Three hours
It took Viktor Orban less than three hours.
When polls closed across Hungary on the evening of April 12, 2026, the results were not ambiguous. They were not close enough to contest, not murky enough to spin, not narrow enough to litigate. Peter Magyar's Tisza Party had won 53.6 percent of the national vote and 138 of 199 parliamentary seats -- a two-thirds supermajority, the same constitutional threshold Orban had used to reshape Hungarian democracy in his own image beginning in 2010. Orban's Fidesz party, which had governed Hungary for sixteen consecutive years, took 37.8 percent and 55 seats.
Orban conceded. "The responsibility of governing was not given to us," he said. It was the most restrained public statement of his political career -- a man who had once declared he was building "illiberal democracy" as a model for Europe, reduced to a single sentence of passive voice.
European Commission President Ursula von der Leyen was less restrained: "Europe's heart is beating stronger in Hungary tonight. Hungary has chosen Europe."
Turnout was estimated at 77 to 80 percent -- the highest since the first free elections following the collapse of Communism in 1990. This figure, more than any other, tells the story of what happened in Hungary and why it matters for the global contest between surveillance and democracy. Because those voters did not cast their ballots in a normal election. They voted under the most extensively documented surveillance apparatus ever deployed against a European democracy's own electorate.
The apparatus
In the weeks before the election, the Hungarian government completed license renewals for a surveillance platform called Webloc, developed by Israeli company Cobwebs Technologies and now sold by Penlink following a 2023 merger. Webloc is an ad-tech surveillance system -- it exploits the commercial advertising infrastructure embedded in smartphone applications to track the physical movements, behavioral patterns, and association networks of targeted individuals. According to researchers at the University of Toronto's Citizen Lab who have studied the deployment, Hungary's implementation was capable of tracking approximately 500 million devices through 219 active servers -- 126 in the United States, 32 in the Netherlands, 17 in Singapore, and the remainder spread across Germany, Hong Kong, and the United Kingdom.
Hungary was the first confirmed European Union member state to deploy mass ad-tech surveillance against its own citizens.
The Webloc system was not the only surveillance tool in play. Peter Magyar, the opposition leader, publicly alleged that the Orban government had deployed Candiru spyware -- military-grade surveillance software developed by another Israeli firm -- against members of his Tisza Party. Candiru's signature product, DevilsTongue, is capable of remotely accessing a target's device, extracting messages, activating the microphone and camera, and exfiltrating stored data without the user's knowledge. Cybersecurity researchers confirmed the presence of active DevilsTongue infrastructure in Hungary, though the government neither confirmed nor denied its use against domestic political opponents. The non-denial was itself a message: the ambiguity is the point. If the opposition does not know whether their phones are compromised, the surveillance has already done its work regardless of whether it is actually running.
The government had also spent millions of euros developing a homegrown open-source intelligence system called Quvasz, which proved to be an expensive failure -- a monument to the gap between authoritarian ambition and technical capability. But the failure of the in-house system only accelerated the purchase of proven tools from the commercial surveillance market. When the state cannot build, it buys. The global surveillance industry exists to serve exactly this customer.
A more consequential intelligence operation was the SCI-Network, headed by former counterintelligence colonel Tamas Berki and connected directly to Antal Rogan, the cabinet minister who controlled both Hungary's intelligence services and its propaganda operations. Rogan oversaw the Prime Minister's Cabinet Office, which meant a single political operative held authority over what the state knew about its citizens and what its citizens were told about the state. The fusion of surveillance and messaging under one office was not an accident. It was the architecture of control -- the feedback loop that every authoritarian system requires, where intelligence collection informs information operations and information operations justify further intelligence collection.
And the media empire that Rogan's propaganda machine served was vast. The government-aligned Central European Press and Media Foundation controlled more than 500 media outlets across Hungary, creating an information ecosystem in which the surveillance apparatus operated not in darkness but under the cover of narrative dominance. When the regime controls what people see, the regime can also control what people think about what the regime sees.
