Hacker News new | past | comments | ask | show | jobs | submit login
Poland’s PM says previous government illegally used Pegasus spyware (apnews.com)
242 points by arkadiyt on Feb 18, 2024 | hide | past | favorite | 81 comments



Just bear in mind that this is the same Polish PM whose former government set World record making requests to Apple for data from 241 509 iPhones in 1H2015… (out of 300 thousand total request from the entire World)…

Quarter milion iPhones in 2015 in Poland was basically everyone who counts in public life.

https://www.apple.com/legal/transparency/pdf/requests-2015-H...


Making requests is one thing, because Apple can deny the request, while using Pegasus simply hacks the phone without oversight.


Thank God we have Apple to uphold civic society and due process in Poland


from your linked document:

*Poland: predominately requests from Customs and Revenue Authorities


KAS is under government control MoF, not an independent institution, right?


KAS has very specific mandate though and doesn't share with other institutions - they tend to go after very specific things that they do know how to get.

Not that it's a crystal clear institution, but everything will go around taxes and customs with them, even when it's something rotten.


1 Over 7000 licenses for Pegasus alone. Both opposition and own party surveilled.

2 Usage of Pegasus means all intercepts are on the servers in Israel. All Government secrets and potential kompromat transferred to foreign power.


3. And most importantly: all of that funded by the taxpayer, to satisfy one man's paranoia.


Even worse. Pegasus was all paid from the 'Justice Fund', which was intended to help crime victims.

https://www.funduszsprawiedliwosci.gov.pl

"The Justice Fund provides immediate and free emergency assistance to crime victims, witnesses and their closest relatives, including victims of armed aggression in Ukraine.

You can use the free:

legal aid, psychological help, material assistance"

Quite fitting considering previous corrupt regime was ran by PIS, which doesnt stand for piss but 'Prawo i Sprawiedliwosc' - Law and Justice.


>Usage of Pegasus means all intercepts are on the servers in Israel

Wait, seriously? Any sources on that? I find it hard to believe that any government would spend $$$ on a security tool that doesn't allow on-prem installation and instead beams all your surveillance to another country.


NATO countries' governments and military use phones with encrypted communications to which the US has the keys. This fact was made available during investigation into the Polish government plane crash in Smolensk. The US authorities have access to the recordings of the calls made by the late president of Poland, but said they would not make them available.

source: https://www.money.pl/archiwum/wiadomosci/artykul/usa;nie;uja...

Indirectly, all software vulnerability tools that send source code and other artefacts to servers outside government's control give third parties access to information about potential attack vectors, software vulnerabilities, and infrastructure layout.


>NATO countries' governments and military use phones with encrypted communications to which the US has the keys.

What do these phones look like and who manufactures them?


I’m curious about this statement too, seems there’s evidence that they don’t and the customer is the data handler: https://www.edps.europa.eu/system/files_en?file=2023-01/0221... top of page 4.

I guess this is all according to NSO claims. I’d like to see evidence otherwise!


Why would you trust anything a spyware company says? This is not a tongue-in-cheek question.


No honour among the thieves


It is a lot of money lost if it comes out that you lied to some of your biggest clients.


Not if your customers are reticent to even admit being a customer in the first place.


Your other customers will see every major headline that you lied and kept confidential documents.


That was one of the claims during parliamentary committee investigating it.


S(pyware)aaS


a) it's not a security tool but spyware b) this spyware is meant to spy on the government so this job is better outsourced to another government


You have a lot to catch up on, then.


this was meant to be used for spying terrorists and such, so should not be big deal

from what I heard about Pegasus: noone could get that malware for themselves to not compromise it, so it's you wanted to hijack some phone you would send them phone number so they could resend exploit again (spyware was not persistent across reboots, so you needed to rehack it every time)


best of all they spy on their own party members and some businessmen's which were rivals of some party members family


To absolutely no one's surprise.


What is surprising is that Poland was able to rescue itself from this catastrophe with democratic means. Unlike Hungary and Belarus.


