Pegasus, Poland, and the Court That Knew First

For 5 years, Poland argued about a surveillance tool that nobody in the room could describe. A federal courtroom in Oakland had the manual the whole time.

On the morning of Monday, October 12, 2026, the National Prosecutor’s Office in Warsaw posted a communiqué that read, in places, like a product review written by a deeply disappointed customer. Forensic experts from the Internal Security Agency, known in Poland by its initials, ABW, had spent 2 years examining Pegasus, the Israeli spyware that the Central Anticorruption Bureau, or CBA, bought in 2017 with money taken, among other sources, from a fund meant for crime victims. Their conclusions, declassified in part by order of the Prosecutor General, were blunt. The CBA had never fully controlled the system. It lacked the passwords to some administrator accounts. The server module that infected phones remained under the exclusive control of the manufacturer, NSO Group. The data harvested from Polish phones left the country through an anonymizing network of servers scattered around the world, managed by NSO and beyond the CBA’s reach. During remote maintenance, the manufacturer had full access to the system, including the power to change its software and configuration, and the surveillance operations running at the time were not paused.

At noon, in the Sejm, Poland’s lower house of parliament, Magdalena Sroka, who chairs the investigative committee on Pegasus, presented the public part of its report and announced criminal referrals against 11 people. The state, she said, had been treated like a private fiefdom. Later that day, Prime Minister Donald Tusk posted a video under the line “You haven’t heard this about Pegasus yet” and called the affair a crime against the state. (Tusk’s party was the spyware’s most prominent target when it was in opposition; the people the committee now accuses ran the government that bought it. A reader is entitled to keep both facts in view.)

What was striking, to anyone who had followed a certain lawsuit in California, was how little of this was new. The mechanism that Poland’s experts reconstructed over 2 years, in a report stamped top secret, had been accumulating in the public docket of a federal court in Oakland since October 29, 2019, the day WhatsApp sued NSO Group: first as the allegations of a complaint, then as sworn testimony and unsealed briefs, and, on December 20, 2024, as the findings of a judge. By May 2025, a jury had put a price on it. The record named the attack tools, traced the servers, and described, partly in NSO’s own words, what the customer did and what the company did. For 5 years Poland argued about a weapon that nobody with the power to authorize it could describe, while the description sat in a courtroom 6,000 miles away, in a dispute between 2 private companies.

Five years without the manual

Poland learned that its anticorruption bureau had bought something expensive in September 2018, when the state auditor found an invoice for “special technical means” worth more than 33 million złoty and reporters began to guess what it was. It learned who had been targeted 3 years later, and not from a document but from a forensic examination. In December 2021, researchers at Citizen Lab, a group at the University of Toronto that studies digital surveillance, found that the phone of Krzysztof Brejza, a senator who had run the opposition’s parliamentary campaign in 2019, had been attacked with Pegasus 33 times between April 26 and October 23 of that year, the months of the campaign. Similar traces appeared on the phones of Roman Giertych, a lawyer who had represented Tusk, and Ewa Wrzosek, a prosecutor critical of the government.

The government’s response was a sequence of denials, each shorter-lived than the last. In late December, a deputy defense minister declared that the Pegasus system was not in the possession of the Polish services. On January 7, 2022, Jarosław Kaczyński, the chairman of Law and Justice, the party that governed Poland from 2015 to 2023, confirmed the purchase in a magazine interview and defended it in a sentence: it would be bad, he said, if the Polish services lacked “this type of tool.” The Prime Minister at the time assured the public that every operation had been approved by a court.

Court approval became the government’s trump card, and it was a strange one, because the courts did not know what they were approving. At a debate convened in the Sejm by the opposition on January 14, 2022, Judge Piotr Gąciarek acknowledged that a court reviewing a surveillance request has no idea which system the agency intends to use. The agency asks for “operational control,” the statutory term for covert surveillance, lists the legal grounds, and attaches a justification; the judge signs or does not. Nearly 5 years later, Sroka told reporters the same thing: the judges who signed the Pegasus orders did not grasp what the system could do.

