The National Prosecutor's Office informed about the findings of experts from the Internal Security Agency in the investigation into the Pegasus system. They show that the CBA did not have full control over the Pegasus system. "The CBA did not have access passwords to some accounts with administrative privileges, and some elements of the system remained under the control of the software producer (a private Israeli company)," we read in a statement from the National Prosecutor's Office. As emphasized, the server module responsible for infecting mobile devices remained under the exclusive control of the manufacturer.
Moreover, experts from the Internal Security Agency found that the data sent through the Pegasus system left the territory of Poland. They were sent via the so-called anonymizing network covering servers located in different parts of the world. This network was managed by the system manufacturer and remained outside the control of the CBA. Experts revealed foreign IP addresses used by the system to transmit data.
Moreover, as experts from the Internal Security Agency found, the manufacturer of the Pegasus system had technical access to materials from operational inspections. "Technical support and updates were provided via remote connection. During this work, operational checks were not interrupted, and the manufacturer gained full access to the system, including the ability to make changes to its software and configuration," it was written.
What do these findings mean?
The prosecutor's office emphasized that expert opinions do not determine whether the manufacturer actually gained access to materials from specific operational inspections.
The prosecutor's office informs that such solutions did not guarantee full security of the system and the acquired data.
"The lack of access to some system elements prevented the CBA from having full control over its operation and independent verification of the processes of data acquisition, transmission and storage," it was stated.
Pegasus installed without the user's knowledge
As emphasized in the announcement, the Pegasus system could be installed on mobile devices (mainly phones) with Android and iOS systems without the user's knowledge and consent. It allowed access to all or part of the data stored on devices, including: SMS, MMS, messages, photos, videos, instant messages.
Additionally, Pegasus allowed the use of the microphone and cameras built into the device to record audio and video in real time and take screenshots.
Investigation into the Pegasus case, 7 people charged
Since March 18, 2024, an investigation has been ongoing regarding suspected abuse of powers and failure to fulfill duties by public officials in connection with the use of the Pegasus software. The investigation covers mainly three topics: the legality of operational controls, the method of obtaining and using information, and the security and functionality of the Pegasus system.
So far, 7 people have been charged:
Ernest B. (former head of the CBA), Piotr P. (former head of the Internal Security Agency) and Maciej M. (former head of the Military Counterintelligence Service) - charges of failure to fulfill duties in connection with allowing the use of Pegasus without the required ICT security accreditation and ensuring the required protection of classified information.
Daniel K. (former deputy head of the CBA) - accused of illegally transferring materials from the operational inspection of Roman Giertych, including information covered by attorney-client privilege and defense secrecy.
Jarosław W. (former director of the CBA Branch in Warsaw), Katarzyna S. (former head of the 1st Operational and Investigative Department of the CBA Branch in Warsaw) and Angela P. (expert of this department) - charges of leading to groundless operational inspections, unauthorized acquisition of data and misleading the prosecutor and judges.
The investigation continues.
Today we will learn the public part of the report of the investigative committee on Pegasus
Today, the parliamentary investigative committee for Pegasus will present the public part of the report on the purchase, legality and method of using this system. The document will have approximately 700 pages and will include a public and a classified part.
According to the chairwoman of the commission, Magdalena Sroka, one of the commission's findings is that Pegasus was used without the required - in her opinion - accreditation, i.e. without a state guarantee, and the materials collected through the system were at the disposal of the Israeli manufacturer. Sroka also announced further notifications to the prosecutor's office.
