Hello! It’s 007.

In early 2022, Citizen Lab, an interdisciplinary laboratory based at the University of Toronto, Canada, informed about a number of people under surveillance in Poland. The list of politicians, journalists, officials, and judges who handed their phones over to the lab for investigation is growing longer, as it was established, surveillance had been featured with the use of state-of-the-art methods. One of the tools allowing such methods is Pegasus, which virtually cannot be protected against. It enables taking complete control of the phone — not only eavesdropping on calls or monitoring text messages but also downloading the entire content of the phone, breaking into all information stored on the phone, and also getting ongoing access to the camera or loudspeaker.

IS POLAND AN ORWELLIAN STATE?

In George Orwell’s “Nineteen Eighty-Four,” we read about the phenomenon of thoughtcrime — a crime taking place in a fictional state that comes from newspeak and is the result of combining the words “thought” and “crime.” In practice, it means acting against the line propagated by the Party and Big Brother. Thoughtcrime is detected by the Thought Police, which acts as a secret service. A person declared a thought criminal by the Thought Police is evaporated, i.e. all their data is erased from the books and all traces are erased. Orwell owes his own adjective to this book alone and his idea that wellbeing is crushed by the restrictive and untruthful government. At the time when “Nineteen Eighty-Four” was published, hardly anyone thought about the possibility of oppressive power having the technical means to spy on citizens. Today, the state has such means. It is true that it is not extremely oppressive. But it cannot be precluded that it will turn into an oppressive state. There exists a tacit social consent that allows the authorities to keep an eye on everyone. In Orwell’s vision, the society is divided into the socially unconscious Proles, interested only in satisfying their basic needs — they do not need to be watched over, unlike extraordinary citizens who can potentially organize the Proles into a significant force. Hence, for many people, surveillance is not a big problem. We don’t even experience it every day. Nevertheless, we are aware that it is happening — on the internet, through cameras on the streets, or through social media.

NO BIG DEAL

Surveillance is taboo in today’s world. Nobody wants to talk about it and it causes conflicting emotions. After NSA whistleblower Edward Snowden leaked unfavorable reports on spy actions of the US administration in 2013, comments were very varied, including that Snowden’s actions had devastated the authority of Western democracies and their citizens’ trust in the authorities. The illegality of the government’s actions was not paid attention to very much. After all, every country uses various methods to obtain valuable information. Perhaps, the trick is that we should be aware that we are “under control.” Surveillance is always justified by the need for prevention and detection of terrorism, arms and drug trafficking, corruption, and tax evasion.

Nevertheless, the scope of scrutiny should be limited. If someone is convinced that the state’s intervention in terms of surveillance of criminal offenders is indispensable, how to draw boundaries for surveillance used in a political game? In light of the present knowledge, Pegasus could have been used in Poland to test the opposition’s ideas and use them in pre-emptive actions. Moreover, it allows more control over judges, officials, and others, and they can be more easily intimidated or discredited. 

IS IT LEGAL?

Prof Marcin Wiącek, Poland’s human rights commissioner, says: “The Polish law does not allow the court to consent to surveillance using this type of device.” Generally, customary methods of legal operational control that must be approved by the court may last up to a year. On the other hand, without the consent (and thus without a trace), the services can eavesdrop for up to five days — and if they do not obtain the consent of the court — the materials must be destroyed. Unfortunately, the so-called consumption of the fruit of the poisonous tree doctrine, introduced to Polish law in 2017, allows the use of illegally obtained evidence. It is no coincidence that in the same year, the Central Anticorruption Bureau (CBA) purchased the Pegasus system and the Polish services gained the possibility of uncontrolled surveillance of smartphones and tablets, bypassing the courts.

To sum up, in Poland it is not allowed to keep people under surveillance or use systems such as Pegasus, but if something is found, it might be used in court cases. Law formulated this way is a great stimulus for secret services, but also a threat to privacy. Once an exception is made in the case of an important president, judge, prosecutor or businessman, it may happen to anyone anytime. The question is, will it have a deteriorating effect on democracy and freedom in Poland? From the citizens’ point of view, it does not look good. Knowledge of the purchase of surveillance equipment is a secret. The right to keep people under surveillance is a secret. Whether this right is exercised by services in relation to any entity is also a secret — not only we cannot find out whether we are being eavesdropped on, but also we can’t find out whether we have ever been eavesdropped on. Is it time to check our phones ourselves?

ANTI-PEGASUS SOFTWARE AVAILABLE

Amnesty International Security Lab has developed a special Pegasus trace surveillance software called MVT, and — in cooperation with Citizen Lab — has initiated an investigation on the scale of its use. MVT is available for free: every user of iOS (Apple) and Android smartphones is able to detect whether they were a potential target of an attack.

What does this mean for business? If software like Pegasus is ever resold in the open market, it will virtually be impossible to track who ultimately bought the tools and for what purpose/s. One of the reasons the NSO Group’s Pegasus is so well-recognized is that it is the only software capable of performing certain operations. In other words, it plays in its own league against its competitors. Citizen Lab analysts indicate that companies are not the main target of Pegasus and similar tools, and the vast majority of confirmed or suspected infections do not concern corporate espionage, also due to restrictions on sales to the private sector. Beyond that, corporations are good at implementing security measures, phishing protections, wherever possible.

In 2022, the presidium of the European parliament decided to appoint a cross-party investigative committee dealing with the use of the Pegasus surveillance system. Meanwhile, Polish politicians have claimed that if someone has nothing to hide, there is nothing to be afraid of. Is there anything more to be expected?