The institutions that followed added facts, but always from outside the machine. A special commission of the Senate, which the opposition controlled at the time, concluded in its final report of September 6, 2023, that Pegasus was not an investigative tool at all but a cyberweapon, and that its use in Poland was illegal. In April 2024, Adam Bodnar, by then Justice Minister and Prosecutor General in Tusk’s government, informed parliament that between 2017 and 2022 operational control using Pegasus had covered 578 people: 6 in 2017, 100 in 2018, 140 in 2019, 161 in 2020, 162 in 2021, and 9 in 2022, when it stopped. It had been used by 3 agencies: the CBA, the ABW, and the Military Counterintelligence Service. Standing in the Sejm, Bodnar remarked that it saddened him to be addressing, in that very chamber, people who had been the system’s targets. On May 28, 2024, the European Court of Human Rights, in Pietrzak and Bychawska-Siniarska and Others v. Poland, held that Poland’s surveillance regime lacked adequate safeguards against abuse.

Even the legislature’s latest response steps around the tool. A law of September 4, 2026, signed by the President on September 25, lets a court demand information about a surveillance operation in progress and order it stopped. Panoptykon, a Warsaw digital-rights foundation, pointed out that the provisions were drafted with the traditional wiretap in mind and that spyware like Pegasus remains outside judicial oversight; the data-protection authority had already warned that the bill fell short of the Strasbourg judgment, since nobody is told, afterward, that they were watched.

The common thread of these 5 years is that knowledge of how Pegasus worked was, in Poland, a state secret. The ABW experts’ opinions, commissioned by prosecutors, were classified top secret until an order of August 26, 2026, lifted the stamp from selected passages. Public debate fed on the work of Citizen Lab, Amnesty International, and Panoptykon, and on the manufacturer’s marketing. Across the Atlantic, the same machine was being taken apart in open court.

What Oakland knew

On October 29, 2019, WhatsApp and Facebook sued NSO Group Technologies and its parent, Q Cyber Technologies, in the federal court for the Northern District of California (case no. 4:19-cv-07123). The claims rested on the Computer Fraud and Abuse Act, the federal anti-hacking statute, on its California counterpart, and on breach of WhatsApp’s terms of service. The complaint described an attack between late April and early May 2019 on roughly 1,400 devices, among them the phones of lawyers, journalists, diplomats, and human-rights workers.

NSO’s first line of defense was sovereign immunity: since governments buy Pegasus, the company argued, it acts as their agent and shares their protection from suit. The Ninth Circuit rejected the theory on November 8, 2021. Judge Danielle Forrest observed that the name of the doctrine gave the answer away, and that a private company does not become an organ of a foreign state by selling it tools. The Supreme Court declined to hear the case in January 2023.

Then came the phase that no Polish proceeding has ever reached: discovery. In February 2024, Judge Phyllis Hamilton ordered NSO to produce the code for its spyware across a 2-year window, from April 29, 2018, to May 10, 2020, together with information about its full functionality. NSO offered code that could be viewed only by Israeli citizens, and only on Israeli soil. That summer, according to a leak reported by the Guardian, the Israeli government took steps to frustrate the American case. On December 20, 2024, the court found NSO liable on the 3 claims still standing (a fourth, trespass to chattels, had been dismissed in 2020), imposing evidentiary sanctions for the company’s refusal to comply with its orders.

