WARSAW, Poland (AP) – Amnesty International said on Thursday it independently confirmed that powerful spyware from Israeli surveillance software maker NSO Group was used to hack a Polish senator several times in 2019 while leading the opposition parliamentary election campaign.
The Associated Press reported last month that Citizen Lab, a University of Toronto internet watch group, discovered Senator Krzysztof Brejza and two other critics of the Polish government were hacked with NSO’s Pegasus spyware.
Dozens of high-profile cases of Pegasus abuse have been uncovered since 2015, many by a global media consortium last year, with the NSO group’s malware being used to listen to journalists, politicians, diplomats, lawyers, and human rights activists across the Middle East in the Mexico.
Polish hacks are considered particularly egregious because they took place not in a repressive autocracy but in a member state of the European Union.
The revelations rocked Poland, drawing comparisons to the Watergate scandal in the United States in the 1970s and prompting calls for investigation and accountability. Although neither Citizen Lab nor Amnesty International has determined who was behind the hacks, the victims all blame the right-wing party in power in Poland, Law and Justice.
Law and justice officials have denied any knowledge of the hacks and sometimes scoffed at the reported findings while refusing to open an investigation.
The NSO Group does not identify its customers but claims it only sells Pegasus to governments to fight terrorism and other serious crimes. Spyware allows its operators to suck up everything from instant messages and contacts to photos, and turn microphones and cameras into real-time spy tools.
Polish Prime Minister Mateusz Morawiecki called Citizen Lab-AP’s findings “false news” and suggested that a foreign intelligence service could have spied – an idea rejected by critics who say no other government would have of interest to the three Polish targets.
John-Scott Railton, Principal Investigator at Citizen Lab, said that “if (Polish government leaders) really believe this could be the action of a foreign service, it would be the height of irresponsibility not to investigate “.
The senator’s cell phone was hacked with Pegasus 33 times in 2019, mostly while Brejza led the opposition campaign to overthrow the law-and-justice-led government, Citizen Lab determined last month.
The text messages stolen from Brejza’s phone were forged and broadcast by state-controlled television as part of a smear campaign in the heat of the moment, which the ruling populist party narrowly won. Brejza compared the actions to the tactics used in Russia against Kremlin critic and opposition leader Alexei Navalny.
Donncha O’Cearbhaill, an expert at Amnesty International’s security lab, said he confirmed Citizen Lab’s findings after receiving raw backups of Brejza’s phone from Canadian researchers. Amnesty uses independently developed tools and methods for its forensic analysis.
Brejza told the PA that he believes the real victims of the piracy are Polish voters who have been “deceived” by the law and the courts and “denied the right to fair elections”.
The other two Polish targets confirmed by Citizen Lab were Roman Giertych, a lawyer who represents opposition politicians in a number of politically sensitive cases, and Ewa Wrzosek, an independent-minded prosecutor.
Wrzosek formally asked the Warsaw District Attorney’s Office last month to investigate the hack into his phone. The office refused, justifying its decision saying Wrzosek refused to hand over his phone.
She said she had not given up on the phone as she did not trust the DA’s office and wanted to participate in the device assessment. “It is my right under the law,” Wrzosek told the AP.
In November, the Israeli financial newspaper Calcalist reported that the country’s defense ministry had significantly reduced the list of countries to which spyware produced by Israel could be exported. The newspaper did not say that Poland was one of the nations removed from the list, but it was not among the approved countries mentioned in the report.
Hungary, another member of the European Union where the NSO Group’s Pegasus is confirmed to have been used against non-criminals, was also not on the short list.
Israel’s Defense Ministry said the Calcalist report was inaccurate, without giving details.
____
Josef Federman in Jerusalem and Frank Bajak in Boston contributed to this report.
“Amateur web enthusiast. Award-winning creator. Extreme music expert. Wannabe analyst. Organizer. Hipster-friendly tv scholar. Twitter guru.”