July 8, 2025, promised to be a rainy Tuesday, but at 6AM in the morning the sky was still clear when three officers from the Hungarian National Bureau of Investigation\u2019s (NNI) cybercrime division rang the doorbell of a family home in a small town near Budapest. A man looked out the door. The police were looking for his 19-year-old son. They had come to search the house for pornographic images depicting children. They took several phones, computers, and various storage devices from the young man\u2019s room.<\/p>\n
At the same time, as part of the same investigation, a search was also conducted on a boat moored at a Budapest waterfront. The target was an office maintained on the boat by a 38-year-old man, who spent most of his days among the servers and computers kept in the room. A total of 38 data storage devices were seized from him, including several high-capacity external hard drives, numerous phones, servers, USB drives, tablets, laptops, and desktop computers. A peculiar device was also found among the man\u2019s clothes: a leather belt with a tiny camera hidden in one of its holes.<\/p>\n
The police officers specializing in child pornography arrived at the two addresses following an anonymous tip. The tip stated that the two men intended to use a \u201chidden camera\u201d to record pornographic footage of children and distribute it to deviant adults.<\/p>\n
However, the officers soon realized they had stumbled upon a completely different story. During the house searches, both men stated that they were connected to the Tisza Party, the opposition force leading in polls in the run-up to the April 12 elections, threatening the rule of Hungary\u2019s long-term leader, Viktor Orb\u00e1n. The 19-year-old man had previously helped Tisza as a volunteer IT specialist, while the older man working on the boat was responsible for protecting the Tisza Party\u2019s internal systems and had access to the party\u2019s core IT systems.<\/p>\n
There were other strange signs. Several intelligence agencies had been involved in the case from the very beginning. The Office for the Protection of the Constitution (AH) played a particularly important role, acting as the initiator of the entire proceedings. Even before the report on child pornography had reached the relevant department of the NNI, they had already called police leaders to insist that the case be addressed without fail.<\/p>\n
It was also the AH that insisted that an expert from the National Security Service (NBSZ), which provides technical support for intelligence operations, participated in one of the searches, the one conducted on the boat on July 8. Both intelligence agencies are under close government supervision, and their work is directed by the Prime Minister\u2019s Office, led by Antal Rog\u00e1n, one of Viktor Orb\u00e1n\u2019s closest confidants.<\/p>\n
The AH\u2019s such intense presence was unusual for the NNI officers dealing with child pornography. The primary mission of this agency is to prevent crimes against the state and, for example, to counter foreign intelligence agents operating in Hungary. They do not typically deal with child pornography crimes.<\/p>\n
NNI officers encountered further surprises. They found no information suggesting child pornography on the devices seized from the two men, but they did stumble upon details of an operation that appeared to be a political conspiracy. They found documents showing the attempts to hack into the Tisza Party\u2019s IT system and potentially bringing it down.<\/p>\n
This emerged from the messages exchanged between the 19-year-old man and an unknown individual using the name Henry. Henry attempted to recruit the man for a covert operation against the Tisza Party. He demanded that the man report on the party\u2019s internal affairs and gain access to the party\u2019s IT systems. In exchange, he promised a generous reward. The stranger even wanted to meet the young man at a secret base and recruit him into his \u201cteam.\u201d<\/p>\n
It is impossible to identify who Henry was or which organization was behind him, but his messages suggest that he possessed extensive information about the Tisza Party\u2019s internal affairs and had access to certain internal systems. Henry even predicted certain events in advance. One day before the\u00a0activist database stolen from the Tisza Party\u2019s Discord server was leaked, he had told the young man that it would happen.<\/p>\n
The young IT specialist pretended to cooperate with Henry but in reality he was trying to learn as much as possible about the stranger\u2019s intentions. He showed the messages he received from Henry to the man working on the boat who was responsible for protecting the Tisza\u2019s IT systems, who in turn informed the Tisza\u2019s leadership. The two men were preparing to expose Henry and his team using a camera hidden in a belt, but the police raid last July thwarted their plans.<\/p>\n
Direkt36 learned of this story through obtaining numerous documents related to the investigation\u2014including text messages found on the seized devices and receiving information from a source familiar with the investigation. Several sources familiar with the internal affairs of the Tisza Party confirmed that the two men under investigation did indeed work for the party. They also confirmed that the police investigation and the recruitment operation proceeded in accordance with the documents we obtained.<\/p>\n
