The Record reported that Polish prosecutors say spyware maker NSO Group had technical access to data from Poland's Pegasus program. The Central Anti-Corruption Bureau ran it under the previous government. Prime Minister Donald Tusk, who ordered the probe, accused NSO on Monday of working with Israeli intelligence. That claim is his, not the prosecutors'.
Prosecutors said only NSO controlled the server that infects phones. The bureau lacked passwords to many admin accounts, so it could not fully check how data was sent and stored. Data left Poland through servers abroad. NSO gave updates by remote link, with full access and power to change settings. Investigators cannot say if NSO obtained material from any specific operation. NSO did not reply to a request for comment.
Analysis: the facts fit together. The vendor ran the key server, the buyer could not fully check it, traffic passed through relays abroad, and the vendor could change the system remotely. NSO has long told government customers it cannot see Pegasus data. Citizen Lab's John Scott-Railton said documents from WhatsApp's 2019 lawsuit support Poland's claims. So 'we cannot see your data' is a promise, not a design feature. Buyers can test it: who holds admin passwords, where traffic goes, and what remote rights the contract gives.