The damages trial ended on May 6, 2025, with a jury verdict of $444,719 in compensatory damages and $167,254,000 in punitive damages. On October 17, 2025, Judge Hamilton cut the punitive award to $4,002,471, 9 times the compensatory damages, the most she thought the Supreme Court’s due-process case law would bear for conduct she declined to call “particularly egregious,” and she granted a permanent injunction forbidding NSO ever to target WhatsApp or its users again. The injunction was entered with the final judgment on November 12, 2025, and took effect on January 28, 2026, after the Ninth Circuit refused to stay it. NSO appealed (the case is No. 25-7380 in the Ninth Circuit). On June 8, 2026, Meta asked the court to hold NSO in contempt, alleging that after the injunction took effect the company had created 23 accounts and 34 test groups on the platform and, in February and April, had sent users one-click phishing links. In its reply, WhatsApp noted that NSO routes its activity through anonymizing infrastructure and then pleads uncertainty about attribution: “Having built that opacity, NSO now invokes the uncertainty it creates as a defense.” As of this writing, no ruling on the contempt motion has been reported. On May 20, 2026, a coalition of civil-society groups, among them Access Now, the Electronic Frontier Foundation, the Committee to Protect Journalists, and Reporters Without Borders, filed an amicus brief defending the injunction.

Heaven, Eden, Erised

The money is the least interesting part. What matters is the account of the machine that emerged from the complaint, the depositions, and the unsealed briefs. The attack was discovered, as it happens, by an intern. On May 2, 2019, a Meta intern working on WhatsApp noticed server traffic carrying unusual data, which turned out to be shellcode redirecting phones to an outside server. The flaw, catalogued as CVE-2019-3568, sat in WhatsApp’s voice-calling feature.

According to the 2019 complaint, NSO had opened WhatsApp accounts using numbers from Cyprus, Israel, Brazil, Indonesia, Sweden, and the Netherlands; leased servers in several countries, including the United States; and pushed malicious code through WhatsApp’s signaling servers, disguised as call settings. The code lodged itself in the phone’s memory whether or not the victim answered. A second packet, sent through WhatsApp’s relay servers, woke the implant, which then reached out to an NSO-controlled server and downloaded the spyware proper. When WhatsApp patched the flaw in May 2019, an NSO employee complained to WhatsApp in a message that would later be quoted in the complaint: “You just closed our biggest remote for cellular.”

WhatsApp’s brief, unsealed in November 2024, and the deposition of NSO’s head of research supplied names and a chronology. NSO had decompiled the WhatsApp app and built a counterfeit client, known internally as the WhatsApp Installation Server, or WIS, which could send the servers messages the real app could not. On that foundation it developed a family of installation vectors called Hummingbird: Heaven, tested on WhatsApp’s servers from around April 2018; Eden, the vector used in the 2019 attack; and Erised, deployed after the lawsuit was filed and retired only when WhatsApp’s changes blocked it, sometime after May 2020. (Erised is “desire” spelled backward, the name of the mirror in the Harry Potter novels that shows whoever looks into it whatever they most want to see. Whether NSO’s engineers intended the allusion, the record does not say.) When WhatsApp killed the second vector, an internal NSO message announced that Eden had “finished its duty with us.” Every one of the vectors passed through WhatsApp’s infrastructure; in May 2019 alone, the court noted, Pegasus code moved through servers in California 43 times.

There is a conceptual point here that the Polish debate never reached. Jonathon Penney and Bruce Schneier, in an article in the Berkeley Technology Law Journal, showed that Pegasus does not break end-to-end encryption; it goes around it. It seizes the endpoint, the phone, and reads messages before they are encrypted or after they are decrypted. The authors called this a “network trespass,” an intrusion on the whole messaging network rather than on a single device. For a lawyer, the implication is that the object of the intrusion is not a conversation but the entire contents of a device, including its past.

Who presses the button

From the Polish point of view, one finding matters more than the rest. WhatsApp maintained in its filings that an NSO customer typed in a phone number, pressed “install,” and waited; the manufacturer’s infrastructure did everything else. The 2019 complaint described a network of NSO-controlled computers that relayed malware, commands, and data between the compromised phone, NSO, and its customers, a “nerve center,” in the complaint’s phrase, through which the company supported and controlled its customers’ use of Pegasus. It also described technical support delivered by NSO engineers over remote-desktop software and a VPN. NSO’s position has always been that its customers operate the system and that the company has no window into what they collect. The court did not have to resolve that dispute in full: the sanctions for NSO’s refusal to produce its code allowed the judge to accept the plaintiff’s account wherever the missing code would have told the story.

