‘Democracy on Wiretap’ Report

Spyware today is one of the most significant threats to democracy, human rights, and cybersecurity in the European Union and worldwide. For non-democratic governments it is one of the key tools used to maintain power and eliminate opponents: journalists, lawyers, opposition figures, and human rights defenders.

Spyware reaches through the ins and outs of a device – including through sensitive journalistic data, intimate correspondence with loved ones, online banking and social media activity. It allows for remote control of the microphone or camera. Used without scrutiny, spyware might very well be regarded as a ‘nuclear weapon’ stripping targets of all privacy.

Unscrutinised use of such technology poses a threat to the rule of law and civic engagement. It enables planting evidence and, consequently, framing people for crimes they did not commit or discrediting inconvenient journalists or activists. The Polish experience on the matter was particularly stringent. Between 2017 and 2022, Pegasus was used by authorities to spy on politicians: it provided the government with extraordinary insight into the opposition’s plans. In fact, authorities went much further. As it will be detailed below, law enforcement authorities used spyware to extract 10 years of texts from one target, reorganised the texts and even merged some of them in order to rebuild a brand new narrative. This narrative was later sent to public TV and broadcasted, as part of a political smear campaign.

Despite multiple abuses having been exposed all over Europe, we are still learning about new cases of unauthorised use of spyware. Authoritarian regimes as well as democracies resort to it. They often deny using such tools – or admit to using them only after undeniable evidence has been revealed. At this stage we are not able to say whether Polish authorities still resort to such tools. However, it cannot be excluded.

Why? Because the widely publicised promises of accountability and legislative changes have not been delivered.

Security services representatives argue that they need spyware to operate effectively. Their main argument: the growing popularity of encrypted communication, which cannot be accessed with conventional methods of surveillance, such as retrieving phone records from telecom operators or the standard court-authorised wiretapping. This is why more than 100 countries around the world are now using – or independently developing – different types of spyware.

Yet, spyware is like a nuclear weapon: it can determine the outcome of a war, while, at the same time, cause humungous damage. Politicians cannot ignore its existence any longer. A clear legal framework is necessary to prevent it from being used beyond scrutiny. Just as a nuclear weapon requires adequate safeguards for people’s protection, spyware requires safeguards for civil rights and liberties.

This report examines why it is necessary both to conclude the ‘Pegasus scandal’ investigations, and to adopt legislation on spyware immediately. Poland needs to implement systemic changes to rules governing the judicial authorisation for an oversight over the use of surveillance techniques by the security services.