Polish Intelligence: History, Structure, and the Headlines

Poland sits on NATO’s border with Russia, Belarus, and Ukraine, and since February 2022 it has been the main land route for Western military aid to Kyiv. That geography has made Polish intelligence one of the busiest services in Europe. Polish authorities have charged spy rings that put cameras on railway lines, blamed Russian intelligence for burning down Warsaw’s largest shopping center and for blowing up a railway line, closed every Russian consulate in the country, and seen a Polish judge defect to Belarus. At the same time, the services have been at the center of Poland’s fiercest domestic fight: the use of Pegasus spyware under the previous government.

This page is a working overview of Polish intelligence: its history from the codebreakers who first broke Enigma to the post-communist rebuild, how the services are organized under the law today, who runs them, and the cases that have put them in the news. It relies on Polish statutes, government releases, prosecutors’ statements, and named reporting, and it notes where a claim comes from an interested party or has not been tested in court.

Polish intelligence at a glance

• Internal Security Agency (Agencja Bezpieczeństwa Wewnętrznego, ABW): the civilian counterintelligence and internal security service. Head: Col. Rafał Syrysko, named in December 2023 when the new government replaced the heads of all five special services (Polish government; ABW).
• Foreign Intelligence Agency (Agencja Wywiadu, AW): the civilian foreign intelligence service. Head: Col. Paweł Szota, since December 2023 (RMF FM; AW).
• Military Counterintelligence Service (Służba Kontrwywiadu Wojskowego, SKW): Head: Brig. Gen. Jarosław Stróżyk, since December 2023, and still in post in April 2026, when a new deputy was nominated (XYZ).
• Military Intelligence Service (Służba Wywiadu Wojskowego, SWW): Col. Dorota Kawecka has led it since December 2023; in August 2026 Defence24 described her as performing the duties of head (Defence24).
• Central Anticorruption Bureau (Centralne Biuro Antykorupcyjne, CBA): Head: Tomasz Strzelczyk, acting from February 28, 2025, and appointed by the prime minister in April 2025 after his predecessor resigned (XYZ).
• Political oversight: the Minister-Coordinator of Special Services, Tomasz Siemoniak, who kept the post when he handed the Interior Ministry to Marcin Kierwiński in July 2025 (Interior Ministry); the prime minister’s Board for Special Services (Kolegium do Spraw Służb Specjalnych); and the Sejm’s Special Services Committee, which must give its opinion before service heads are appointed or dismissed.
• Relationship with the United States: allied. Poland joined NATO on March 12, 1999 (NATO), and in August 2024 it released an accused Russian intelligence officer into the multi-country prisoner exchange with Russia, which Poland’s prosecution service said was done “at the request of the US authorities” (Notes from Poland).

History: from the Enigma codebreakers to a NATO service

Polish intelligence’s most famous achievement came before the Second World War. The Cipher Bureau (Biuro Szyfrów), part of the General Staff’s Second Department, known as the Dwójka, recruited young mathematicians from Poznań. In December 1932, Marian Rejewski, working with Jerzy Różycki and Henryk Zygalski, broke the German Enigma machine cipher. Zygalski devised the perforated “Zygalski sheets” to find rotor orders, and Różycki the “clock method.” On July 25–26, 1939, weeks before Germany invaded, the Cipher Bureau briefed French and British cryptologists in the Kabaty Forest near Warsaw and gave each delegation a Polish-built replica of the Enigma, work that Alan Turing’s team later built on at Bletchley Park (Foreign Intelligence Agency). The AW now presents the three codebreakers as part of its own lineage.

After the 1939 defeat, Polish intelligence kept working from exile and underground. The Home Army, the main resistance army loyal to the government-in-exile in London, ran its own intelligence network. Its best-known coup came in July 1944, when Home Army soldiers recovered parts of a German V-2 rocket near Sarnaki, and an Allied Dakota from Italy landed on a makeshift strip in occupied Poland, in an operation known as Most III, to fly them and Polish experts to Brindisi for the British (British Poles).