According to sources familiar with the party, there is concern within Tisza that their IT systems could be targeted by cyber-attacks ahead of the elections. At the same time, they are actively preparing to counter these attacks and believe that they have so far successfully defended their internal systems, as they have managed to thwart numerous malicious attempts.<\/p>\n
An investigation into the two men is underway at the NNI\u2019s cybercrime division. However, according to the source familiar with the case, they are not investigating who Henry is or what organization is behind him. Instead, in accordance with the wishes of the AH, which has been continuously intervening in the investigation, NNI leadership instructed the police to focus on the camera belt. The two men were charged with misuse of military equipment because of the belt.<\/p>\n
No traces of child pornography were found on the devices that were seized. According to the information available so far, the anonymous tip, which set the whole case in motion, was therefore unfounded.<\/p>\n
We sent the Tisza Party a detailed list of questions regarding the story, but they stated that \u201cwe do not wish to comment on specific questions or allegations.\u201d They added that after the election, an \u201cindependent investigative authority\u201d should \u201cuncover\u201d what happened and act against those responsible. \u201cUntil then, we call on the staff of these agencies not to violate the oath they swore to their country,\u201d the party wrote.<\/p>\n
The relevant authorities (the NNI, the AH, and the NBSZ) and the competent government ministries (the Prime Minister\u2019s Office and the Ministry of the Interior) did not respond to our detailed questions sent on Monday morning.<\/p>\n
The whole affair began on July 1, 2025, with an anonymous tip received by the National Media and Infocommunications Authority (NMHH) so-called internet hotline. This was established so that anyone who comes across content about online sexual exploitation of children can report it to the authorities through this channel. The NMHH automatically forwards the reports to the Cybercrime Department of the National Bureau of Investigation (NNI).<\/p>\n
This is exactly what happened in this case. Direkt36 obtained a copy of the text sent to the police, which stated that the anonymous tipster had learned \u201cthrough an online gaming platform\u201d that a 19-year-old man living in a small town near Budapest, who goes by the name Gundalf \u201cin online circles,\u201d was planning, together with the man working on the boat, \u201cto purchase or assemble a surveillance device hidden in a piece of clothing.\u201d<\/p>\n
\u201cThey would use the hidden camera to record children, which they could later pass on to perverted adults,\u201d the report stated. The anonymous tipster specifically named the individuals involved, knew where to find them, and also indicated that the ship contained \u201ccomputers and servers used to upload pornographic videos to the internet.\u201d<\/p>\n
Investigators from the Cybercrime Division found the report\u2019s formal tone strange, as well as the fact that the informant had shared so many specific details. They raised their eyebrows even higher when they learned that the NNI\u2019s management had meanwhile received a call from one of the intelligence agencies, the Office for the Protection of the Constitution (Alkotm\u00e1nyv\u00e9delmi Hivatal, AH), stating that a report was coming in via the NMHH hotline, which must be taken seriously, and that an investigation and a search warrant must be ordered as soon as possible.<\/p>\n
Following such reports, police officers do not usually rush to the scene (unless, of course, children are in clear danger) but instead conduct thorough preliminary investigations to verify the information received and establish the legal grounds for the search.<\/p>\n
This time, however, everything happened much faster. On July 8, the seventh day after the report was filed, police officers were already conducting the two house searches. We reconstructed the events based on search and seizure reports obtained by Direkt36.<\/p>\n
NNI forensic experts always back up data from seized storage devices. This time, however, the backup was performed by staff from the National Security Service (NBSZ), one of the civilian intelligence agencies, the same people who were on the ship. According to a source familiar with the case, the AH insisted on this as well.<\/p>\n
Since there were a huge number of seized devices, and since most of them contained encrypted files, the data backup took more than a month, so the police were only able to begin examining the files in mid-August. Although they were unable to open a significant portion of them due to missing passwords, and they were not able to crack all of them, they still had plenty of material to work with.<\/p>\n
Their first task was to scan through the media files to see if any contained images of children. They found no trace of anything like that. \u201cDuring the analysis of the seized and accessible devices, our agency found neither recordings related to an interest in minors nor child pornography,\u201d \u2013 stated one of the reports compiled during the investigation.<\/p>\n