Two descriptions of one machine

Set the Warsaw communiqué of October 12 beside the Oakland docket and the overlap is hard to miss.

Who installs the spyware? The ABW experts: the server module that infects phones stayed under the manufacturer’s exclusive control, and the CBA lacked passwords to some administrator accounts. The California record: the Heaven, Eden, and Erised vectors and the counterfeit WIS client were built and maintained by NSO’s research team, while the customer worked a console with a phone number in it.

Where does the data go? The experts: out of Poland, through an anonymizing network of servers around the world, run by the manufacturer; they identified the foreign IP addresses. The complaint: proxy and relay servers leased from Choopa, QuadraNet, and Amazon Web Services, forming the nerve center through which NSO supported its customers.

Who has access while the system runs? The experts: support and updates were done remotely, surveillance was not suspended while they were, and the manufacturer had full access, including the power to change software and configuration. The complaint: remote troubleshooting by NSO engineers over remote desktop and VPN.

What does the system take? The experts: messages of every kind, calls over cellular networks and the internet, contacts, calendars, browsing history, photos, documents, location, the microphone and cameras in real time, screenshots, and messages exchanged before the surveillance order began, as long as they were still on the phone. The complaint: modular spyware built to intercept iMessage, Skype, Telegram, WeChat, Messenger, and WhatsApp, and to exfiltrate screenshots, browsing history, and contacts.

The one real difference lies in a sentence that, for purposes of liability, is the most important in the Polish communiqué: the experts could not determine whether the manufacturer actually looked at material from any particular operation. That is a negative finding, an absence of proof rather than proof of absence. The American court faced the same wall and climbed it procedurally: once NSO refused to show its code, the uncertainty counted against NSO. Polish prosecutors have no such lever over a foreign company. Spain learned the same lesson in January 2026, when, as El País reported, a judge of the Audiencia Nacional closed, once again, the investigation into Pegasus attacks on the phones of the Prime Minister and the Defense Minister, citing nearly 4 years of Israeli refusals to coöperate, an episode the amicus brief in the California appeal recounts.

Does Pegasus fit the Polish definition?

Fairness requires stating the strongest case for the purchase. Since a 2016 amendment, the statutes governing Poland’s police and intelligence agencies have defined operational control broadly. It covers not only the recording of calls and correspondence but also “obtaining and preserving data contained in” computer storage, “telecommunications terminal devices,” and information systems. Remote access to a phone, considered in the abstract, has a statutory basis. The orders were signed by a court, in practice the Warsaw Regional Court. Encrypted messaging apps really did blind the classic wiretap, and NSO is fond of noting that Pegasus helped Mexican authorities find Joaquín Guzmán, the cartel leader known as El Chapo. At that level of generality, the argument holds.

The trouble starts with the particular tool, and it follows directly from what the experts found.

The first problem is time. A surveillance order runs from the moment it is issued, for a fixed period. Pegasus, by the ABW’s account, reached back into messages sent and received before the order existed, as long as they were still on the phone. An order that sweeps in years of archives is not, in that part, surveillance at all. It is a search without a search warrant, conducted without the person’s knowledge and without a record of what was taken. Defenders of the purchase will reply that the 2016 clause on data stored in terminal devices covers exactly this, and some commentators have argued that what matters is the date of acquisition, not the date a message was written. Perhaps. But a clause that lets an agency read what is on a device does not tell a judge how far back it may reach, and an order that does not say so authorizes everything. The first Polish court to face the question, in Wrocław in 2023, read the statute the other way, and its fate is described below.

The second problem is integrity. The manufacturer could alter the system’s software and configuration while operations were running, and the CBA could not verify the modules that transmitted and stored the data. In a criminal trial, evidence must have a known origin and an unbroken chain of custody. When material has passed through infrastructure to which the agency lacked full passwords, and which a third party could reconfigure at will, the defense is entitled to ask who vouches that what reached the file is what was on the phone.

