The courts did not know what they were giving consent to. Shocking behind-the-scenes report of the parliamentary committee on Pegasus

Lack of full state control over the Pegasus system

As informed by the chairwoman of the commission, Magdalena Sroka, one of the most important findings of the commission is the lack of full control of the Polish state over the Pegasus system. She said that part of Pegasus's infrastructure was under the control of the Israeli company NSO Group, and data downloaded from the phones was sent via foreign IP addresses. Sroka noted that, according to the commission's findings, the manufacturer had the opportunity to access materials obtained as part of operational control, and warnings about the risk of data flow abroad appeared already in 2017.

The intermediary earned PLN 8 million

Sroka also reported that the purchase of Pegasus cost PLN 33.4 million, of which over PLN 8 million went to the intermediary company. As she noted, this amount does not include all costs of operation, system maintenance and license renewal. The total cost of purchasing and maintaining, administering and extending licenses is much higher, Sroka emphasized.

According to the commission's findings, Pegasus never obtained the required ICT security accreditation, and the CBA did not apply to the Internal Security Agency for it. According to the committee, this meant that the system was used without meeting the requirements arising from the provisions on the protection of classified information.

The Commission also found - said Sroka - that the courts granting consent to operational control were not informed about Pegasus' real capabilities. As Sroka reported, the judges questioned by the commission testified that they did not know that the tool could provide access to the entire content of the phone, including messages, photos, contacts, location and past data.