They then began to take a closer look at what was in their possession. Hundreds of strange screenshots were found on the 19-year-old man\u2019s desktop computer. The man had saved his conversations from an encrypted messaging app called Session. In these, he used the name Gundalf, so we will refer to him as such in this article as well (we contacted the young man with detailed questions, but he stated that he does not wish to comment at this time).<\/p>\n
He sent some of the screenshots to his friend, the man working on the ship, as the police also found them on the latter\u2019s phone. (Hereinafter, we will refer to him as Buddha, based on the name he uses online. We also contacted him with detailed questions, but he replied that he did not wish to respond to our inquiries.)<\/p>\n
These were the messages that revealed an operation was underway against the Tisza Party. The messages show, hour by hour and day by day, how an unknown individual attempted to recruit Gundalf into his team, with the goal of obtaining internal information about the Tisza Party, disrupting its operations, and ultimately bringing down the party\u2019s IT systems.<\/p>\n
Gundalf received the first message on February 9, 2025 from the stranger, who referred to himself by the initials V.E. and used the name Henry elsewhere.<\/p>\n
\u201cHow are things going? The birds have been chirping that you\u2019re organizing some serious meetings [\u2026] Doesn\u2019t that seem like a bit too much? Especially with a team like this, where talent is just overflowing!\u201d the stranger wrote to him. Gundalf was puzzled. The other person hinted that he knew Gundalf had connections to an international hacktivist group. He ordered him to stop supporting the Tisza Party, \u201cin exchange, neither you nor your friends will have any trouble.\u201d<\/p>\n
The next day, he contacted him again. \u201cTick-tock, buddy. Have you decided yet?\u201d \u201cStop supporting your political community. In any form. We\u2019ll find out if you don\u2019t. Walls have ears\u2026\u201d<\/p>\n
At this point, the young man turned to Buddha, an IT specialist older than him who also worked for Tisza. He sent screenshots of the messages he\u2019d received from the stranger, adding, \u201cI\u2019m not really sure what I should do here :D.\u201d<\/p>\n
In the days that followed, more messages arrived in a style similar to Gundalf\u2019s\u2014slightly threatening and commanding. The stranger made it clear that he had insight into the inner circles of the Tisza Party, which he claimed was full of corrupt figures: \u201cListen, when this house of cards collapses, you don\u2019t want to be buried under the rubble.\u201d<\/p>\n
Gundalf replied that if he was so well-informed, he surely also knew that he no longer worked for Tisza. The young man had left the party in early 2025 due to some internal conflict, but he hadn\u2019t completely severed ties with his former colleagues. He remained on friendly terms with Buddha, for example, which is why he knew what was happening within the party.<\/p>\n
Henry changed tactics in the last days of February. After sending clear signals that he had inside information on both Gundalf and Tisza, he began persuading the young man to return to the party. However, he also made it clear that he expected Gundalf to work for him and his team as an undercover operative in the field of IT security.<\/p>\n
\u201cP\u00e9ter would surely be happy to have a reliable security expert,\u201d he wrote, presumably referring to P\u00e9ter Magyar. \u201cYou can be sure that if you go for it, we\u2019ll support you all the way. You won\u2019t find a better partner than us anywhere in the country. We see and hear everything,\u201d Henry wrote, but he didn\u2019t specify exactly who he was or what organization was behind him.<\/p>\n
He did, however, imply that within the party, he was aware of everyone\u2019s movements and knew the relationships between colleagues. On one occasion, he hinted that he reads internal correspondence and even claimed to know that Buddha was currently ill because \u201che really looked pretty bad on Monday.\u201d When Gundalf asked Henry how he knew so much, the reply was: \u201cOh, well, I know a lot of things.\u201d<\/p>\n
While Gundalf pretended to be on board with the plan and tried to carry out the instructions, he continued to send screenshots of his conversations with Henry to Buddha.<\/p>\n
A few weeks after making contact, in late February of last year, Henry decided to bring Gundalf more fully into his operations. He put him in touch with another person working for him. This person went by the name Mos4ik, and in his case, too, it is unclear who he actually is.<\/p>\n
Mos4ik explained that he, too, had previously been a volunteer with the Tisza Party and had joined Henry around September 2024. He also mentioned that he received money from Henry for the work he did.<\/p>\n
Mos4ik and Henry also identified the ultimate goal of their operations: to take control of the Tisza Party\u2019s IT infrastructure so they could paralyze these systems before the parliamentary elections. Henry put it this way:<\/p>\n
\u201cWe need to get an IT person in, then gently push them up to a leadership position. Once we have that, we\u2019ve practically won. [\u2026] At the right moment, all the puppets pull the trigger, and the whole thing collapses. [\u2026] Our puppet must maintain complete control over all IT systems, and it should be damn hard to remove him from them. Even if they manage to kick him out, there should always be a backdoor in place.\u201d<\/p>\n
