Control and data flows

The Sejm commission investigating Pegasus, chaired by Magdalena Sroka, presented the public part of its final report on Monday, 12 October 2026. Accounts differ on its length: one puts the public part at 370 pages, another the whole document at 700 pages, and the rest is to be presented in closed sessions. Sroka said Poland did not have full control of the system, since part of its infrastructure remained under the control of the Israeli firm NSO Group and data taken from phones was sent through foreign IP addresses. According to the commission, the manufacturer could access material gathered during operational control, and warnings about data flowing abroad had appeared as early as 2017. Opening the sitting, Sroka set out the core conclusion:

“The commission does not question the need to equip Polish services with the most modern operational tools. What it does question is that the state was treated like a private farm, and the law as an obstacle to be bypassed.”

Accreditation and court approvals

According to the commission, Pegasus never obtained the required IT security accreditation, and the CBA did not ask the Internal Security Agency to carry it out, so the system was used without meeting information-protection rules. Judges who approved operational control were not told what the tool could do. Judges questioned by the commission testified that they did not know Pegasus could reach the entire content of a phone, including messages, photos, contacts, location and past data. In a statement issued before the sitting, the National Prosecutor's Office cited expert opinions that the CBA did not have full control of the system, that the manufacturer may have had access to the infrastructure where operational-control material was stored, and that data sent by the system left Polish territory. Sroka also said the commission found Pegasus was used against people for whom there were no grounds for its use.

Cost and funding

Sroka said the 2017 purchase of Pegasus for the Central Anti-Corruption Bureau (CBA) cost 33.4 million zloty, of which more than 8 million zloty went to an intermediary company. That figure excludes operating costs, maintenance and licence extensions, which she said bring the total bill to a significantly higher level. The bulk of the funding, 25 million zloty, came from the Justice Fund. Commenting on the report, the prime minister said Poland had paid over 60 million zloty in total, including 25 million from the Justice Fund, money he said was meant for crime victims. He added that more than 30 million zloty had gone to an Israeli company.

Notifications to prosecutors

The commission sent notifications of a possible crime to prosecutors concerning 11 people. They include former justice minister and prosecutor general Zbigniew Ziobro, former deputy justice minister Michał Woś, former special services coordinator Mariusz Kamiński, deputy coordinator Maciej Wąsik, former CBA head Ernest Bejda and his deputy Grzegorz Ocieczek, former ABW head Piotr Pogonowski, former SKW head Maciej Materka, former Gdańsk regional prosecutor Teresa Rutkowska-Szmydyńska, former Justice Ministry director Mikołaj Pawlak and former SKW deputy Maciej Szpanowski. Sroka said the basic charge linking almost all the notifications is exceeding powers and failing to perform duties. Some notifications go further, concerning the disclosure of classified information to foreign entities, large-scale property damage and aid in acquiring a tool for computer crimes. These are notifications of possible offences, not charges. Sroka noted that 432 MPs voted to set up the commission in 2024 with none abstaining, and that Law and Justice politicians also voted for that law.