And then there was Russia. The Washington Post reported that Russian intelligence had proposed staging an assassination attempt as part of an influence operation targeting the Hungarian election. Documented bot campaigns and Kremlin-linked agitprop operations flooded Hungarian social media with disinformation designed to discredit the opposition and bolster Orban's narrative of external threats requiring a strong hand. The Kremlin's interest in Orban's survival was not sentimental. Orban had been the EU's most reliable internal obstructionist -- blocking sanctions against Russia, vetoing security cooperation, and single-handedly holding up a $105 billion loan package for Ukraine. Losing Hungary meant losing the veto.
The journalist who became a criminal
The case of Szabolcs Panyi is the case study in how surveillance infrastructure becomes a weapon against accountability itself.
Panyi is one of Hungary's most prominent investigative journalists. His reporting for Direkt36 had exposed elements of the government's surveillance operations, its intelligence relationships with foreign vendors, and the institutional connections between Orban's security apparatus and his political operations. The kind of reporting that, in a functioning democracy, produces parliamentary inquiries and oversight reforms. In Orban's Hungary, it produced an espionage indictment.
In the months leading up to the April election, Panyi was charged with espionage -- a criminal offense carrying years of imprisonment -- for the act of journalism. The charges alleged that his reporting on the intelligence apparatus constituted a breach of state secrets. The legal theory was straightforward: if the government classifies its surveillance operations, then reporting on those operations is espionage. The classification does not protect national security. It protects the government from embarrassment. And the espionage charge does not punish spying. It punishes disclosure.
The prosecution served a dual purpose. It punished Panyi specifically -- imposing legal costs, travel restrictions, and the existential threat of imprisonment. And it warned every other journalist in Hungary about the consequences of investigating the state's surveillance capabilities. The chilling effect was the point. Espionage charges against a reporter are a broadcast signal to the entire press corps: this is what happens to people who look too closely at the tools we use to watch you.
With Orban's defeat, Panyi's case becomes the first and most immediate test of Magyar's government. Dropping the charges would signal that the new government considers journalism to be journalism, not espionage. Pursuing them would signal that the institutional reflexes of the surveillance state survive the election that was supposed to end it. The Panyi case is not a side story. It is the leading indicator of whether Hungary's democratic renewal is real.
The GDPR that was not
Hungary is a member of the European Union. Its citizens are nominally protected by the General Data Protection Regulation, the most comprehensive data privacy framework in the world. The GDPR explicitly prohibits the kind of mass surveillance that the Webloc system represents -- the indiscriminate collection of location data, behavioral patterns, and personal information without informed consent or legitimate legal basis.
Researchers who examined the Webloc deployment concluded that it blatantly violated EU privacy regulations. But the GDPR's enforcement mechanism depends on national data protection authorities, and Hungary's data protection authority -- like its courts, its media regulator, and its election commission -- had been systematically captured by Fidesz appointees over sixteen years. The regulation existed on paper. The enforcement did not exist in practice.
This is the gap that authoritarian governments exploit within democratic frameworks: they maintain the formal structures of rights and oversight while hollowing out the institutional capacity to enforce them. Hungary's surveillance apparatus operated within an EU member state, under the nominal jurisdiction of EU law, using commercial technology developed by companies that operate in regulated markets. At no point did any of these formal protections prevent the deployment of mass surveillance against Hungarian citizens.
The irony deepens when you look at what the EU itself is doing to the GDPR at the same time it celebrates Hungary's democratic renewal. In November 2025, the European Commission published its Digital Omnibus proposals -- and Amnesty International called them "the biggest rollback of digital rights in EU history." The proposals redefine personal data in ways that allow Big Tech to harvest more information for AI training. They delay high-risk AI system compliance deadlines from August 2026 to August 2028. They weaken protections for sensitive data -- political opinions, union membership, sexual orientation -- that are exactly the categories an authoritarian government weaponizes first. Corporate Europe Observatory published an article-by-article analysis showing the fingerprints of Big Tech lobbying on virtually every revision. Amazon alone spent 7 million euros on EU lobbying.
So the EU celebrates Hungary voting out a government that violated the GDPR while simultaneously gutting the GDPR itself. Von der Leyen declares that Europe's heart beats stronger in Hungary tonight -- while her Commission weakens the privacy law that was supposed to prevent what Hungary's government just did. The contradiction is not subtle. It is structural. And it means that Hungary's new government will attempt to rebuild democratic privacy protections within an EU framework that is actively dismantling them.
What 77 percent means
The election's significance is not simply that the opposition won. It is how they won, and against what.
Seventy-seven percent turnout in the context of a surveillance state is a remarkable figure. The purpose of a surveillance apparatus is not merely to collect information. It is to create the ambient awareness of being watched -- the knowledge that political activity is observed, that dissent is recorded, that association with the opposition carries risk. The academic literature on the chilling effects of surveillance documents this dynamic extensively: when people believe they are being watched, they modify their behavior. They self-censor. They withdraw from political participation. They stay home on election day.
Seventy-seven percent of Hungarians did not stay home.
The surveillance infrastructure that the Orban government built over sixteen years -- the ad-tech tracking, the spyware, the intelligence networks, the prosecution of journalists, the Russian-backed disinformation -- was designed to produce exactly one outcome: the continuation of Fidesz rule. The system was sophisticated, well-funded, and deployed without meaningful legal constraint. It had the advantage of incumbency, state resources, a captured judiciary, and a media ecosystem of more than 500 aligned outlets.
And it failed. It failed because the fundamental premise of authoritarian surveillance -- that watched people are compliant people -- is wrong. It is wrong not universally and not inevitably, but it is wrong often enough that surveillance alone cannot substitute for legitimacy. When a government loses the consent of the governed, no amount of data collection can manufacture it back. The metadata shows where people go. It does not control where they choose to go. And on April 12, enough Hungarians chose to go to the polling stations that no surveillance architecture could change the outcome.
The two-thirds question
The most consequential number in the election results is not 53.6 percent. It is 138 seats.
Under Hungary's constitution, a two-thirds parliamentary majority -- 133 of 199 seats -- is required to amend the Basic Law. Orban secured this threshold in 2010 and used it to rewrite Hungary's constitutional framework, embedding provisions that strengthened executive power, weakened judicial independence, and created the legal basis for the surveillance and media infrastructure that sustained Fidesz rule for the next sixteen years.
Magyar now holds 138 seats. He has the same constitutional authority that Orban used to build the system. The question is whether he will use it to dismantle the system.
Why dismantling is harder than building
This is where the story shifts from election night to institutional transformation, and where the real difficulty begins. Dismantling a surveillance state is not a matter of changing personnel. It is an architectural problem, and history says most new governments underestimate how long it takes.
The Webloc licenses can be revoked. The SCI-Network can be defunded. Panyi's espionage charges can be dropped. But the 219 Cobwebs servers are still running. The Candiru spyware infrastructure is still deployed. The intercept capabilities installed at every Hungarian ISP are still operational. The officials who operated these tools still hold their security clearances and their institutional knowledge. The contracts with Israeli surveillance vendors do not expire with the election results. And databases, once created, can be copied faster than they can be deleted.
Germany took fifteen years after reunification to fully process the Stasi files -- and the Stasi was analog. The Stasi-Unterlagen-Behorde, the agency created to manage the archive, employed thousands of people for decades to reconstruct shredded documents, process millions of pages, and handle hundreds of thousands of individual requests for access. The sheer volume of an analog surveillance state's records was staggering. Digital surveillance infrastructure is simultaneously easier to audit and easier to hide. A database can be exfiltrated in minutes. A server can be cloned before the decommissioning order arrives. The expertise to rebuild lives in the heads of the people who built it the first time.
South Africa's intelligence services were not meaningfully reformed until a decade after apartheid. The National Intelligence Agency that replaced the apartheid-era Bureau of State Security retained many of the same personnel, the same institutional cultures, and many of the same capabilities. Spain's CNI retained Franco-era surveillance capabilities well into the 2000s. In every historical case, the political will to dismantle a surveillance state exceeded the institutional capacity to do so -- and the gap between intention and execution was where the old infrastructure survived.
Poland's experience since late 2023, when Donald Tusk's coalition replaced the Law and Justice government, offers the most recent and most relevant precedent. Media reform proved contentious. Judicial reform faced constitutional obstacles planted by the previous government. The surveillance infrastructure was not simply a set of tools to be switched off; it was woven into the institutional fabric of the state. And Tusk's coalition did not have a supermajority.
Hungary's challenge is greater. Orban's sixteen years -- compared to Law and Justice's eight -- allowed deeper institutional capture. The constitutional amendments are more extensive. The media consolidation is more complete. The intelligence apparatus is more thoroughly integrated into the political system.
But Magyar's supermajority is also greater than anything Tusk commanded. The constitutional authority to dismantle is there. If Magyar's government does not make it a first-100-days priority -- with public audits, infrastructure decommissioning, and criminal accountability for unlawful deployments -- the tools Orban built will be waiting for whoever comes next.
Meanwhile, another democracy builds
While Hungary votes out its surveillance state, the United Kingdom is building a new one.
In early 2026, the UK announced it will expand its live facial recognition deployment from 10 mobile vans to 50, deployed to every police force in England and Wales. The government allocated 26 million pounds for the national facial recognition system and 115 million pounds over three years for a National Centre for AI in Policing. The expansion was announced before the government's own 12-week public consultation on facial recognition use had concluded -- a consultation whose conclusions, apparently, were not required before the spending decisions were made.
A March 2026 study conducted by Cambridge researchers for Essex Police found "no statistically significant evidence" that live facial recognition deployments reduced crime. Some tests produced false positive rates as high as 91 percent, with documented bias against Black and Asian subjects. An Asian man was wrongfully arrested in January 2026. Lords amendments to the Crime and Policing Bill are scheduled for April 14 -- two days from now.
The UK is also the country that served Apple with a secret Technical Capability Notice under the Investigatory Powers Act, forcing Apple to withdraw end-to-end encrypted iCloud backups for UK users in February 2025. It is building, simultaneously, a nationwide biometric surveillance network and a legal framework that compels companies to weaken encryption. The NEC Corporation contractor supplying the facial recognition technology is the same firm whose systems have been linked to operations in Israel.
The lesson of Hungary is that surveillance infrastructure built by a democratic government does not remain in democratic hands forever. The tools built for one purpose get used for another. The databases compiled for one administration become the targeting infrastructure for the next. Every democracy that builds mass surveillance capability is building the toolset for its own potential authoritarian turn -- and betting that the turn will never come. Hungary just demonstrated what sixteen years of lost bets looks like.
The defense that does not depend on governments
There is a temptation to read Hungary's election as proof that democracy can always overcome surveillance. The 77 percent turnout makes a powerful case. But the structural lesson is the opposite: the surveillance apparatus came within institutional distance of working. It did not fail because it was technically inadequate. It failed because the political conditions in April 2026 happened to produce a turnout large enough to overcome it. A different year, a weaker opposition, a lower turnout -- and the same tools produce a different outcome. The apparatus is still there. It works. The next government will inherit it.
The only durable defense against surveillance infrastructure is not a favorable election result. It is architecture.
End-to-end encrypted communications eliminate the centralized access point that surveillance systems exploit. Signal encrypts every message and every call by default. The server never holds the plaintext. When a grand jury subpoenaed Signal's records in 2021, the company turned over two data points: the date the account was created and the date it last connected. That was everything Signal had. An Orban-style government serving a court order on Signal's infrastructure gets nothing useful, because there is nothing useful to produce.
Decentralized networks go further. Tor distributes traffic across thousands of volunteer-operated relays so that no single node can observe both the origin and destination of a communication. There is no central switching infrastructure where intercept equipment can be installed. The Webloc model -- where a surveillance platform tracks devices through centralized advertising infrastructure -- is architecturally disrupted when traffic does not flow through centralized chokepoints.