By \u201cbackdoor,\u201d he meant a secret back entrance through which they could freely access the party\u2019s system without others noticing.<\/p>\n
Mos4ik, meanwhile, hinted that numerous \u201cpuppets\u201d had already been infiltrated into Tisza. He specifically mentioned Buddha as the one who, as the \u201clast line of defense,\u201d was resisting the infiltration attempts.<\/p>\n
The files we obtained do not reveal whether they ultimately succeeded in infiltrating the \u201cpuppet.\u201d Regardless, Henry likely already had some\u2014limited\u2014access to Tisza\u2019s internal systems, as he once boasted to Gundalf that he could view data stored in the party\u2019s Strapi system. (Strapi is a software used for content management on websites and mobile applications.) He illustrated this with a screenshot, in which Gundalf recognized Strapi.<\/p>\n
It also turned out that one of the primary goals of Henry and his associates was to hack the Tisza Vil\u00e1g (meaning \u201cTisza\u2019s World\u201d) app, which had been developed for Tisza supporters under the direction of M\u00e1rk Radnai, the party\u2019s vice president. The goal was to create a user-friendly community organizing platform.<\/p>\n
Months later, in October 2025, a list containing the personal data of nearly 20,000 people was leaked online, and in November, the data of 200,000 users of the Tisza Vil\u00e1g app was leaked. At that time, Tisza\u2019s candidate selection process was underway. Pro-government newspapers were the first to report on the data theft or leak, and the NNI launched an investigation, but so far no results were made public.<\/p>\n
There is no information in the data we obtained to suggest that the Tisza Vil\u00e1g app was actually hacked by Henry and his associates. However, the party experienced another embarrassing IT glitch, which they likely had a hand in.<\/p>\n
A few months earlier, in June, confidential data was leaked from Tisza\u2019s Discord server. The server contained a list of members of a group called Visszhang. It can be assumed that Henry and his associates were involved in this because he had already predicted the leak to Gundalf.<\/p>\n
On June 13, Henry wrote to Gundalf: \u201cWe\u2019re going to publish the database of Visszhang members. [\u2026] It\u2019s time for the names to make music, not just the sound.\u201d Gundalf asked what the point of such a leak was. \u201cJust for the hell of it?\u201d The next day, on the afternoon of June 14, Henry replied that, essentially, yes, and then added, attaching a link:<\/p>\n
\u201cIt\u2019s out there, by the way. We\u2019ve whispered it in a few corners, dropped hints in a few nooks. We haven\u2019t managed to post it on Telegram or Reddit yet, but we\u2019re working on it; it\u2019ll be buzzing there soon, too. [\u2026] Over the next few days, the scoop will just be trickling out everywhere, so buckle up, Gundalf!\u201d<\/p>\n
The data did indeed leak at that time. According to an article by \u00c1tl\u00e1tsz\u00f3 at the time, this caused serious turmoil among the members of Tisza supporters\u2019 groups called Tisza Islands. The party was forced to completely shut down its Discord server, which had previously served as an important internal organizational platform. P\u00e9ter Magyar and the party wrote about the incident on Facebook, claiming that someone had used Russian methods to collect data on their volunteers. According to them, a community had formed on this forum, but \u201cunfortunately, this community space has now become a target: it is being abused, distorted, and used for attacks.\u201d<\/p>\n
A week later, P\u00e9ter Magyar told Telex about the incident: \u201cWe were hit by a large number of attacks, which our IT and security specialists and experts successfully repelled. This is not a simple oversight, but a much more serious matter.\u201d He added that they had also found military spyware on their computers but did not provide further details.<\/p>\n
Henry considered the operation they had carried out\u2014according to him\u2014a success. \u201cWe can check off an extremely successful operation. It\u2019s not completely wrapped up yet; we still have some follow-up work and a several-week assessment phase ahead of us, but the lion\u2019s share is already behind us. And based on what we see: it was a spectacular job, Gundalf. The already shaky Tisza Island network has now been completely destabilized, and their internal trust structures have crumbled. There is a significant loss of trust in the party, and we will measure this precisely in the coming weeks using our narrative-detection and shaping network,\u201d he wrote on June 19.<\/p>\n
In addition to the IT systems, Henry was also interested in the movements of the two IT specialists. The screenshots and messages found on Buddha\u2019s devices suggest that someone may have been physically following some of Tisza\u2019s employees and officials. On one occasion, Henry felt it was important to let Gundalf know who he had met. \u201cHi Gundalf! I saw you finally met Buddha. Buja Diszn\u00f3k [Lustful Pigs]? Not a bad choice!\u201d (Buja Diszn\u00f3k is a Hungarian-style restaurant; there are several locations in Budapest.)<\/p>\n