The third problem is secrecy, in the technical sense. Surveillance material is classified information under Polish law, and systems that process it must be accredited for security. The ABW concluded in May 2025 that Pegasus should have been accredited and never was; that finding underlies the charges of dereliction of duty against the former heads of the CBA, the ABW, and military counterintelligence. The Sejm committee went further, describing some of its referrals as enabling the disclosure of classified information to foreign entities. Whether any such disclosure occurred is unknown. That it was technically possible throughout the system’s service life is now established.

The fourth problem is the simplest: the court agreed to something it did not know. The new law lets a judge demand files and halt an operation, but it still does not require an application to name the tool or its properties: its reach into the past, its capacity to modify data, the presence of a third party in the loop. The committee described this as the courts having been misled. The legislature, so far, has left the gap open.

The one Polish court that tried

One Polish court did attempt to describe the tool before ruling on its product, and its experience is the thesis of this article in miniature. In 2018, the CBA obtained a Warsaw court’s authorization to surveil a private detective, a retired ABW officer suspected of asking a serving officer whether he was being watched. The bureau pulled his messenger correspondence from his phone, including messages exchanged months before the order, and prosecutors built a case on it. A regional court in Wrocław convicted. In May 2023, the Wrocław Court of Appeals acquitted the detective, in the first ruling by a Polish court on evidence attributed to Pegasus. The court could not even establish which tool had been used, because the CBA twice refused to say and would not disclose the full justification it had given the authorizing judge; it inferred Pegasus from press reports. On that basis it held that spyware installed by breaking into a phone, with full access to everything on it, is not what the statute means by obtaining data from a terminal device; that historical data have no connection with the purpose of a surveillance order, which exists to confirm information about a crime that, months earlier, may not have existed; and, 3 years before the ABW’s experts, that the way such a system transfers data creates the possibility of access by other parties, “such as the software producer.” It also excluded the defendants’ later explanations as fruit of the same tree, because the questions put to them had been shaped by what the surveillance had revealed.

Prosecutors took the case to the Supreme Court, in a cassation drafted, Rzeczpospolita reported, by the prosecutor who is now the National Prosecutor’s Office spokesman, and their argument deserves a moment’s attention: the appellate court, they said, had never established what tool was used and had taken its understanding of Pegasus from the media, so it was in no position to judge the tool’s legality. That is true, and it is the point. The court had no other source. The Supreme Court opened the hearing on January 22, 2026, and adjourned it the same day, asking the head of the CBA whether the software had ever been accredited. The reporting judge retires this week, the case will be reassigned, and the first Polish ruling on the legality of Pegasus evidence is, 8 years after the surveillance, no closer than it was.

An exclusionary rule, inverted

What happens when Pegasus material reaches a criminal or tax file? The answer turns on a provision that was rewritten in 2016 in exactly the opposite direction from the one the present situation demands. I wrote about it 10 years ago, in a piece on criminal law and the abuse of means (in Polish), when the justice minister of the day announced that he would do away with the fruit-of-the-poisonous-tree doctrine. He did, in March 2016. The minister was Zbigniew Ziobro, who has since told the Sejm committee that he initiated the Pegasus purchase, and whose ministry controlled the Justice Fund that paid 25 million złoty toward it some 18 months later.

Article 168a of the Code of Criminal Procedure now says that evidence may not be deemed inadmissible solely because it was obtained in breach of procedure or by means of a crime, unless a public official obtained it, in the course of his duties, through homicide, intentional bodily harm, or unlawful imprisonment. Unauthorized access to information, a crime under Article 267 of the Penal Code, is not on the list. Read literally, the provision forbids a court to reject Pegasus material merely because it was obtained unlawfully, even if the court’s order proves defective, even if the data predates the order, even if it crossed a foreign company’s servers on the way. Other grounds for exclusion survive, among them privilege, the scope of the order, and the fair-trial guarantee, but unlawfulness alone is no longer one of them. Scholars and some courts rescue the provision by reading it in light of the Constitution, which lets a citizen demand the removal of information gathered contrary to statute, and of the fair-trial guarantee of the European Convention. I have surveyed how different legal systems handle the admissibility of illegally obtained evidence; the short version is that Poland’s statute is strikingly permissive on its face, and that its pro-constitutional reading is a construct, not a text.

