AP Exclusive: Polish opposition senator hacked with spyware
Security researchers say they've confirmed that a third Polish opposition figure had his phone hacked with sophisticated spyware from Israeli company NSO Group
December 23, 2021, 6:33 PM
7 min read
Share to FacebookShare to TwitterEmail this articlePolish Senator Krzysztof Brejza on the night of parliamentary elections on Oct. 13, 2019. An investigation by The Associated Press and Citizen Lab, a watchdog at the University of Toronto, has found that Brejza's mobile phone was hacked with military-grade Pegasus spyware nearly three dozen times in 2019 as he ran an opposition campaign to unseat the right-wing populist government in parliamentary elections. The ruling party won a slim majority and Brejza is convinced that the hacking of his phone gave it an unfair advantage. (AP Photo)
WARSAW, Poland -- Polish Sen. Krzysztof Brejza’s mobile phone was hacked with sophisticated spyware nearly three dozen times in 2019 when he was running the opposition's campaign against the right-wing populist government in parliamentary elections, an internet watchdog found.
Text messages stolen from Brejza's phone — then doctored in a smear campaign — were aired by state-controlled TV in the heat of that race, which the ruling party narrowly won. With the hacking revelation, Brejza now questions whether the election was fair.
It's the third finding by the University of Toronto’s nonprofit Citizen Lab that a Polish opposition figure was hacked with Pegasus spyware from the Israeli hacking tools firm NSO Group. Brejza’s phone was digitally broken in to 33 times from April 26, 2019, to Oct. 23, 2019, said Citizen Lab researchers, who have been tracking government abuses of NSO malware for years.
The other two hacks were identified earlier this week after a joint Citizen Lab-Associated Press investigation. All three victims blame Poland’s government, which has refused to confirm or deny whether it ordered the hacks or is a client of NSO Group. State security services spokesman Stanislaw Zaryn insisted Thursday that the government does not wiretap illegally and obtains court orders in “justified cases.” He said any suggestions the Polish government surveils for political ends were false.
NSO, which was blacklisted by the U.S. government last month, says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals. It does not name its clients and would not say if Poland is among them.
Citizen Lab said it believes NSO keeps logs of intrusions so an investigation could determine who was behind the Polish hacks.
In response to the revelations, European Union lawmakers said they would hasten efforts to investigate allegations that member nations such as Poland have abused Pegasus spyware.
The other two Polish victims are Ewa Wrzosek, an outspoken prosecutor fighting the increasingly hardline government's undermining of judicial independence, and Roman Giertych, a lawyer who has represented senior leaders of Brejza’s party, Civic Platform, in sensitive cases.
Prime Minister Mateusz Morawiecki on Wednesday dismissed revelations that Giertych and Wrzosek were hacked as “fake news.” Justice Minister Zbigniew Ziobro expressed no knowledge of “illegal actions aimed at the surveillance of citizens” but also said Poland was “not helpless” in taking action against people suspected of crimes.
Giertych was hacked 18 times, also in the run-up to 2019 parliamentary elections that the ruling Law and Justice party won by a razor-thin margin. That victory has continued a dangerous erosion of democracy in the nation where the popular 1980s protest movement Solidarity presaged the eventual collapse of the Soviet empire.
The intense tempo of the hacks of Brejza and Giertych “indicates an extreme level of monitoring” that raises pressing questions about abuses of power, Citizen Lab senior researcher John Scott-Railton said. Pegasus gives its operators complete access to a mobile device: They can extract passwords, photos, messages, contacts and browsing history and activate the microphone and camera for real-time eavesdropping.