Gundalf forwarded this exchange to Buddha, who mentioned the incident to M\u00e1rk Radnai, the vice president of Tisza. This is indicated by a screenshot showing Buddha chatting with a person named M\u00e1rk Radnai, as they attempt to resolve some disagreement between them.<\/p>\n
Buddha then mentioned the alleged surveillance to Radnai: \u201cOh, and by the way, I met Gundalf in person downtown yesterday; he brought me technical data related to the case. He essentially received a message right away that he had met with me. So now we\u2019re at the point where they\u2019re watching and tracking us 24\/7 (don\u2019t think they\u2019re not watching you).\u201d<\/p>\n
It\u2019s not clear from the screenshot how Radnai reacted to this, nor is it clear exactly who Buddha believed was observing them.<\/p>\n
On several occasions, Henry spoke as if a larger organization were backing him. At times, he waited for management decisions or for some analysis from their \u201cstrategic department.\u201d At other times, he awaited reports from his team members and wrote about \u201coperational security,\u201d \u201clive operations,\u201d and puppets.<\/p>\n
At the end of April, he recounted that \u201cit\u2019s been almost a year since it became clear that this little party would pose a much bigger problem than anyone could have anticipated,\u201d and the \u201cmanagement\u201d decided that multiple teams needed to work parallel against Tisza, and several units did manage to infiltrate the party. According to Henry, however, his is the best team, working with the most modern tools and the most talented people.<\/p>\n
Based on the messages, Tisza\u2019s management was\u2014at least partially\u2014aware of the operation against the party. Henry mentioned to Gundalf on several occasions that he feared \u201cBuddha had become suspicious,\u201d and he also spoke to G\u00e1bor P\u00f3sfai, the party\u2019s director of operations, about this. \u201cHe was beginning to sense that certain groups were working in an organized manner here,\u201d Henry said.<\/p>\n
Gundalf told Henry that he thought Buddha had suspected something for a while, since he once told him, \u201cThe guys from the Interior Ministry are coming and going in here like a horse\u2019s dick in Cicciolina\u2019s ass\u2026\u201d On another occasion, they discussed how an IT specialist had been kicked out of Tisza because it had become obvious that he was a mole and had tried to install backdoors in several systems. Henry\u2019s responses suggested that the fired IT specialist\u2014whom he referred to as a \u201cnetwork element\u201d\u2014was their man.<\/p>\n
Other details of the conversations also suggest that multiple teams were working in an organized manner against Tisza. Mos4ik claimed that earlier, around September 2024, he had worked as a member of another team alongside Henry. When Gundalf asked who was on the \u201cother team\u201d and whether they were also Tisza members, he replied: \u201cYeah, former members. Evelin\u2019s team\u2014I guess you know them. A bunch of idiots.\u201d<\/p>\n
Mos4ik was presumably referring to Evelin Vogel, who, as P\u00e9ter Magyar\u2019s girlfriend, had previously been involved in the activities of the Tisza Party. After their breakup, in the fall of 2024, several audio recordings of their private conversations were posted online. Among these were some that were embarrassing for P\u00e9ter Magyar and forced him to explain himself. Mos4ik told Gundalf about this period, saying, \u201cWell, you know about those audio recordings. That\u2019s pretty much the only part of this whole project that can actually be called a success.\u201d<\/p>\n
Evelin Vogel stated in response to our inquiry: \u201cI have not participated in any secret or non-secret Russian or domestic operations, smear campaigns, or secret social activities, nor do I plan to.\u201d<\/p>\n
Henry also tried to arrange a face-to-face meeting with Gundalf, and in the process, he again hinted that he was a member of some larger organization.<\/p>\n
\u201cThe meeting would take place at one of our facilities,\u201d he wrote to Gundalf, adding that \u201cit is a secure, controlled base where we can discuss matters undisturbed,\u201d and that Gundalf could also meet the other team members.<\/p>\n
The young man was hesitant and tried to find out more about the location. Henry revealed only that the \u201cfacility\u201d was in Budapest, and that a car would pick him up at an agreed-upon location and take him there. He promised that after the meeting, Gundalf would likely receive women\u2014two, three, or even four girls\u2014who worked as prostitutes as payment.<\/p>\n
Henry added that Gundalf didn\u2019t need to worry because they wouldn\u2019t be conducting an X-ray scan upon entry. At the same time, \u201caccording to the rules, entry to the facility is permitted only after a scan. This ensures that no one tries to bring in anything that would be detrimental to us.\u201d<\/p>\n
At this point, Gundalf asked, \u201cThat sounds like I\u2019d have to join some kind of secret service. Are you some kind of official agency?\u201d To this, Henry replied, \u201cWe operate as a special operations unit. [\u2026] We work with top-notch equipment and personnel. Among the best in the country, perhaps even in all of Europe.\u201d Gundalf wasn\u2019t convinced by any of this and said he didn\u2019t like the offer. Henry agreed to revisit the matter later.<\/p>\n
