NASK report on foreign interference in the presidential election finally released

• The Ministry of Digital Affairs has published a report summarizing the presidential campaign online. It describes the disinformation campaigns and influence operations that Poland was subjected to, including those linked to Russia and Belarus.
• The report highlights the need for legal changes – current regulations only allow for a response to incidents, not effective prevention. According to the authors, Poland should create a new system to combat disinformation and develop digital education for its citizens.
• The report also included information that the prosecutor's office had launched an investigation into the campaign supporting Rafał Trzaskowski in the elections.

Three months – that's how long the Ministry of Digital Affairs and its subordinate national research institute, NASK, have been waiting for a report summarizing the operation of the so-called "Electoral Umbrella." These are activities related to election protection in cyberspace. It was supposed to be ready in June, right after the presidential campaign. The ministry finally posted it on its website on Wednesday . Although the Ministry of Digital Affairs usually organizes press briefings when it has something important to share (as was the case last week, when Krzysztof Gawkowski warned against disinformation surrounding the violation of Polish airspace), this time the report was not accompanied by any media commentary.

The 55-page document summarizes the activities of NASK-PIB, the Central Informatics Centre (COI), the Internal Security Agency, the Military Counterintelligence Service and the Ministry of Foreign Affairs around the presidential elections.

Mysterious organizations behind the presidential campaign

The report describes a range of actions taken by state agencies ahead of the presidential elections. It also addresses the most controversial topic: ads published on Meta's platforms targeting Sławomir Mentzen and Karol Nawrocki, while supporting Rafał Trzaskowski.

As a reminder, in April and May, Meta-owned websites published political ads supporting the Civic Coalition candidate. The campaign accounts spent more money on promotion in seven days than any electoral committee. We know this because, under EU regulations, social media platforms are required to publicly disclose data about ads and advertisers.

On May 14th, NASK published a statement warning of potential foreign interference in the election. However, it did not specify the accounts in question. The statement specified which politicians were affected, but the note was accompanied by the comment: "Analysis indicates a possible provocation. Its purpose could have been to harm the candidate allegedly supported by such ads and to destabilize the situation before the presidential election." This led to considerable controversy.

A day later, the Wirtualna Polska website published a comprehensive analysis showing that the ads supporting Rafał Trzaskowski were prepared with the assistance of the Vienna-based company Estratos Digital GmbH. Members of the Polish organization Akcja Demokracja (Democracy Action) were to recruit and perform. Its president, until March 2025, served as a social assistant to Civic Coalition MP Iwona Karolewska .

In the CIS, we revealed that this likely wasn't the only campaign Estratos was behind . The Hungarian company was also involved in a campaign run by the Impulse for the Young Foundation, in which influencers were paid to publish political posts supporting a progressive agenda.

The fact-checking organization Demagog went a step further, linking the Polish campaign to similar efforts in Spain. Analysts discovered Estratos's connections to the American organization Action for Democracy (A4D), a foundation that financially supports progressive non-governmental organizations. The Oko.press website also reported on A4D's involvement.

Foreign interference in the elections is still not ruled out.

The exact method of financing the 135 identified ads was unclear, however. Meta claimed they were paid for from Poland (which is not illegal). In a report published Wednesday, NASK maintains that digital verification methods are not perfect and foreign interference remains a possibility .

"Domain analyses conducted by OAD NASK revealed links between the operation and citizens and businesses from third countries. It should be noted that completing such digital verification is within the capabilities of external disinformation actors, and therefore was not considered sufficient evidence to disprove the obvious foreign connections," the report reads.

The pages "Stół dorosłych" and "Wiesz jak nie jest" are no longer available on Facebook. The Meta ad library only shows that the former spent PLN 165,958 on political and social advertising, while the latter spent PLN 321,484.

As NASK declares, the Disinformation Analysis Center operating there "established common foreign connections (with regard to certain entities and persons)" between political ads supporting Trzaskowski and the influencer campaign.

