CBA did not control Pegasus. Here are ABW's new findings

Pegasus is commercial spyware designed to gain deep access to a targeted smartphone. Unlike ordinary monitoring, it can potentially observe activity on the device itself. That matters because a phone contains private conversations, contacts, photographs, documents, and location history. The supplied headlines focus on Polish oversight findings, not a technical description of Pegasus.

In general, once deployed successfully, spyware of this kind may read messages on the device, collect files, record sound, activate a microphone, access a camera, and track location. It can also capture information before encryption or after decryption. These capabilities make the phone a surveillance sensor, rather than merely a communications channel.

The article headlines report that experts examined Pegasus and reached concerning conclusions about CBA control. They also mention use “without knowledge and consent.” They do not identify a particular target, device, or capability. Any assessment of a specific investigation therefore requires technical evidence and legal review.

The central issue is control. The supplied headlines state that CBA did not control Pegasus, or did not have full control over it. That matters because an agency using powerful surveillance software should know who can operate it, what data it collects, and how access is recorded. Without that clarity, responsibility becomes difficult to establish.

ABW experts examined the system, while other headlines refer to “biegli,” or appointed experts, and to concerning conclusions. The source does not describe the system’s architecture, identify every operator, or explain whether CBA could start surveillance, retrieve data, change settings, or review logs. Those details would be needed to define the precise meaning of “no full control.”

The current reported position is therefore limited but significant: CBA’s authority or technical command was not complete. The findings may prompt further investigation into supervision, authorization, and accountability. The headlines also indicate political reactions, including a statement by the justice minister about full responsibility.

The institutions clearly named in the supplied headlines are CBA and ABW. CBA appears in reports about control of Pegasus. ABW appears through experts who examined the system. The headlines also mention a justice minister reacting to the findings, but they do not name that ministry as the system’s purchaser or supervisor.

The source distinguishes several functions without assigning each one fully. Experts and “biegli” examined Pegasus. CBA is discussed as an operator or institution expected to control it. ABW is connected with the new findings. A minister responded publicly. No headline identifies the contracting body, the precise supervising authority, or every investigative institution involved.

That limited institutional map is itself important. It shows that the controversy concerns both technical control and public accountability. To establish who acquired, authorized, used, or reviewed particular operations, investigators would need procurement records, access logs, legal orders, and testimony. Those details are not supplied here.

Ordinary phone surveillance often focuses on communications passing through a network, such as call metadata or messages obtained through legal requests. Pegasus-type spyware can potentially reach the phone itself. That distinction matters because the device may contain information never sent across a network, including drafts, saved files, photographs, and app activity.

In general, successful spyware deployment may allow investigators to read messages, collect files, obtain location data, and activate microphones or cameras. It may also expose messages inside encrypted applications after they are readable on the device. The exact access depends on the version, infection method, permissions, and target phone. The supplied article does not provide those technical details.

The reported Polish concern is not a quantified comparison of access. Instead, the headlines say experts found troubling issues and that CBA lacked full control. Any claim about a specific phone’s recordings, images, or messages would require forensic evidence, system logs, and a clear legal authorization.

If powerful spyware was used without proper authorization, the damage could reach beyond privacy. Prosecutors and courts might question how evidence was obtained, whether it was altered, and whether the target’s rights were respected. Investigations could face delays, challenges, or exclusion of material, depending on applicable law. The supplied headlines do not state that any particular case has already failed.

The central concern is accountability. If CBA did not have full control, investigators may need to establish who operated the system, who approved each action, and who retained the data. A claim that surveillance occurred “without knowledge and consent” would make those questions especially urgent. Technical logs, authorization records, and chain-of-custody documentation would be crucial.

Public trust could also suffer. People may doubt whether surveillance powers are limited and independently checked. The justice minister’s reported call for “full responsibility” signals a possible political and legal response. The eventual consequences depend on verified facts, court decisions, and any reforms that follow.

Powerful surveillance should be limited by law, necessity, and proportionality. A competent authority should authorize a specific operation against a defined target for a defined purpose and period. The request should explain why less intrusive methods are inadequate. Secret powers still need rules that protect privacy, due process, and confidential information.

Independent oversight should not depend solely on the agency operating the tool. A court or legally independent body can review applications before deployment. Inspectors, parliamentary committees, data-protection authorities, or judges can later audit use. Access logs, operator identities, approvals, collected material, retention periods, and deletion records should be preserved for review.

The supplied headlines make these safeguards especially relevant because they report that CBA lacked full control and that use occurred “without knowledge and consent.” They do not describe Poland’s exact authorization process or any confirmed breach. The practical goal is traceable responsibility: every operation should have a lawful decision, an accountable operator, and an independent audit.

Serious investigations do not depend on one spyware platform. Legal alternatives include targeted interception authorized by a court, requests for communication records, searches governed by warrants, financial investigations, witness interviews, undercover work, and cooperation with service providers. Open-source research can also identify relationships, movements, or public evidence without entering a private device.

Technical tools can be limited too. Investigators may examine a seized device under a warrant, create a forensic copy, and preserve its integrity for court. Access can be divided between teams, with separate approval, logging, and auditing. Strong encryption, evidence hashing, retention limits, and automatic access records can reduce unauthorized use. No single agency should silently control every stage.

The headlines do not list alternatives or say which methods Polish investigators used. They do show why alternatives and safeguards matter: experts reportedly found that CBA did not have full control over Pegasus. A lawful, documented mix of methods can preserve investigative effectiveness while making responsibility easier to verify.