This happened November 2021, while the software was used to attack public prosecutor and advocate in 2019. That means that they never reviewed the targets, and only reacted after the NGOs published a list of illegal attacks.

(Eavesdropping advocate is illegal under Polish law.)