This is what happens when democracy starts to dysfunction and the ruling party wants to cling to power any means necessary.


Is Pegasus still working, or OS manufacturers patched the vulnerabilities it was using?


Pegasus is only the malware that has the spying capabilities (file upload, download and command execution...etc).

it usually infects the intended target using an exploit (0-day) that doesnt have a fix, if you're asking if there are 0days that can hack modern iPhones, the answer is most likely yes, given the most recent hack against the iPhone of one of the executives of the russian cybersecurity company Kaspersky [1].

[1] https://www.youtube.com/watch?v=1f6YyH62jFE


Pegasus is in constant development, its not one off spyware


Fuck NSO Group.


And, more importantly, fuck the states that support them, and the people who are complicit with them at any level.


They are too many.


NSO is just a strawman for the government of Israel. Surveillance technology is a very successful soft power tool, as the dictators crave its capabilities to stay in power. Pegasus is world class technology, so Israel could score a lot of brownie points by allowing these sales. Too bad they got too greedy and sloppy and allowed the phones of some US officials in Africa to be infected. Coincidentally there was a leak of 50000 phone numbers and NSO goes boom. Israeli "security diplomacy" rebuilt NSO and is still going strong, surprised i am not :-(


Yep. One could also say "fuck state surveillance", but it doesn't have quite the same ring to it (and coincidentally implicates Apple and the NSA).


Why? It serves no purpose, if it wasn't them, it would be New NSO Group instead. So long as these vulnerabilities exist, they're going to be exploited. Every time they find an exploit it's a moment of pure genius. With every new baseband and every new OS update there's a good chance that they find they have no answer. I don't blame the hackers in the slightest. It's also not useful to blame governments.

More useful to blame the systemic issues that allow these things to take place: the one that pops to the front of my mind is that the FCC has such a high degree of standards with modems that it results in a severe lack of competition. Google and Apple choose to release phones without contractually demanding full source access to the entirety of it so that it can be audited by their security teams. Those are things that can and should change.


What? Pegasus is not enabled by modem vulnerabilities. The primary vulnerabilities used on iOS phones are in Apple designed and implemented components and the primary vulnerabilities used on Android phones are in Google designed and implemented components.

The problem is not that Google and Apple did not have the opportunity to secure the vulnerable components. The problem is that their best teams with thousands of people and billions of dollars are completely incapable of designing systems secure against moderately resourced attackers.

They openly admit that their systems are defenseless against attackers with resources. Every single time their security is completely invalidated they make press releases like: "It was a unprecedented attack using never-before-seen techniques by highly sophisticated attackers." implying that they can not be blamed because look, they were "highly sophisticated" and it was "unprecedented" there is no way we could stop that. Even though every single attack is described that way.

You would be hard pressed to find a single technically competent security developer in any of these organizations which would claim their systems could stop their systems being totally and utterly compromised and their security completely invalidated by a single, individual, lone competent hacker with a year to work on attacks. A team of 3, forget about it. That is only in the low millions of dollars to completely invalidate their entire security story for all hundreds of millions to billions of systems worldwide.

No, the problem is not a lack of accessibility, effort, resources, or focus. The problem is that all of these large companies have failed for literal decades to develop systems secure against competent attackers. And the entire time they have been intentionally deceiving the public into thinking they can even though they know and admit they can not.

The solution is to stop believing these perennial incompetents and liars until they present solid, auditable proof. At least then they can not suck all of the air out of the room from people who actually know what they are doing.


> The problem is that all of these large companies have failed for literal decades to develop systems secure against competent attackers.

I don't think they tried. One of their main customer is a 3 letter agency which has no interest that the bugs get fixed.


The NSO is only supplying a product for which there is insatiable demand from every government. If they wouldn't build them, someone else will.

They're kind of like arms manufacturers. Do you blame them if your government shoots you?


> The NSO is only supplying a product for which there is insatiable demand from every government.

There is also insatiable demand for nuclear weapons, but if a private company from the US started selling them to random dictatorships, yes, I would blame them.