In June, he brought up the topic again, saying that the next meeting was scheduled for early July, but by then \u201cthe management\u201d wanted not only to meet but provide training for Gundalf.<\/p>\n
By this time, however, Buddha and Gundalf were already planning something. Their plan was presumably to expose Henry. This is suggested by audio recordings captured by a camera hidden in a belt found on Buddha\u2019s boat. The belt came into the possession of Direkt36; according to an expert report written by an expert from the National Security Service (NBSZ) during the investigation, it was homemade and suitable for secretly recording video and audio.<\/p>\n
According to data obtained by Direkt36, the device was ready by the end of June, as several recordings were made with it. Police seized a tablet from Buddha, from which a series of video and audio recordings were successfully recovered from the deleted files. It was determined that these were made using a camera hidden in the belt. Although the belt was found with Buddha, most of the recordings were made in Gundalf\u2019s room, according to one police report summarizing the investigation.<\/p>\n
In one of the videos, the young man is testing the device and telling someone that it is a prototype, and what he \u201cglued\u201d or \u201cscrewed\u201d together to make it. In addition, the belt recorded a 77-minute video on July 1st, in which Gundalf can be heard talking at length with someone on the phone. Only fragments of the conversation can be made out, but it is clearly audible when Gundalf says: \u201cto expose Henry, so to speak,\u201d and that at their meeting \u201cto somehow record him, and then he mentioned this training, which, you know, takes place over several sessions, and then to ensure there\u2019s an opportunity\u2026\u201d<\/p>\n
The plot came to an end when police officers showed up at Gundalf\u2019s and Buddha\u2019s places last July and seized all their IT and technical equipment, including the belt. From that point on, the authorities became a key player in the story.<\/p>\n
From the beginning, it was clear for police investigators that the entire case was sensitive, as it targeted individuals linked to political figures\u2014Gundalf and Buddha. According to information obtained by Direkt36, the reports generated in this case were therefore not entered into the \u201cRobotzsaru\u201d system used by official agencies for a long time; instead, they were written as simple Word documents and distributed in printed form to a small circle of police leaders. Several of these reports reached Direkt36 along with other case documents, such as search warrants and expert opinions.<\/p>\n
The case remained a priority for the intelligence service; according to a source with insight into the matter, the Constitution Protection Office (Alkotm\u00e1nyv\u00e9delmi Hivatal, AH) consistently inquired about the case and sought to steer the direction of the investigation. The immediate supervisors of the cybercrime unit\u2019s investigators regularly received calls from AH personnel, who made requests regarding the direction of the investigation.<\/p>\n
A source familiar with the case told Direkt36 that developments in the matter were a hot topic at executive meetings in both November and December 2025, as files in their possession showed that an unknown individual had approached Tisza\u2019s IT staff with the aim of harming the party. Based on the content and tone of the messages, as well as the extent to which the AH was involved in the matter, investigators familiar with the case were convinced that they were looking at the details of a secret service operation. They believed that no one else in Hungary was capable of carrying out operations of the depth suggested by the information gathered\u2014such as hacking into IT systems or surveilling individuals.<\/p>\n
Although they had no direct evidence of this, they believed it was necessary to investigate who Henry was, as his activities raised suspicions of several possible crimes. According to the criminal law expert we interviewed, for example, unauthorized data acquisition, violation of an information system or data, misuse of personal data, or even coercion could be involved. However, according to a source familiar with the investigation, under pressure from AH, they were unable to pursue this line of inquiry. While AH consistently denied to the NNI that they had any connection to Henry\u2019s operations, they persuaded police leadership not to pursue the investigation in this direction.<\/p>\n
A source familiar with the case understands that NNI investigators were frustrated that, instead of focusing on their core mission\u2014protecting children\u2014they had to waste their resources on a politically sensitive case. Moreover, they were unable to freely determine the direction of the investigation. They decided to look into every detail, albeit unofficially; they precisely documented the story emerging from the screenshots and wrote detailed reports about it. According to a source familiar with the case, a report written at that time\u2014in Word format, and thus unofficial\u2014also reached the Ministry of the Interior led by S\u00e1ndor Pint\u00e9r, where the details revealed about Henry\u2019s activities came as a surprise.<\/p>\n
