US bans government agencies from using spyware ‘operationally’ as national security concerns grow

(CNN) — President Joe Biden on Monday issued an executive order banning US government agencies from using invasive commercial hacking tools that are deemed a threat to US national security or are implicated in human rights abuses.

Pressure has grown in recent weeks on the administration to do more to curb the use of the hacking tools among fellow democracies following press reports that multiple European governments have used spyware on their citizens. A bipartisan group of US lawmakers wrote to Secretary of State Antony Blinken this month urging him to form an “international coalition” to combat spyware.

The US has been targeted and the Biden administration has identified about 50 US government personnel in at least 10 countries that are confirmed or suspected to have been targeted by commercial spyware, a senior administration official told reporters on Monday.

Such hacking tools pose “distinct and growing counterintelligence and security risks to the United States, including to the safety and security of US personnel and their families,” the senior official said.

The directive targets spyware, or malicious software sold by companies around the world that break into the mobile phones of targets with a few clicks.

An impetus for the executive order was the discovery in 2021 that the iPhones of about a dozen US State Department employees were hacked with spyware developed by Israeli firm NSO Group, CNN has reported.

The executive order reflects wide-ranging concerns in the Biden administration that both authoritarian governments and democracies can use the powerful hacking tools to suppress opposition voices or target journalists.

The tools also directly threaten US diplomats.

The Biden administration will this week co-host a “Summit for Democracy” with governments around the world where spyware is expected to be a prime topic.

But the extent to which US government agencies themselves have used spyware is unclear. The new directive prohibits US agencies from using spyware “operationally,” but does not preclude using the tools for testing purposes, as the FBI says it has.

The FBI has also explored using NSO Group’s signature hacking tool in criminal investigations before opting not to, while the CIA bought the tool for the East African government of Djibouti, according to a New York Times report.

The senior administration official on Monday declined to detail any examples of when US government agencies may have used commercial spyware operationally in response to a question from CNN.

Ron Deibert, director of the University of Toronto’s Citizen Lab, which investigates spyware abuses, said the new executive order will “make the very lucrative US federal government market inaccessible to firms that present a national security risk and facilitate transnational repression and human rights violations abroad.”

The directive, Deibert told CNN, will hopefully “trigger a common front among allied countries worldwide and send a strong signal that the Wild West days are over for NSO Group and other reckless actors in this space.”

NSO Group, which the US Commerce Department has effectively blocked from buying US software, has long asserted that its hacking tools are only sold to governments for legitimate counter-terrorism or anti-crime purposes.

But the spyware challenge is not confined to one technology or vendor, analysts say. Suspected spyware infections have been found in dozens of countries, from Angola to Zambia, according to a study from the Carnegie Endowment for International Peace.

---

The-CNN-Wire™ & © 2023 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.