Poland isn’t a dictatorship, it’s an EU member state and a member of NATO.

Also let’s not compare malware/spyware to nuclear weapons.

Poland can get their hands on any weapon or controlled technology they pretty much want.


Pegasus is notoriously sold to more than 40 countries worldwide, among them a fair share of dictatorships: Saudi Arabia, Belarus, Kazakhstan, Azerbaijan, (Hungary?), Bahrain, Russia...


It wasn’t sold to neither Russia or Belarus, and the rest are countries that we sell weapons too all the time.

And I find it laughable that you out Hungary as a dictatorship it’s an EU member and a NATO member.


You truly have some bias in your definition of dictatorship.


A bias towards democracy.


Like Canada, US ...


That would be an argument if we weren’t selling weapons to those countries all the fucking time.


If the arms manufacturer explicitly works with unethical and illegal uses of clients as main sales target, yes.


Of course I do. Is your theory that manufacturing weapons of war is a morally neutral occupation?


> They're kind of like arms manufacturers.

More like hired hitmen.


> If they wouldn't build them, someone else will.

Nobody thinks that we can prevent everyone from doing something. The point of regulating (or making it illegal) and then enforcing those laws is to increase friction, increase costs, and thus making the thing difficult enough to obtain that the problems it causes become manageable. If there are 3 vendors of this sort of thing, then shutting down one of them definitely will make it more difficult for would-be customers by increasing costs and risks. Something does not have to be perfect to be good.

> They're kind of like arms manufacturers. Do you blame them if your government shoots you?

When Iran sells weapons to the Russians we definitely blame them, yes. And the Russians for using them, as well.


Replace NSO group’s spyware with child sex slaves, reread what you wrote, and then revisit your moral compass


Why not target the NSO group headquarters with a drone?


Because that must be helluva drone!


"and illegally" is strangely missing from the title


That's no doubt an artifact of HN's 80 char title limit, which required the submitter to shorten the title.

Edit: I've changed it now.


Is 80 still the hard limit? I see it warns if too long when typing in a new submission. However, HN guidelines don't provide guidance in what to do if the title is too long.


80 is the hard limit with a few weird exceptions like you can have 6 extra chars for " [pdf]".

> However, HN guidelines don't provide guidance in what to do if the title is too long

We can't get to that level of detail in the guidelines—it would make them so long that no one would read them! Except maybe to look for loopholes.


God knows what dystopian regulations/powers they created for themselves.


[flagged]


Worth pointing out that bribed* by PIS reporters have made the Polish "public" (in reality party owned) television into a meme by the sheer amount and ridiculousness of propaganda. What older people watched out of habit and inability to get their information online, was so bad that you could as well watch it as a monthy python episode. And one of the most shown topics was blaming literally anything on the PM that ruled 8 years ago (one who thrown then out now). They blamed from immigrants and war in Ukraine to bad weather and situation in health services. They even showed the guy with parts of his previous party logo as horns and with his face hued with red. I'm not making this stuff up.

*They were bribed with money taken from defunded children cancer treatments.


> What older people watched out of habit and inability to get their information online

The quality of "news" old people end up finding online isn't any better than on TV.

I know because unfortunately, my parents in their 60's, both with advanced degrees, are now more retarded and brainwashed than ever, by all the nasty shit that gets pushed to them on Facebook, Youtube and Tiktok.

I think those are even worse than the TV, because in the EU what gets shown on TV is at least mildly regulated, but what gets shown to you on social media isn't.


The article you've posted is engaging in mental gymnastics and misrepresentation that I've never considered possible.

To sum up the facts:

- PiS got into power several years ago

- PiS fired all the journalists of public broadcasters and replaced them with staff they selected. Major private media corporations in poland were already closely aligned with PiS, and independent media was shut down.

- As a result, for several years all media in poland was pro-government.

Regardless of your political ideals, that's not something that happens in a working democracy.

- In the most recent election, PiS lost.

