President Joe Biden signed an executive order on March 27, 2023, that restricts the use of commercial spyware by government agencies. The use of commercial spyware has become widespread in recent years, with many countries using it to spy on their citizens, journalists, activists, and dissidents. This has led to significant counterintelligence and security risks, as well as violations of human rights and democratic values. To address this issue, the executive order establishes a policy that prohibits the operational use of commercial spyware that poses significant counterintelligence or security risks to the United States Government. It also prohibits the use of commercial spyware that has a significant risk of improper use by a foreign government or foreign person.
The order directs steps to implement this policy, including the establishment of robust protections and procedures to ensure that any United States Government use of commercial spyware aligns with its core interests in promoting democracy and democratic values around the world. It also encourages the development and implementation of responsible norms regarding the use of commercial spyware that are consistent with respect for the rule of law, human rights, and democratic norms and values.
Any federal agency seeking to procure commercial spyware for purposes other than a criminal investigation must first review the intelligence assessment issued by the Director of National Intelligence (DNI) and request additional information from the DNI if necessary. The agency must then consider the factors set forth in section 2(a) of the order in light of the information provided by the DNI. Additionally, the agency must consider whether the entity furnishing the commercial spyware has implemented reasonable due diligence procedures and controls that would enable the entity to prevent or identify significant counterintelligence or security risks to the US government or significant risks of improper use by a foreign government or person.
NSO Group, an Israeli technology company, made headlines with their popular commercial spyware, Pegasus, after an investigation by 17 news organizations into over 50,000 numbers revealed that NSO clients allegedly selected more than 1,000 individuals across 50 countries for potential surveillance since 2016. The list includes 189 journalists, over 600 politicians and government officials, and several heads of state. The FBI has confirmed in the past that it obtained NSO Group’s Pegasus spyware to “stay abreast of emerging technologies and tradecraft.”