This is because the police are overseen by the Ministry of the Interior, which is headed by Pint\u00e9r, who previously worked as a police officer himself. In theory, therefore, the police operate independently of the secret services, and the AH has no right to issue orders to the police. In practice, however, it happens that the organization with greater informal influence\u2014in this case, the AH operating under Viktor Orb\u00e1n\u2019s cabinet office\u2014can force its will upon the other.<\/p>\n
In this specific case, the senior leadership of the NNI apparently made efforts to comply with requests coming from the AH. These requests were primarily made by phone to the relevant department head and others. In December, under pressure from the AH, another search was ordered of Gundalf and Buddha\u2019s apartments. In addition, both were questioned as suspects of \u201cillegal trade of military technology products\u201d.<\/p>\n
An expert report prepared by an expert from the National Security Service classified the camera hidden in the belt as a military technology device. Under the law, the manufacture and distribution of military technology products constitute a criminal offense. A debate arose within the police regarding whether assembling a single unit from a camera belt at home constitutes \u201cmanufacturing,\u201d but Direkt36 has learned from a source familiar with the case that the AH insisted this be the basis for charging Buddha and Gundalf.<\/p>\n
Based on this suspicion, a separate investigation was ultimately ordered, which is being conducted by a separate unit of the NNI\u2019s Cybercrime Department. (This is a separate unit from the investigative unit handling the child pornography case.) The investigation initiated on suspicion of child pornography, however\u2014since there is no evidence to support it\u2014remains unconcluded.<\/p>\n
It has happened before during the terms of the Orb\u00e1n governments that Hungarian intelligence agencies have become involved in politically sensitive matters.<\/p>\n
In 2021, as part of an international investigative project, Direkt36 revealed that a spyware called Pegasus had been deployed against Hungarian journalists, businesspeople critical of the government, and opposition politicians. It later became clear that the software had been purchased by the Hungarian state and was also used by the intelligence services.<\/p>\n
At that time, most civilian intelligence agencies\u2014including the AH and the NBSZ\u2014still fell under the authority of Interior Minister S\u00e1ndor Pint\u00e9r, but since then they have come under even tighter political oversight. After the 2022 election, control of the intelligence services was transferred to the Prime Minister\u2019s Office, led by Antal Rog\u00e1n, thereby bringing this area closer to Viktor Orb\u00e1n.<\/p>\n
It became clear during the investigation into the Pegasus affair that the rules governing surveillance for national security purposes are far too lax in Hungary. The intelligence services can carry out such operations with little oversight; all they need is authorization from the Minister of Justice. As the civil liberties organization Hungarian Civil Liberties Union (T\u00e1rsas\u00e1g a Szabads\u00e1gjogok\u00e9rt, TASZ) points out on its website, the European Court of Human Rights has repeatedly ruled that the Hungarian national security law \u201csuffers from such fundamental shortcomings that the regulation of surveillance in Hungary is, in its entirety, unlawful.\u201d<\/p>\n
However, even under the current regulations, the AH or any other intelligence agency has no right to conduct house searches on its own authority. Such actions must take place within the framework of a so-called open police investigation. According to M\u00e1t\u00e9 Szab\u00f3, TASZ\u2019s professional director, it is not unprecedented for the AH to collaborate with certain police agencies on individual cases, but it is very strange that the intelligence agency has been present from the very beginning of an investigation launched due to child pornography. In theory, Szab\u00f3 says, the AH has no business being involved in such matters unless there is a very clear national security angle to the case from the beginning.<\/p>\n
The AH did not respond to our questions, including whether they were officially involved in the NNI\u2019s proceedings.<\/p>","protected":false},"excerpt":{"rendered":"
According to documents obtained by Direkt36, a secret operation was carried out to bring down the IT systems of the Hungarian opposition party Tisza. IT specialists affiliated with the party planned to expose this, but then police officers, pressured by the Hungarian secret services, raided them, apparently on trumped-up charges.