A second provision, Article 168b, governs evidence of crimes other than the one named in the surveillance order, or committed by other people. In 2018, the Supreme Court, sitting as a panel of 7 (resolution I KZP 4/18), confined it to the catalogue of offenses for which a court could have authorized surveillance in the first place. With a tool that collects everything, including a client’s messages to his lawyer, this provision becomes the main battlefield; one of the prosecution’s charges accuses a former deputy head of the CBA of passing on material from the surveillance of Giertych that was covered by attorney-client privilege.

The third reference point is the Warsaw Court of Appeals’ ruling in the case of “Agent Tomek,” an undercover officer who spent months cultivating a member of parliament before anyone had grounds to suspect her of anything. The court held that operational measures conducted outside the statutory requirements produce no evidentiary effect, and that the taint extends to derivative evidence. I described that case, alongside the entrapment of John DeLorean, in Fruit of the Poisonous Tree. Its reasoning rests on the Constitution rather than on the wording of Article 168a, and the Supreme Court has since confirmed, under the 2016 text, that the provision does not work the other way around either. In October 2023 (V KK 178/23), it dismissed as manifestly unfounded a prosecutor’s cassation arguing that Article 168a obliged a court to convict on evidence that CBA officers had obtained through an unlawful controlled bribe; whether a provocation reached an innocent person, the court said, must be judged as of the moment it was launched, not with hindsight. Together, these rulings are the sturdiest instrument available to a defendant whose case has Pegasus somewhere in its history.

Finally there is the tax angle, which for business owners is the practical one. Article 181 of the Tax Ordinance lets tax authorities use material gathered in criminal proceedings, so surveillance product handed to a prosecutor can end up in a tax assessment. In 2019, the Supreme Administrative Court held that tax authorities may not presume such material lawful and must examine its legality themselves; I have written about that ruling in Wiretap Evidence in Tax Proceedings and about the wider practice in When the Taxman Listens In. After October 12, 2026, the thesis sharpens: an authority that receives surveillance product should establish which tool produced it, and whether that tool stayed within the court’s order, before treating it as an official record.

Why California knew more

The answer has little to do with the talent of the judges and everything to do with procedure. American civil discovery forced NSO to choose between disclosing its code and losing. Judge Hamilton applied the Ninth Circuit’s Richmark test, which weighs American discovery obligations against foreign legal restrictions, and concluded that another country’s export-control regime does not excuse a litigant from the process. When NSO chose sanctions over disclosure, the court treated as proved what the company would not show. Meta then put the transcripts online. For a business reader, this is a lesson in the price of a trade secret: NSO decided that a damages award was cheaper than its source code, and in that calculation, as the reduction to $4 million suggests, it was probably right.

In Poland, the mechanism ran in reverse. Knowledge of the system was classified to protect state secrets, which is to say protected from citizens though not, as we now know, from the manufacturer. The parliamentary committee worked under a cloud of litigation over its own legitimacy, and the foreign company remained beyond the reach of Polish authority. The result is that in 2017 the state bought a product it could not inspect and spent 5 years using it on its own citizens. The Senate commission put it in a sentence: Pegasus is not an investigative tool but a cyberweapon. It sounded like rhetoric. The ABW’s experts gave the phrase technical content.

Whether this was error, negligence, or something more is a question for the courts. The reconstruction offered here is a hypothesis built from public documents. One thing, though, is not in doubt: anyone who read the complaint filed in Oakland in October 2019 knew more about Pegasus than the judge who signed off on its use in Warsaw.