The communist government installed after the war built a security apparatus on the Soviet model, whose political police in its later decades was the Security Service (Służba Bezpieczeństwa, SB). When communism fell, Poland chose to dissolve the SB but rehire some of its people. Under the 1990 law creating the Office for State Protection (Urząd Ochrony Państwa, UOP), all SB officers were dismissed and could apply to the new service. Qualification commissions, the central one chaired by the UOP’s head, Krzysztof Kozłowski, reviewed 14,034 officers between June and September 1990, and more than 10,439, nearly 75 percent, passed. Only about 5,000 UOP posts existed, so roughly half of those who passed found work there, according to the Institute of National Remembrance (IPN, Przystanek Historia). That compromise, more forgiving than the Czech or East German approach, has been argued over ever since.

The modern civilian structure dates from the Act of May 24, 2002, on the Internal Security Agency and the Foreign Intelligence Agency, which replaced the UOP with the ABW and the AW (Act on ABW and AW). The military services were rebuilt in 2006. The communist-era military intelligence and counterintelligence had survived the transition as the Military Information Services (Wojskowe Służby Informacyjne, WSI). The Law and Justice government abolished the WSI on September 30, 2006, replacing it with the separate SKW and SWW under an act of June 9, 2006 (Act on SKW and SWW). In February 2007, a verification commission’s report on the WSI went to the president and prime minister before publication; RMF FM reported that it contained information on criminal activity by WSI soldiers and collaborators, and Antoni Macierewicz, who oversaw the process, said the document was still incomplete (RMF FM). The CBA was created the same year, 2006.

How Polish intelligence is organized today

Poland has five statutory special services, and their chains of command are set out in public law. The prime minister appoints and dismisses the heads of the ABW and AW after seeking the opinions of the president, the Board for Special Services, and the Sejm’s Special Services Committee (Act on ABW and AW, Art. 14). The heads of the two military services are appointed the same way, but on the defense minister’s motion (Act on SKW and SWW, Art. 13).

• The ABW handles counterintelligence, counterterrorism, threats to the constitutional order and economic security, and the protection of classified information. It is the service most often seen in the sabotage and espionage arrests described below.
• The AW collects foreign intelligence for the government and works abroad. It publishes little and appears in the news mainly through its history.
• The SKW protects the armed forces from espionage and sabotage and carries out security vetting in the defense sector.
• The SWW is military foreign intelligence, reporting to the defense minister.
• The CBA is an anticorruption police service with intelligence powers, and it was the agency that bought Pegasus. The current coalition promised to abolish it. On March 13, 2026, the Sejm voted 231 to 180 to dissolve it and move its functions to the police, the ABW, and the tax administration (Notes from Poland), but on May 11, 2026, President Karol Nawrocki vetoed the bill, citing the risk of jurisdictional chaos and “wieloletniego paraliżu walki z korupcją,” years of paralysis in the fight against corruption (Polsat News). The CBA therefore still exists.

Two features stand out. First, service leadership tends to change with governments; in December 2023 the new prime minister replaced all five heads in one day (RMF FM). Second, because the government and the president come from rival camps, the president’s formal role in appointments and his veto give him real leverage over the services’ shape.

On NATO’s front line

Since Russia’s full-scale invasion of Ukraine, Polish officials have described their country as a target of a Russian campaign of sabotage, arson, and recruitment. In October 2024, the Foreign Ministry withdrew consent for the Russian consulate in Poznań after an attempted sabotage in Wrocław that it attributed to foreign intelligence services, saying Polish services had concluded that “the Russian Federation is waging a hybrid war against Poland” (Polish Foreign Ministry). In May 2025, after prosecutors attributed the Marywilska fire to Russian intelligence, Foreign Minister Radosław Sikorski ordered the consulate in Kraków closed (Notes from Poland). After the November 2025 railway sabotage, he said, “I have made the decision to withdraw consent for the operation of the last Russian consulate general in Gdańsk” (Polish Radio). Russia’s embassy in Warsaw remains open.

