AP Exclusive: Polish opposition duo hacked with NSO spyware

Dec 20, 2021, 12:47 PM | Updated: Dec 23, 2021, 9:59 am
In this two-picture combo, Polish lawyer Roman Giertych, left, poses for a portrait in Rome, and Po...

In this two-picture combo, Polish lawyer Roman Giertych, left, poses for a portrait in Rome, and Polish prosecutor Ewa Wrzosek, right, is photographed in Warsaw, on Thursday, Dec. 16, 2021. The hacking of their phones are the first two confirmed cases of Pegasus military grade spyware being used against targets in Poland, where an illiberal government is eroding democratic norms. (AP Photo/Andrew Medichini, left, Czarek Czarek Sokolowski)

(AP Photo/Andrew Medichini, left, Czarek Czarek Sokolowski)

WARSAW, Poland (AP) — The aggressive cellphone break-ins of a high-profile lawyer representing top Polish opposition figures came in the final weeks of pivotal 2019 parliamentary elections. Two years later, a prosecutor challenging attempts by the populist right-wing government to purge the judiciary had her smartphone hacked.

In both instances, the invader was military-grade spyware from NSO Group, the Israeli hack-for-hire outfit that the U.S. government recently blacklisted, say digital sleuths of the University of Toronto-based Citizen Lab internet watchdog.

Citizen Lab could not say who ordered the hacks and NSO does not identify its clients, beyond saying it works only with legitimate government agencies vetted by Israel’s Defense Ministry. But both victims believe Poland’s increasingly illiberal government is responsible.

A Polish state security spokesman, Stanislaw Zaryn, would neither confirm nor deny whether the government ordered the hacks or is an NSO customer.

Lawyer Roman Giertych and prosecutor Ewa Wrzosek join a list of government critics worldwide whose phones have been hacked using the company’s Pegasus product. The spyware turns a phone into an eavesdropping device and lets its operators remotely siphon off everything from messages to contacts. Confirmed victims have included Mexican and Saudi journalists, British attorneys, Palestinian human rights activists, heads of state and Uganda-based U.S. diplomats.

But word of the Poland hacking is especially notable, coming as rights groups are demanding an EU-wide ban on the spyware. The 27-nation European Union has tightened export restrictions on spyware, but critics complain that abuse of it by EU member states urgently needs to be addressed.

Citizen Lab previously detected multiple infections in Poland dating from November 2017, though it didn’t identify individual victims then. The Pegasus spyware has also been linked to Hungary, which like Poland has been denounced for anti-democratic abuses. Germany and Spain are reportedly among NSO’s customers, with Catalan separatists accusing Madrid of targeting them with Pegasus.

“Once you start aggressively targeting with Pegasus, you’ll join a fraternity of dictators and autocrats who use it against their enemies and that certainly has no place in the EU,” said senior researcher John-Scott Railton of Citizen Lab.

Former EU parliament member Marietje Schaake of the Netherlands, now international cyber policy director at Stanford University, said: “The EU cannot credibly condemn human rights violations in the rest of the world while turning a blind eye to problems at home.”

The Polish targets see the hack as evidence of a perilous erosion of democracy in the very nation where Soviet hegemony began unraveling four decades ago.

Just hours before Zaryn answered emailed questions about the hack from The Associated Press, a provincial prosecutor filed a motion seeking the arrest of Giertych, the lawyer, in a financial crimes investigation.

Zaryn did not comment on whether the two matters might be related. He said Poland conducts surveillance only after obtaining court orders.

“Suggestions that Polish services use operational methods for political struggle are unjustified,” Zaryn said.

An NSO spokesperson said Monday that the company is a “software provider, the company does not operate the technology nor is the company privy to who the targets are and to the data collected by the customers.” Citizen Lab and Amnesty International researchers say, however, that NSO appears to maintain the infection infrastructure.

The company spokesperson also called the allegations of Polish misuse of Pegasus unclear: “Once a democratic country lawfully, following due process, uses tools to investigate a person suspected in committing a crime, this would not be considered a misuse of such tools by any means.”

In July an investigation by a global media consortium found Pegasus was used in Hungary to hack at least 10 lawyers, an opposition politician and several journalists. Last month, a Hungarian governing party official acknowledged that the government had purchased Pegasus licenses.

In 2019, independent Polish broadcaster TVN found evidence the government anti-corruption agency spent more than $8 million on phone spyware. The agency denied the report but Prime Minister Mateusz Morawiecki was more ambiguous, saying all would “be clarified in due time.”

In the last four months of 2019, Giertych was hacked at least 18 times, Citizen Lab found. At the time, he was representing former Prime Minister Donald Tusk of Civic Platform, now head of the largest opposition party, and former Foreign Minister Radek Sikorski, now a European Parliament member.

The “jaw-droppingly aggressive” tempo and intensity of the targeting — day-by-day, even hour-by-hour — suggested “a desperate desire to monitor his communications,” Scott-Railton said. It was so unrelenting that the iPhone became useless and Giertych abandoned it.

“This phone was with me in my bedroom and it was with me when I went to confession. They scanned my life totally,” he said.

Most of the hacks occurred just ahead of an Oct. 13, 2019, parliamentary election that the Law and Justice party of Jaroslaw Kaczynski won by a slim margin, leading to a further erosion of judicial independence and press freedom.

Giertych was also involved representing an Austrian developer at the time who claimed that Kaczynski, Poland’s most powerful politician, stiffed him as a deal to build twin business towers in Warsaw fell apart. Revelations of that deal-gone-sour triggered a scandal because Polish law bans political parties from profit — and the towers were to be built on land owned by Kaczynski’s party.