What comes next

Several matters remain open, and they are worth watching together.

In California, the Ninth Circuit will hear NSO’s appeal from the injunction and the judgment, and the district court will rule on the contempt motion. NSO has been controlled by American investors since October 2025, and David Friedman, the former U.S. Ambassador to Israel, has become its executive chairman, moves the amici read as a bid for the American market despite the company’s placement, in November 2021, on the Commerce Department’s Entity List.

In Poland, the prosecutors’ Investigative Team No. 3 is pursuing 3 strands: the legality of the surveillance orders, the use made of the information, and the security of the system. Prosecutors have charged 7 people. A parliamentary committee is weighing a motion to bring the former Justice Minister before the Tribunal of State, Poland’s court for constitutional offenses by officials. The law of September 4, 2026, published on September 30, takes effect on October 31 and does not reach back to the operations of 2017 to 2022. The Supreme Court’s first Pegasus case starts over with a new reporting judge. In Strasbourg, Brejza and Others v. Poland is pending.

For anyone who suspects that they were targeted, the path is by now well trodden: a forensic examination of the device by Citizen Lab or Amnesty International, Apple’s notifications of state-sponsored attacks, a request to be recognized as a victim in the prosecutors’ investigation, and, where material was published, a civil action. In Brejza’s case against state television, which had broadcast private messages taken from his phone, a court ordered an apology and 200,000 złoty, roughly $50,000, in damages. For anyone facing surveillance product from the years 2017 to 2022, the first motion should ask 3 questions: which tool, what span of data, and what route the material travelled before it reached the file. The answers live in extraction logs, timestamps, and file hashes, and a prosecutor who cannot produce them cannot vouch for the file.

For 5 years, Pegasus was in Poland a political quarrel over who had been listened to. The communiqué of October 12, 2026, moved the quarrel to where it belonged all along: to the question of what the tool is and who was in charge of it. The experts’ answer matches what had been on file in Oakland since 2019. A state that wants to use software that takes over its citizens’ phones must first be able to describe that software to its own courts. A civil court in California managed it in a dispute between 2 companies. A criminal court in Warsaw should be able to manage it before it signs.

Frequently asked questions

Was the use of Pegasus in Poland legal? No court has given a final answer. A Senate commission concluded in 2023 that it was illegal; prosecutors have charged 7 people, including for running the system without security accreditation and for baseless surveillance orders; a Sejm committee has referred 11 people for prosecution. The dispute is not whether the state may ever reach into a phone but whether this tool stayed within the court’s order and within the rules on classified information.

What did WhatsApp v. NSO Group actually establish? That NSO built a counterfeit WhatsApp client and 3 installation vectors, Heaven, Eden, and Erised; that its code passed through WhatsApp’s servers in California; that it kept developing new vectors after the flaw was patched and the lawsuit filed; and that customers did little more than enter a phone number. The court found NSO liable in December 2024, a jury awarded damages in May 2025, and in October 2025 the court permanently barred NSO from targeting WhatsApp.

Can Pegasus material be used as evidence in a Polish trial? Article 168a of the Code of Criminal Procedure says that unlawful acquisition alone is not a ground to reject evidence, except where a public official obtained it through homicide, bodily harm, or unlawful imprisonment. Every other ground survives: a defendant can challenge Pegasus material under the Constitution, the fair-trial guarantee of the European Convention, the Supreme Court’s 2018 resolution on Article 168b, its 2023 ruling on unlawful CBA provocation, and the Wrocław Court of Appeals’ 2023 judgment, now before the Supreme Court.

How do we know that Pegasus data left Poland? From the opinions of forensic experts at the ABW, prepared for the National Prosecutor’s Office after an inspection of the system at CBA headquarters. The experts identified foreign IP addresses used to transmit data and found that the anonymizing network was managed by the manufacturer. They did not determine whether the manufacturer actually read material from any specific operation.

Legal and factual status as of October 14, 2026.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.