Moscow rejects the accusations. Kremlin spokesman Dmitry Peskov said of the Marywilska charges, “These accusations are always absolutely baseless,” and called them part of Poland’s Russophobic stance, according to Russia’s state agency TASS as cited by Notes from Poland. After the railway attack he again accused Poland of Russophobia (Al Jazeera). Russia retaliated for the Gdańsk closure by ordering Poland’s consulate general in Irkutsk shut (Polish Radio).

The pattern prosecutors describe is consistent: handlers recruit through Telegram, pay small sums in cryptocurrency, and use foreign nationals, often Ukrainians or Belarusians in financial trouble, as disposable agents. Prosecutors’ spokesman Przemysław Nowak said in 2025 that several groups of this kind were operating in Poland (Notes from Poland). Most of these cases are still at the charging stage, which matters for how much weight each attribution can bear.

Polish intelligence in the news

Six cases account for most recent coverage of Polish intelligence. Some have ended in convictions; others rest on prosecutors’ charges that have not been tested at trial, and the accused or the governments named deny them.

The Pegasus affair (2017–present)

Poland bought the Israeli-made Pegasus spyware for the CBA in autumn 2017, paying about 25 million złoty from the Justice Ministry’s Justice Fund, according to the Supreme Audit Office as summarized by RMF FM (RMF FM). In April 2024, Prosecutor General Adam Bodnar told the Sejm that three services had carried out surveillance of end devices, which his spokesman said could be colloquially understood as Pegasus use, against 578 people from 2017 to 2022 (TVN24). Critics say the former Law and Justice government used it against political opponents; Prime Minister Donald Tusk has said his wife and daughter were among those surveilled. Law and Justice has argued that Pegasus “was a necessary tool to fight crime and ensure national security” (Notes from Poland), and former Interior Minister Mariusz Kamiński said every request had court approval (Radio Lublin).

The legal status is still moving. In February 2026, prosecutors charged two former service chiefs, Piotr Pogonowski of the ABW (2016–2022) and Maciej Materka of the SKW (2018–2022), with failing in their duties by allowing Pegasus to be used without the required security accreditation. Both deny it; Materka said “it was my duty to provide officers with the necessary and best possible tools,” and Pogonowski said the ABW under him “always complied with legal regulations.” A former deputy justice minister was indicted in 2025 over the purchase (Notes from Poland). Former Justice Minister Zbigniew Ziobro, whom prosecutors want to charge with 26 offenses, one of them approving the Pegasus purchase, denies all of them and calls the case “political revenge”; he left Poland, and in July 2026 Poland asked the United States to extradite him (Notes from Poland). The Sejm’s investigative commission on Pegasus was preparing a final report in spring 2026 with public, classified, and strictly classified parts; its deputy chair said he would not sign it (Telepolis). None of the charges has yet been tried.

Pablo González, or Pavel Rubtsov (2022–2024)

In late February 2022, days after Russia’s full-scale invasion, the ABW arrested a man working in Przemyśl, near the Ukrainian border, as Pablo González, a Spanish freelance journalist. Polish authorities said he was Pavel Rubtsov, born in Moscow in 1982, and a GRU officer “carrying out intelligence tasks in Europe” (Notes from Poland). Press freedom groups called his detention arbitrary, and Spain asked Poland to bring him to trial quickly (The Local Spain). He was never tried in Poland before Poland released him to Russia in the August 1, 2024 prisoner exchange. On August 9, 2024, prosecutors filed an indictment accusing him of passing information to Russian military intelligence from 2016 to 2022; it was not clear whether he would be tried in absentia (AP via Boston Globe). We found no public response from Rubtsov to the indictment.

The railway camera network (2023)

Beginning in March 2023, Polish authorities detained 16 people, most of them Ukrainians, along with two Belarusian students and a Russian ice hockey player. On December 19, 2023, the district court in Lublin sentenced 14 of them, who had pleaded guilty, to one to six years for espionage and membership in a criminal group; the sentences could be appealed. The group installed at least six cameras to watch air and rail traffic, including at the airport and station in Rzeszów, the naval port in Gdynia, and border crossings with Ukraine, and its handler, directing members via Telegram from outside Poland, planned to derail a train carrying military equipment. Prosecutor Piotr Łopatyński called it “a modern, previously unknown way of running and organising a spy network” (Notes from Poland). Polish authorities described it as a Russian spy ring; the reporting we reviewed did not name a specific Russian agency.

The judge who went to Minsk (2024–present)

In May 2024, Tomasz Szmydt, a judge of the administrative court in Warsaw, appeared in Minsk asking for asylum, saying he was being persecuted for opposing Polish government policy. The Supreme Administrative Court lifted his immunity and permitted his detention, stating that he “took part in a hybrid war in the form of an information war waged by Belarus and Russia against Poland.” Prosecutors obtained an arrest warrant on espionage charges, but Interpol declined to issue a red notice, citing its rule against political or military matters (Notes from Poland). Belarus later granted him asylum. Szmydt denies spying and calls the allegations fabricated (AP via ABC News). He has not been tried and remains in Belarus.

The Marywilska 44 fire (2024–2025)

On May 12, 2024, a fire destroyed Marywilska 44, Warsaw’s largest shopping center. A year later, Tusk said Poland knew “for sure” that Russia was behind it, and the National Prosecutor’s Office said the fire was arson by members of an organized criminal group acting on behalf of Russia. Two Ukrainians were charged: one, born in 1975, who is believed to be in Russia and allegedly arranged for the fire to be filmed, and one, born in 2006, who allegedly filmed it and was already in custody in Lithuania over an arson attack on an IKEA store in Vilnius. Russia called the accusations baseless (Notes from Poland). No trial verdict has been reported.

The railway sabotage (2025–present)

On November 15–16, 2025, an explosive charge damaged the Warsaw–Lublin line near the village of Mika, the route toward the Ukrainian border, and tracks and power supply were damaged near Gołąb. No one was hurt. Tusk said the explosion “was most likely intended to blow up the train” and that the two suspects, Ukrainian citizens, had been cooperating with Russian services “for a long time”; both were believed to have left for Belarus (Al Jazeera). Prosecutors charged Oleksandr K. and Yevhenii I. as direct perpetrators of sabotage of a terrorist nature in the interests of Russian intelligence (Ukrinform), and a third man, Volodymyr B., with helping with reconnaissance (Anadolu). Prosecutors sought European arrest warrants for the two main suspects (Polish Radio). The Kremlin answered by accusing Poland of Russophobia, as it has with earlier sabotage charges, and the case has not come to trial.

How to read coverage of Polish intelligence

Polish intelligence is unusually well documented, because Poland names suspects, files charges, and announces its attributions publicly. Even so, three cautions apply. First, Polish politics is sharply polarized, and coverage of the services, from Pegasus to the CBA to the WSI report, is part of that fight; check which camp an outlet or a source is aligned with before weighing its account. Second, many sabotage attributions come from prosecutors and ministers at the charging stage, often against suspects who are abroad and will never be tried, so they are official allegations rather than court findings. Third, the other side of these stories is usually told by Russian and Belarusian state media, which are instruments of those governments.

The discipline is the one taught in our guides to trend analysis and cognitive bias: climb toward primary records. For Poland, that means the statutes on the special services, National Prosecutor’s Office statements, court rulings, Sejm committee records, and the Institute of National Remembrance’s archives on the communist-era services. In the United States, the Justice Department’s database of registered foreign agents (FARA eFile) shows who lobbies Washington for Poland and its rivals. A single leak timed to a Polish election should be treated as a lead, not a finding.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Qatari Intelligence: History, Structure, and the Headlines
• Czech Intelligence: History, Structure, and the Headlines
• Cognitive Bias: A Field Guide for Leaders

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and Poland and NATO’s eastern flank; details are on the services page.