<\/p>\n","protected":false},"author":24,"featured_media":12918,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"single-telex.php","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"ppma_author":[558,522],"aioseo_notices":[],"fimg_url":["https:\/\/www.direkt36.hu\/wp-content\/uploads\/2026\/03\/henry_v2_kicsi.jpg",1200,800,false],"authors":[{"term_id":558,"user_id":24,"is_guest":0,"slug":"zsuzsi","display_name":"Zsuzsanna Wirth","avatar_url":{"url":"https:\/\/www.direkt36.hu\/wp-content\/uploads\/2023\/10\/Wirth-Zsuzsanna.png","url2x":"https:\/\/www.direkt36.hu\/wp-content\/uploads\/2023\/10\/Wirth-Zsuzsanna.png"},"author_category":"","user_url":"","last_name":"Wirth","first_name":"Zsuzsanna","job_title":"","description":"[:hu]Az ELTE hallgat\u00f3jak\u00e9nt kezdett az Orig\u00f3n\u00e1l dolgozni, ahol t\u00edz \u00e9vet t\u00f6lt\u00f6tt a politika rovat \u00fajs\u00e1g\u00edr\u00f3jak\u00e9nt. Dolgozott a Forbesnak \u00e9s a Marie Claire-nek, 2016 \u00f3ta pedig a Direkt36 \u00fajs\u00e1g\u00edr\u00f3ja, 2022 \u00f3ta szerkeszt\u0151je is. 2022-ben az OCCRP \u00f6szt\u00f6nd\u00edjasak\u00e9nt tanult a t\u00e9nyfelt\u00e1r\u00f3 \u00fajs\u00e1g\u00edr\u00e1sban alkalmazhat\u00f3 OSINT \u00e9s m\u00e1s kutat\u00e1si technik\u00e1kr\u00f3l. H\u00e1romszor is elnyerte a Min\u0151s\u00e9gi \u00dajs\u00e1g\u00edr\u00e1s\u00e9rt d\u00edjat. 2023-ban Szente L\u00e1szl\u00f3-d\u00edjat kapott, a k\u00f3rh\u00e1zi fert\u0151z\u00e9sek eltitkolt helyzet\u00e9t felt\u00e1r\u00f3 cikksorozat\u00e1\u00e9rt pedig Marton Kamill\u00e1val k\u00f6z\u00f6sen elnyerte a Transparency-Soma d\u00edjat. Az ELTE m\u00e9dia szak\u00e1n \u00f3raad\u00f3k\u00e9nt \u00fajs\u00e1g\u00edr\u00e1st tan\u00edt.[:en]Zsuzsanna started her journalistic carreer at Origo, where she spent ten years at the news desk, covering and investigating various political and social issues as well as corruption and organized crime. She worked for the Hungarian editions of Forbes and Marie Claire. She has been workign at Direkt36 as a journalist since 2016, and as an editor since 2022. In 2022, she studied OSINT techniques as an OCCRP Research Fellow. She was awarded the Prize for Quality Journalism three times. In 2023, she received the L\u00e1szl\u00f3 Szente-Prize, and together with Kamilla Marton she also won the Transparency-Soma award for her series of articles exposing the hidden situation of hospital-acquired infections. She teaches journalism at ELTE\u2019s media department.[:]"},{"term_id":522,"user_id":0,"is_guest":1,"slug":"andraspetho","display_name":"Andr\u00e1s Peth\u0151","avatar_url":{"url":"https:\/\/www.direkt36.hu\/wp-content\/uploads\/2023\/10\/Petho-Andras.png","url2x":"https:\/\/www.direkt36.hu\/wp-content\/uploads\/2023\/10\/Petho-Andras.png"},"author_category":"1","user_url":"","last_name":"Peth\u0151","first_name":"Andr\u00e1s","job_title":"","description":"[:hu]Andr\u00e1s a Direkt36 egyik alap\u00edt\u00f3ja, szerkeszt\u0151je \u00e9s \u00fcgyvezet\u0151 igazgat\u00f3ja. Kor\u00e1bban az Origo vezet\u0151 szerkeszt\u0151je volt, miel\u0151tt a port\u00e1l r\u00e9sze lett a korm\u00e1ny propagandag\u00e9pezet\u00e9nek. Andr\u00e1s dolgozott a BBC World Service-n\u00e9l Londonban \u00e9s a Washington Post t\u00e9nyfelt\u00e1r\u00f3 rovat\u00e1n\u00e1l is. R\u00e9szt vett sz\u00e1mos nagy nemzetk\u00f6zi nyomoz\u00f3 projektben, k\u00f6zt\u00fck a Panama-iratok feldolgoz\u00e1s\u00e1ban. K\u00e9tszer is elnyerte a legjobbnak \u00edt\u00e9lt t\u00e9nyfelt\u00e1r\u00f3 cikkek szerz\u0151inek j\u00e1r\u00f3 Soma-d\u00edjat. T\u00f6bbsz\u00f6r tanult \u00f6szt\u00f6nd\u00edjjal az Egyes\u00fclt \u00c1llamokban: 2008-ban a World Press Institute programj\u00e1ban, 2012-13-ban Humphrey-\u00f6szt\u00f6nd\u00edjask\u00e9nt a Marylandi Egyetemen, 2019-20-ban pedig Nieman-\u00f6szt\u00f6nd\u00edjask\u00e9nt a Harvard Egyetemen. Andr\u00e1s t\u00f6bb magyar egyetemen is tan\u00edtott \u00fajs\u00e1g\u00edr\u00f3 kurzusokat.[:en]Andr\u00e1s is co-founder, editor and executive director of Direkt36. Previously, he was a senior editor for leading Hungarian news site Origo before it had been transformed into the government\u2019s propaganda outlet. He also worked for the BBC World Service in London and was a reporter at the investigative unit of The Washington Post. He has contributed to several international reporting projects, including The Panama Papers and the Pegasus Project. He plays a leading role in the production of Direkt36\u2019s documentaries, including The Dynasty, the award-winning film on the business empire of Viktor Orb\u00e1n\u2019s family. He won the Soma Prize, the prestigious annual award dedicated to investigative journalism in Hungary, three times. He was a World Press Institute fellow in 2008, a Humphrey fellow at the University of Maryland in 2012\/13, and a Nieman fellow at Harvard University in 2019\/20. Andr\u00e1s has taught journalism courses at Hungarian universities.[:]"}],"tag_names":[],"category_names":[{"name":"Direkt36","slug":"direkt36"}],"_links":{"self":[{"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/posts\/12910"}],"collection":[{"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/comments?post=12910"}],"version-history":[{"count":7,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/posts\/12910\/revisions"}],"predecessor-version":[{"id":12936,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/posts\/12910\/revisions\/12936"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/media\/12918"}],"wp:attachment":[{"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/media?parent=12910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/categories?post=12910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/tags?post=12910"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.direkt36.hu\/en\/wp-json\/wp\/v2\/ppma_author?post=12910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}