The cases were reported by NASK to the Internal Security Agency. "The prosecutor's office has initiated an investigation into the above matter," the report reads.

Update : In response to questions from WNP, Katarzyna Calów-Jaszewska, spokeswoman for the National Prosecutor's Office, confirmed the information provided by NASK. The investigation is being overseen by the Małopolska Branch of the National Prosecutor's Office. It concerns "the use of funds derived from the commission of a prohibited act, which were used in the production and distribution of advertising spots via Facebook related to the election campaign for the President of the Republic of Poland conducted in Poland."

The investigation was initiated on 9 June 2025. Before issuing the decision to initiate the investigation, the prosecutor's office conducted verification activities aimed at supplementing the materials provided to the Prosecutor's Office by the Internal Security Agency.

"As part of the ongoing investigation, we are also using materials and information obtained by NASK," admits a PK spokeswoman. "Due to the ongoing investigation, it is not possible to provide more detailed information about the case."

Earlier, Law and Justice MPs also submitted a notification to the prosecutor's office in this case.

Report published, unknowns remain

Although the MC and NASK report provides ample detail to accurately identify the campaign, the text describes it as one of many examples of election irregularities and anonymizes it—no names of the candidates involved are provided. It is dubbed "Operation G" (it was the sixth case study described in this section—it is designated alphabetically).

Aside from the information about the report to the prosecutor's office, NASK is not publishing any additional facts related to what journalists have managed to determine. However, there is no longer any suggestion that this may have been a provocation.

There are still many unknowns in this case. Among them:

• Was Rafał Trzaskowski's campaign aware of the candidate's support? Did he approve of these actions? In short, could they be considered illegal campaign financing?
• Where did the funds that funded the hate campaigns really come from?
• Why did NASK publish a statement about possible foreign interference in the elections only after receiving questions from WP journalists, since the campaign had been ongoing since April?

The Election Control Movement has also come under the scrutiny of NASK.

While the Facebook campaign generated the most controversy, it's also worth mentioning other examples of threats mentioned in the MC and NASK report. The publication also describes a campaign led by the organization CitizenGO (the name is anonymized, but the dates and key facts of "Operation H" overlap). It discredited Rafał Trzaskowski and supported Karol Nawrocki. NASK emphasizes, however, that contrary to media reports at the time, the campaign was based not on paid advertising, but on the organic reach of accounts.

The election security report also included information about the Election Control Movement Association's app. It criticized the failure of precinct commission members to issue ballots based on the app's instructions.

“Given that the problem potentially affected all people voting based on the certificate, incidents of this kind should be treated as a serious and flagrant violation of electoral law, which could lead to the unjustified deprivation of citizens of the right to vote,” the report reads.

Russian and Belarusian Fingers in the Polish Electoral Process

NASK also recalled other problems related to the elections, this time directly pointing to the foreign origin of the attacks.

Once again, text messages designed to ridicule the electoral committee were used during the campaign. In 2023, such messages targeted the Law and Justice party (PiS). Two years later, they targeted the Civic Coalition candidate. The pattern was very similar, with both campaigns citing increased funeral benefits. The 2023 campaign was linked to the activities of the UNC1151 group, engaged in disinformation and espionage operations targeting Poland. Google-affiliated company Mandiant has repeatedly indicated in its publications that this group is likely linked to the Belarusian government.

The pro-Russian hacktivist group NoName057(16) launched DDoS attacks against Polish entities. Among the 19 Polish websites attacked were those of political parties or electoral committees: Polish People's Party, Non-Partisan Local Government Officials, Left, Civic Platform, Third Road, and Kukiz 15.

NASK reports, among other things, that during the election campaign, over 15,000 accounts spreading false information, including about the risk of terrorist attacks in Poland during the elections on May 18, 2025, were neutralized. An operation conducted using nine internet domains that published false information about the beliefs of one of the candidates regarding Ukrainians was also thwarted.

Write to the author: [email protected]