- The new government fired the employees at public broadcasters that PiS had selected.

The actions of Donald Tusk's government lead to more opinions being represented in media. Which indicates that Tusk's government provides more freedom of the press than the previous one.


> Major private media corporations in poland were already closely aligned with PiS [...]

This statement is an outright lie. For example, Gazeta Wyborcza, all of Agora Media, and TVN have always been anti-PiS.

>[...] and independent media was shut down.

Can you elaborate on this?

> As a result, for several years all media in poland was pro-government.

Completely untrue.


> that's not something that happens in a working democracy.

PiS winning their second term would also be a product of a working democracy. Their certain continuation of their power grab would be a contradiction to your statement.


> Major private media corporations in poland were already closely aligned with PiS

Actually... it was quite the opposite. The vast majority of private media were not pro-PiS. The problem only concerned public media, financed from the state budget


>Remix is funded in part by the Batthyány Lajos Foundation in Budapest

Yeah that's the usual populist Fidesz propaganda then, why I'm not surprised

Edit: you can downvote me these are facts

HUF 3.5 billion from Rogán's ministry to the Lajos Batthyány Foundation, full of Fidesz members https://444.hu/2020/06/10/35-milliardot-kapott-rogan-miniszt...

Rogán's Ministry gave HUF 9.2 billion to the Lajos Batthyány Foundation in January https://hvg.hu/gazdasag/20230228_rogan_miniszterelnoki_kabin...

The Protected Society Foundation has received HUF 22 million from the Lajos Batthyány Foundation, which operates with billions of public funds, according to a report by the organisation that spreads far-right ideas https://telex.hu/belfold/2023/05/26/vedett-tarsadalom-alapit...

The Fidesz-affiliated The European Conservative aims to become a leading European news publication, and will receive the necessary support from the government through the Lajos Batthyány Foundation (BLA), worth more than HUF 1.6 billion https://index.hu/kulfold/2023/07/26/brusszel-batthyany-lajos...

etc etc etc


Call it what it is: Fidesz is an arm of the Putin regime.


No, he kicked previous party minions from Public TV station, politicians who somehow had private passes allowing them to roam free around Public Broadcaster facilities.

Previous regime in Poland was super close to becoming another Hungary with only Party aligned media being allowed to operate. They did try to shut down US owned TV station by using "anti russian media influence" law https://en.wikipedia.org/wiki/Lex_TVN


[flagged]


They have a new one, you know?


yeah that's the one I was talking about. The one who's acting like a dictator and shutting down the free press


You are either a professional troll, or you don't know which year we are living in.

Maybe both...



Politicians committing crimes end up in courts and then in prison, plain and simple. And this is plain propaganda, repeating many talking points of the PiS party (the party previously in power, who illegally used Pegasus).


iT's poLitICal PerSeCutiOn!


> The former top European Union official’s party only won 30% of the vote compared to the 36% of his incumbent conservative, EU-skeptical rivals, the Law and Justice (PiS) party, but was nonetheless able to assemble a coalition of leftists to take power.

Just one party in this coalition is from the left. The rest is decidedly centre to centre-right.

Hard to treat this piece seriously.


Doesn’t even matter, coalition governments are a central feature of parliamentary democracies with roughly proportional elections.

Anyone who can form a coalition can rightfully govern. Those who get the most votes don’t automatically get to govern.


I didn't even pay attention to that part, but indeed it's equally absurd.


It feels surreal to hear this crap translated into English


The author seems to contradict themselves in many places… maybe they just really want it to be true. For example, “allegedly” and “convicted” in this case:

> He was convicted during Tusk’s previous regime (2007-2014) for allegedly abusing his power while pursuing government corruption with “excessive zeal,” but was officially pardoned by then-new President Andrzej Duda in 2015 – a long-standing point of displeasure for the Polish left.


Is anyone fooled by this drivel? Honest question. Because some things are pernicious: misleading but in a subtle way, sly and devious. This is just so in-your-face laughable.


About 40% of American voters appear to be falling for it.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: