Orbán‑Gate
Intelligence services, police, and the election battle — 2025–2026
On March 25, 2026, Bence Szabó, a police captain at Hungary's National Bureau of Investigation, revealed that the Constitution Protection Office exerted intelligence pressure on police during proceedings against TISZA Party IT staff. The affair escalated into a political-national security scandal unseen since Hungary's democratic transition. This page chronologically documents the events, the two competing narratives, the logical contradictions of the government's explanation, and the legal concerns.
⚠ THIS CASE IS ONGOING — LAST UPDATED: APRIL 1, 2026The essence of the affair in three sentences
In the summer of 2025, the National Bureau of Investigation (NNI) conducted raids on two IT specialists working for the TISZA Party, based on an anonymous tip alleging child pornography. The Constitution Protection Office (AH) — Hungary's domestic intelligence agency — urged the police to carry out the raids. No child pornography was found.
In March 2026, Captain Bence Szabó, an NNI investigator, went public: there was strong reason to believe the child pornography allegation was a cover story, and the real objective was to gain access to TISZA's IT infrastructure and cripple the party. The government maintains that this was a legitimate counterintelligence operation against Ukrainian influence.
The affair broke 18 days before the April 12, 2026 parliamentary elections and became intertwined with the parallel Panyi–Szijjártó–Lavrov scandal. Together, the two cases became the defining events of the campaign.
Events in chronological order — sources indicated
Perhaps the most astonishing thread of the spy scandal is that the government propaganda machine's key "evidence" — the declassified interrogation video — was the product of a 19-year-old's deliberate disinformation. Dániel Hrabóczki recognized that what he said during the AH interrogation would be used for political purposes, so he constructed a false narrative in advance — and the government did indeed present that narrative to the nation as "conclusive proof."
The absurdity is multi-layered: the intelligence apparatus directed by the ruling party was outsmarted by a teenager. The Constitution Protection Office's interrogators, the polygraph, and ultimately the entire propaganda machine — which presented the footage as "irrefutable evidence" — were all deceived by a young man who had been running a shared Minecraft server with peers in Tallinn and Kyiv. The "Ukrainian training" suggested by government propaganda amounted to five days in Kyiv, two of which were spent travelling.
This not only undermines the credibility of the "Ukrainian spy" narrative but raises the more serious question: if a 19-year-old was able to see through and outplay an intelligence interrogation, what does this say about the entire operation's professional caliber — and whether the real goal was national security, or merely manufacturing campaign material?
Chronological and logical contradictions in the government's narrative
According to government communications, Ukrainians recruited TISZA Party IT staff, the TISZA Party serves Ukrainian interests, journalist Szabolcs Panyi is a Ukrainian agent, and the entire scandal is Ukrainian interference in Hungarian elections. Influencers and analysts have pointed out that this narrative contradicts itself.
| QUESTION | GOVERNMENT RESPONSE | CONTRADICTION |
|---|---|---|
| If this was counterintelligence, why use a child pornography cover story? | "The police acted on the basis of the tip received." | The tip's level of detail (names, addresses, technical data) suggests an intelligence dossier, not a civilian report. If the AH knew about Ukrainian espionage, why weren't espionage charges brought? NO ANSWER |
| When did the alleged counterintelligence begin? | "The IT workers were on the radar of counterintelligence before TISZA even existed." | If TISZA was founded in 2024, but the Szijjártó–Lavrov wiretap dates to 2020 — how do the two connect in the government's narrative? No official explanation resolves this temporal impossibility. |
| Why at the peak of the election campaign? | "Szabó was politically motivated — he chose the timing." | The raids took place in the summer of 2025 — the government has not released counterintelligence findings since. Yet the declassification happened 14 days before the election. Who chose the timing? |
| Who was "Henry"? | No official position. | In chat messages, "Henry" blackmailed the IT worker and aimed to bring down TISZA. Authorities have not identified him. If counterintelligence was genuinely underway, identifying "Henry" should have been the primary objective. NO ANSWER |
| Are the Ukrainians with TISZA, or against them? | Simultaneously both: "Ukrainian spies recruited TISZA IT staff" + "TISZA serves Ukrainian interests." | If Ukraine wants TISZA to win, why would they recruit and thereby compromise the party's IT workers? The two claims are mutually exclusive. |
| Does the public believe it? | "The evidence is clear." | Polls show that even among Fidesz voters, a majority does not believe the government's official version. |
The declassification, publication of investigative material, and double standards
On March 29, 2026 — just 4 days after the scandal broke — the government declassified a video from H. D.'s interrogation and published it on the government's official YouTube channel. This is unprecedented on multiple levels:
Investigative material from an ongoing national security case — a video of a suspect/witness interrogation — was published on the government's social media channels, clearly for campaign purposes, 14 days before the election.