Giertych also represented Sikorski in an illegal w iretapping case in which the former foreign minister’s conversations were recorded and published; Sikorski alleges the government failed to investigate the possible involvement of Kaczynski allies. Last year, anti-corruption officials searched Giertych’s home and office in a manner a Polish court deemed illegal and the EU called emblematic of how Poland’s government treats hostile lawyers in politically sensitive cases.

When the Lublin regional prosecutor applied for a court order Monday seeking Giertych’s arrest, it said the lawyer had refused to appear for questioning, and seemed to be “deliberately hiding from justice.”

Giertych called this absurd and said the financial wrongdoing investigation was trumped-up, that a Poznan court had already dismissed it for lack of evidence. Prosecutors say he is suspected of money laundering for legal fees he received in a Warsaw property dispute case a decade ago.

Citizen Lab was still investigating how Giertych’s phone was infected but said it expects a “zero-click” vulnerability, which wouldn’t involve user interaction. They believe Wrzosek was similarly hacked. Citizen Lab found six intrusions on her phone from June 24-Aug. 19.

Last year, Wrzosek ordered an investigation into whether presidential elections should be postponed over concerns they could threaten the health of voters and election workers. Almost immediately, she was stripped of the case and transferred to the distant provincial city of Srem with two days’ notice.

“I didn’t even know where the city was and I had nowhere to live there,” said Wrzosek, who was hacked shortly after returning to Warsaw and resuming media appearances critical of the government.

A vocal member of an independent prosecutors’ association, Wrzosek learned she’d been hacked — and tweeted about it — when Apple sent out alerts last month to scores of iPhone users across the globe targeted by NSO’s Pegasus, including 11 U.S. State Department employees in Uganda. In a lawsuit it filed the same day, Apple called NSO “amoral 21-century mercenaries.” In 2019, Facebook sued the Israeli firm for allegedly hacking its globally popular WhatsApp messenger app.

Wrzosek has filed an official complaint but doesn’t expect prompt accountability, believing “the same services that tried to break into my phone will now be conducting the proceedings, looking for perpetrators.”


Bajak reported from Boston. Associated Press reporter Josef Federman contributed from Jerusalem.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


Ten-year-old Greyson Goldstein stands outside Ball Arena before Game 1 of the NHL hockey Stanley Cu...
Associated Press

NHL experiencing sustained growth with female, younger fans

One of the biggest stories in the NHL this season has been the increase in viewers in the league’s first year of its television contracts with ESPN and TNT. The league is also seeing unparalleled growth in female and younger fans that should have a big impact for years to come. According to NHL research, […]
24 hours ago
FIFA President Gianni Infantino answers questions during a 2026 soccer World Cup news conference Th...
Associated Press

Group asks for living wages, labor rights for 2026 World Cup

With this year’s World Cup in Qatar clouded by labor and human rights issues, there’s a push for the North American cities awarded games for the 2026 tournament to commit to livable wages, equitable hiring and worker protection. The Dignity 2026 coalition has brought together groups including the AFL-CIO, Human Rights Watch and the Independent […]
24 hours ago
FILE - Ohio Gov. Mike DeWine, center, and his wife Fran, right, talk with specialist Emily Milosevi...
Associated Press

Army Guard troops risk dismissal as vaccine deadline looms

WASHINGTON (AP) — Up to 40,000 Army National Guard soldiers across the country — or about 13% of the force — have not yet gotten the mandated COVID-19 vaccine, and as the deadline for shots looms, at least 14,000 of them have flatly refused and could be forced out of the service. Guard soldiers have […]
24 hours ago
Karen Sloan said she's a registered Republican who backs abortion rights, Friday, June 24, 2022 in ...
Associated Press

Dems hope to harness outrage, sadness after abortion ruling

YARDLEY, Pa. (AP) — The shock quickly turned to sadness for Victoria Lowe. The 37-year-old lawyer, working outside a cafe in suburban Bucks County, Pennsylvania, said she couldn’t believe the Supreme Court stripped away the constitutional right to abortion that women have had her entire life. She started to cry. “I don’t understand how they […]
24 hours ago
Associated Press

Today in History: June 25, Anne Frank’s diary published

Today in History Today is Saturday, June 25, the 176th day of 2022. There are 189 days left in the year. Today’s Highlight in History: On June 25, 1876, Lt. Col. Colonel George A. Custer and his 7th Cavalry were wiped out by Sioux and Cheyenne Indians in the Battle of the Little Bighorn in […]
24 hours ago
FILE - Chinese President Xi Jinping, left, and Hong Kong's new Chief Executive Carrie Lam attend th...
Associated Press

China’s Xi to visit Hong Kong for handover anniversary

BEIJING (AP) — Chinese leader Xi Jinping will visit Hong Kong to celebrate next week’s 25th anniversary of the former British colony’s return to China following a crackdown on a pro-democracy movement that has inflamed tension with Washington and Europe. Xi will attend an anniversary gathering and the first meeting of the new government of […]
24 hours ago

Sponsored Articles


Most plumbing problems can be fixed with regular maintenance

Instead of waiting for a problem to happen, experts suggest getting a head start on your plumbing maintenance.
Carla Berg, MHS, Deputy Director, Public Health Services, Arizona Department of Health Services

Vaccines are safe if you are pregnant or breastfeeding

Are you pregnant? Do you have a friend or loved one who’s expecting?
Carla Berg, MHS, Deputy Director, Public Health Services, Arizona Department of Health Services

Update your child’s vaccines before kindergarten

So, your little one starts kindergarten soon. How exciting! You still have a few months before the school year starts, so now’s the time to make sure students-to-be have the vaccines needed to stay safe as they head into a new chapter of life.
AP Exclusive: Polish opposition duo hacked with NSO spyware