Decentralized VPN architectures like URnetwork route connections through networks of independent nodes rather than centralized server infrastructure. There is no single carrier to serve a court order on, no central switching facility where CALEA-mandated intercept equipment can be installed, no third-party vendor whose compromise gives an attacker -- or a captured government -- access to the entire network. The architecture is distributed by design. The kind of centralized surveillance that the Orban government deployed is geometrically impossible on a network where the traffic flows through thousands of independent nodes with no centralized aggregation point. There is no Webloc for a network that has no center. There is no SCI-Network tap for a system with no central pipe.
These tools are not theoretical. They exist. They work. They are used by millions of people in countries where the difference between being surveilled and not being surveilled is the difference between prison and freedom, between safety and violence, between participation in democracy and withdrawal from it. The Hungarian citizens who organized, communicated, and turned out at 77 percent did so in part because encrypted and decentralized tools made it possible to coordinate outside the regime's field of vision.
The apparatus was watching
Surveillance infrastructure is not a neutral capability. It is a political weapon. The same ad-tech tracking system, the same spyware, the same intelligence networks can serve legitimate security purposes under democratic oversight or authoritarian control purposes under captured institutions. The difference is not the technology. It is the institutional framework that governs its use -- and, as Hungary demonstrated for sixteen years, institutional frameworks can be captured.
Orban demonstrated how a government operating within a formal democratic framework can systematically capture the institutions meant to constrain surveillance and repurpose the surveillance apparatus for political control. The ad-tech surveillance was deployed legally, under Hungarian law, by a government that had rewritten the laws to permit it. The spyware was operated by intelligence services whose oversight bodies had been staffed with loyalists. The journalist was charged under espionage statutes that had been broadened to criminalize reporting. Everything was lawful. Nothing was legitimate.
The defense against this is layered. It starts with institutions -- independent oversight bodies with real authority, data protection agencies with genuine enforcement power, judicial review that cannot be circumvented by constitutional capture. It continues with law -- privacy frameworks like the GDPR that are enforced at a level above the national authorities that can be captured, assuming the EU does not hollow out the GDPR first. And it ends with architecture -- encrypted communications, decentralized networks, and systems designed so that no single point of capture can compromise the privacy of every user.
On April 12, 2026, 77 percent of Hungarians proved the most important point: the surveillance apparatus, for all its sophistication and expense, could not save the regime that built it. What they build next -- the institutional reforms, the dismantled infrastructure, the restored oversight, the architectural defenses that do not depend on the good intentions of any single government -- will determine whether Hungary's story is a one-time correction or a durable democratic renewal.
The apparatus was watching. The citizens voted anyway. What happens to the apparatus now is the question that matters.
Sources (2)
Sources: Hungarian National Election Office results (April 12, 2026); Citizen Lab, "Webloc" report (April 11, 2026) on Cobwebs Technologies/Penlink ad-tech surveillance (219 servers, 500M devices); Candiru/DevilsTongue infrastructure research and Peter Magyar public allegations; Szabolcs Panyi espionage charge reporting (Direkt36, international press); Washington Post reporting on Russian assassination staging proposal and disinformation operations; European Commission President Ursula von der Leyen statement (April 12, 2026); VSquare, OCCRP, and Bloomberg reporting on SCI-Network, Tamas Berki, Antal Rogan, and Quvasz; Central European Press and Media Foundation media consolidation analysis (500+ outlets); GDPR enforcement gap research; EU Digital Omnibus proposals (November 2025) and Amnesty International critique; Corporate Europe Observatory lobbying analysis; Biometric Update, The Gazette, and Al Jazeera on UK facial recognition expansion (10 to 50 vans, 26M pounds); Essex Police/Cambridge March 2026 facial recognition study ("no statistically significant evidence"); Polish democratic transition comparative analysis (Tusk coalition, 2023-present); Stasi-Unterlagen-Behorde historical records; South Africa National Intelligence Agency reform timeline; Freedom House Global Internet Freedom assessment (15th consecutive year of decline).