Under the Criminal Procedure Act (Be.) and the National Security Act (Nbtv.), material from an ongoing investigation may not be made public. Declassification is decided by the national security director general — not the government's communications team. The usual publication platform is certainly not the government's campaign channels.
When the independent press or the opposition asks about the government's affairs — whether corruption cases, the Pegasus scandal, EU funds, or the Szijjártó–Lavrov connection — the government's standard reply is: "We cannot comment on ongoing proceedings", "National security interests preclude disclosure", or simply no response at all.
Classified interrogation → declassified within 4 days → published on the government's YouTube → Máté Kocsis Facebook post → pro-government media 24-hour rotation. The national security services present "evidence" to the public — not to the courts.
Pegasus affair: classified for years. Szijjártó–Lavrov: "slander, no comment." EU funds: "ongoing proceedings." Gold convoy Garancsi connection: silence. National security classification in these cases serves as a shield, not a campaign weapon.
The Counter-Terrorism Force's March 5, 2026 Alacska raid followed a similar pattern: detailed propaganda material was released immediately about the operation, albeit without showing faces. One could argue that such briefings are standard for raids. However, the publication of the spy scandal interrogation video is qualitatively different: a classified recording of a suspect/witness interrogation was made public for campaign purposes. If the proceeding was truly of national security significance, the declassification served not the evidentiary process but the government's campaign.
The government's and the opposition's interpretations side by side
In numbers and reactions
Since Hungary's democratic transition in 1989–90, there has been no instance of a single whistleblower attracting this much financial support in such a short time. The sum — exceeding EUR 650,000 — represents more than monetary aid: the 28,000 donors effectively held a referendum on the government's credibility.
Polls show that even among Fidesz voters, a majority does not believe the government's official version. This trust deficit carries strategic significance in the final two weeks of the campaign.
Two scandals, one campaign strategy
The TISZA spy scandal does not stand alone: two days before the Direkt36 article, on March 23, pro-government outlet Mandiner published a wiretapped recording targeting journalist Szabolcs Panyi. In response, Panyi released a transcript of a 2020 Szijjártó–Lavrov phone call in which Hungary's foreign minister asked Russia for help influencing a Slovak election.
Together, the two affairs form a government playbook: the Panyi case is the "red herring" — diverting attention from the Szijjártó–Lavrov connection to the journalist personally; the TISZA spy scandal is the "Ukraine card" — lumping every opposition actor into a single "foreign conspiracy" narrative.
As one analyst put it: "TISZA is Ukrainian, the two IT workers are Ukrainian, Szabó is a TISZA agent, Ukrainians, Ukraine, traitors and conspirators, intelligence services asking journalists for phone numbers — everyone who isn't with them is Ukrainian, everyone is a traitor and a TISZA agent."
This affair is not a corruption scandal, not a money laundering case, not a personal controversy. If Bence Szabó and Direkt36's claims are true, then the Orbán government deployed Hungary's intelligence services against the largest opposition party before an election — and when caught, used classified investigative material as a campaign weapon.
If the government's version is true — that legitimate counterintelligence was underway — it remains unanswered why a child pornography cover story was needed, why no espionage charges were brought, why the "evidence" appeared on the government's YouTube channel rather than in court, and why the interrogation video was presented to the campaign trail rather than to a judge.
The HUF 260 million fundraiser, the 1 million views, and the sheer volume of the societal response demonstrate that a significant portion of Hungarian society does not accept that in a NATO and EU member state, the intelligence services should function as a campaign weapon — regardless of which side's narrative one considers true.