brejza.

Forensic analysis of his device showed it had been compromised numerous times in 2019 while he was running the electoral campaign of the opposition Civil Platform party. Brejza told the commission last week that the dates of the attacks “coincided 100% with the election calendar” and stopped a few days after the vote.

Law and Justice, the lead party in the current ruling coalition, has boycotted the commission in the opposition-led senate.

Citizen Lab also confirmed that the devices of lawyer Roman Giertych and prosecutor Ewa Wrzosek had been targeted. Wrzosek is a member of Lex Super Omnia, an association of prosecutors fighting for the independence of the prosecutors office. “In my opinion, there was no legal or factual basis to authorise the surveillance of me with the Pegasus, and the secret service officers who did so committed a crime,” said Wrzosek.

Wrzosek said she infuriated the government by attempting to launch an investigation into the circumstances of holding a presidential election during the early stages of the Covid pandemic in 2020.

“The investigation was taken away from me and discontinued after three hours, and because of this I was facing harassment,” she said. In January last year, she was transferred to a prosecutor’s office several hours’ drive away from her home.

Poland has been embroiled in a long-running battle with Brussels over changes which have undermined the independence of the judiciary.

“Wrzosek is one of only a few independent prosecutors, and she had a media profile. Probably she simply became a personal enemy,” said Adam Bodnar, dean of the law faculty at SWPS University in Warsaw and Poland’s former human rights ombudsman.

Poland’s Central Anti-Corruption Bureau, the CBA, bought Pegasus in 2017 using funds from the Ministry of Justice, according to documents presented to the hearing by the former head of the supreme audit office.

The CBA, in a statement, declined to confirm whether the agency had acquired Pegasus, or whether it was used against Wrzosek and others. However, it said any use of surveillance would have “obtain[ed] the legally required consents, including the court’s consent”.

An NSO spokesperson declined to say if the company had sold Pegasus to Poland, citing a company policy of not confirming or denying its clients. It claimed the company had “zero tolerance” for the use of its spyware against political targets.

Jarosław Kaczyński, the chairman of Law and Justice, admitted in a recent interview with Sieci magazine that Poland had acquired the tool, but dismissed allegations that it had been used for political purposes as “nonsense”.

Some have argued that all use of Pegasus is illegal according to current Polish law, but rights advocates say the real issue is broader, and fits into a pattern of Poland’s government trampling on democratic norms.

“Judges have no tools to realistically check whether the services are abusing their powers, and there is no one who could verify it later,” said Wojciech Klicki of the Panoptykon Foundation, a Polish NGO focusing on technology and surveillance.

Related: Rights groups urge EU to ban NSO over clients’ use of Pegasus spyware

Poland’s government is one of many now faced with calls to regulate the use of Pegasus and similar tools. Dozens of rights organisations have called on the European Union to impose sanctions on NSO Group. In November, the Biden administration announced it was putting the Israeli company on an export blacklist, saying its tools had been used for “transnational repression”.

Last year, a group of media organisations, including the Guardian, reported on the use of Pegasus against journalists, activists and politicians in numerous countries across the world. Forensic analysis of telephones showed that in Hungary, journalists, activists and lawyers had been targeted with Pegasus.

In Poland, Klicki said he hoped the senate commission would draft “a comprehensive reform of control over secret services”.

There is little chance of such a law passing through the government-led lower chamber of parliament, but the opposition-controlled senate could draft a law that would allow a future government to adopt it.

Morawska-Stanecka said the commission planned to work on this new draft law, and would also hear from legal experts about whether the use of Pegasus against Brejza, while he was running the opposition campaign, meant the 2019 election result could be deemed to have influenced the fairness of the vote.

“We knew the 2019 elections weren’t a fair fight, because of the abuse of public media in favour of the ruling party, but we couldn’t have guessed that the secrecy of campaign work could be stolen using secret surveillance,” she said.