In an executive order signed Monday, President Biden barred federal agencies from using commercial spyware that threatens US national security or carries a risk of improper use by foreign governments and individuals. The order applies to all departments, including those involved in law enforcement, defense and intelligence. It also prohibits the use of spyware that in the past was used to disclose non-public information about the US government.
The executive order the Biden administration published on the White House website doesn’t include a list of affected spyware vendors. Specific firms were not identified. However, the administration said the order includes US and foreign-made spyware. Judging from the criteria laid out in the order, known government spyware makers like Isreal’s NSO Group and Macedonia’s Cytrox are likely affected.
Security researchers have long warned of the dangers posed by commercial spyware. Such programs frequently target previously undisclosed vulnerabilities that make entire software ecosystems unsafe. In the case of NSO Group’s infamous Pegasus spyware, the firm exploited a CoreGraphics vulnerability in iOS that allowed the program to infect an iPhone without the victim needing to tap anything. Moreover, while many governments claim to use spyware sparingly to investigate serious crimes, that hasn’t stopped some from using the software for domestic surveillance and to target political dissidents.
On Monday, the Biden administration said at least 50 US federal employees in 10 countries are either suspected or confirmed of having had their devices compromised by spyware. In one recent example, an unknown assailant used the Pegasus spyware to infect iPhones belonging to at least five US State Department officials stationed in Uganda or whose work involved the East African country. The order follows questions about the US government’s alleged use of commercial spyware. Last fall, it was reported that the FBI had considered using Pegasus in criminal investigations.
From The Shadows Emerges Knowledge