All Eyes on Poland: ECHR Rules on Surveillance Law

AT A GLANCE

Following the defeat of the, evidently ironically named, Law and Justice Party (PiS) in Poland last year, investigations and probes into their abuse of Spyware have been launched, both in Poland, by the Civic Platform Party (PO), and at the European Court of Human Rights (ECHR). This comes on the back of 2023's investigation into abuse by the Committee of Inquiry established by the European Union to investigate the use of Pegasus and equivalent surveillance spyware (PEGA). In this, Poland was a main target of the committee's investigative powers, uncovering a number of critical abuses against it's members of civil society, adversarial politicians, and prosecutors.

On May 29th, 2024, the ECHR ruled that the Polish surveillance law passed by the PiS government in 2016, violates the European Convention on Human Rights. The law in question was introduced under the guise of increased anti-terrorism measures, providing authorities with increased powers to surveil citizens and store their data.

Background

Elected to a majority government in Poland's 2015 parliamentary election, notably the first occurrence in Poland's democratic history, the PiS government quickly began enacting dystopian surveillance legislation to provide themselves a legal framework by which they could operate.

The warning signs of their intentions were there. Four years prior to forming a majority, the PiS party leader Kaczyński idolized Orban in a television address proclaiming that there will come a day when they, the PiS party will succeed, and that they will, "have [a] Budapest in Warsaw." Orban, the leader of Hungary, notably having deployed spyware against his enemies frequently and pervasively.

In 2018, the spotlight was shone on Poland, when a report published by the Citizen Lab entitled "Hide and Seek: Tracking NSO Group's Pegasus Spyware Operations in 45 countries" analyzed suspected Pegasus infections around the world, observed spyware infrastructure in the country. Questions began to trickle out around who it may have been deployed against, how it may have been used, and of course, for what reason.

Quick to the Jump

It wasn't until 2023 that we finally had those questions answered. As PEGA convened, and began their investigations, the Citizen Lab reports were confirmed and a small portion of the targets came forward to report their infections.

The Polish newspaper Wyborcza stated that, according to their sources, "Adam Hofman, former PiS party spokesperson was spied upon in 2018, making him one of the first targets following the purchase of the spyware." Confirming that as early as 2018, PiS was targeting citizens within their borders. This highlights that, almost immediately upon acquiring Pegasus, the PiS began to deploy it as a means to keep tabs on their adversaries. Following the lead set forth by Hungary, the PiS was willing to target not only those on the "other side of the aisle", but also members of its own.

This fact was further by a Wiadomosci report highlighting that two other active members of the PiS were spied on vis a vi Pegasus. In this instance, the operators obtained damaging materials and launched character assassination campaigns against the victims, Mariusz Kaminski and Dawid Jackiewicz, providing cause to demote and expel them.

Another notable case brought forth to the PEGA committee was the targeting of Polish prosecutor, Ewa Wrzosek. Amidst her investigation into the PiS party's decision to hold a presidential election, despite the ongoing COVID-19 pandemic, she found herself to be the target of Pegasus infections, having been compromised as many as six times between June and August of 2020. The results of her investigation may have contested the party line. Her subsequent dismissal from the case, and the dropping of the investigation, demonstrated the lengths to witch the PiS would go to punish those pursuing topics against its narrative.

Launching complaint in Polish court's regarding the infection of her mobile phone Wrzosek was met with fierce opposition by the government's representation. The court, and Wrzosek, ordered and expert opinion on the infection to be performed by Citizen Lab, well regarded for their abilities in such investigations, the prosecutor in turn rebuffed the request and opted for another expert. This, prosecutor selected, expert contradicted reports and stated that her device was, in fact, not infected by Pegasus. The prosecutor pushed further by requesting that they be provided with Wrzosek's metadata for a time period irrelevant to the court proceedings.

In her statement to the committee, Wrzosek described that, "she is still under surveillance and that the prosecutor's procedure is aimed at providing additional evidence that could be used against her in other cases." This instance further demonstrates the ways in which magistrates and state employees, whose very duty it is to apply and enforce the law, can not only have their lives upended a result of spyware but, in a distorted legal framework, be further targeted and victimized by the legal system.

The Legal Framework.

Analyzing the Polish legal system, the PEGA report highlighted that "the existing authorisation procedure does not serve as a safeguard against abuse, but rather as a means to lend a veneer of legality to surveillance used for political purposes." And it is this legal framework which has now been ruled in violation of human rights by the ECHR. Whilst there may have been independent bodies by which the PiS actions could have been held accountable by, the PEGA committee found, "the scrutiny and remedies offered by other independent bodies have also been severely weakened." This was compounded by a constant war waged against these bodies' staff members, through harassment and intimidation, leading to their work being not only obstructed but severely hindered their ability to act as an effective counter-power.

The case of European Human Rights violations was brought forth to the ECHR by five Polish lawyers, Mikołaj Pietrzak, president of the Warsaw Bar Association; Dominika Bychawska-Siniarska of the Prague Civil Society Centre; Wojciech Klicki from the Panoptykon Foundation; Barbara Grabowska-Moroz from the Institute of Democracy at Central European University; and Katarzyna Szymielewicz, co-founder of the Panoptykon Foundation.

Until the ECHR ruling, recourses by individual parties whose privacy was violated by spyware was nearly impossible as "the burden of proof [...] is on them and it is virtually impossible to prove the illegitimate use of spyware without the cooperation of the authorities." Effectively, the PiS enacted a legal framework whereby the surveillance of regime dissenters was facilitated by active and regular weakening of institutional counter-powers and the near-impossibility for victims to obtain justice following a violation of their rights with spyware.

The ECHR found that the rules around spyware, "did not provide sufficient safeguards against excessive recourse to surveillance and undue interference with individuals’ private life." Noting that the legislation does not require courts to authorize surveillance to confirm "reasonable suspicion." As well, the ECHR noted that "the secret-surveillance provisions in the Anti-Terrorism Act also failed to satisfy the requirements of Article 8 of the Convention" as there were no mechanisms to review the application of surveillance by independent bodies. The decision to perform secret surveillance was handled by the Polish Internal Security Agency (ABW), under the supervision of the prosecutor general and minister of the security services. As these roles were held by the same individual, the ECHR determined that surveillance activities could have been subject to political influences.

UNDER THE MICROSCOPE

Poland is by no means the "canary in the coal mine," those have long since died as the noxious gas of spyware has swept across democracies, worldwide. They are however, the first instance of the cards being laid out following the defeat of a surveillance hungry party.

We are seeing, what can be done in a democracy when the legal framework to orchestrate wanton abuse of human rights is instituted. It has become evident that democracy alone will not protect us from these measures. We must watch the actions of our governments, we must hold them accountable, we must investigate their use of spyware whenever and wherever possible.

Whilst Adam Bodnar, justice minister and prosecutor general for the PO, stated that they welcome such decision, it behooves us to continue to monitor the actions of this next government. How they act, and react, towards their citizens complaints will demonstrate whether a government can reverse the horrid surveillance instituted by a previous party and heal the wounds of democracy.