President Biden Signs Executive Order Restricting Use of Commercial Spyware

March 28, 2023Rabbi LakshmananSpyware/Cyber ​​Security

US President Joe Biden on Monday signed an executive order restricting the use of commercial spyware by federal agencies.

The executive order states that the spyware ecosystem “poses a significant counterintelligence or security risk to the U.S. government or poses a significant risk of improper use by foreign governments or persons.”

It also calls for governments to use such tools in a manner that is “consistent with respect for the rule of law, human rights, and democratic norms and values.”

To that end, the order sets forth various criteria by which commercial spyware may be disqualified for use by US government agencies. They include –

• Purchase of commercial spyware by a foreign government or individual that targets the U.S. government;
• commercial spyware vendors operating under the control of foreign governments engaged in espionage targeting the United States, using or disclosing sensitive data obtained from cyber surveillance tools without authorization;
• Foreign threat actors using commercial spyware against activists and dissidents to restrict freedom of expression or commit human rights abuses;
• Foreign threat actors using commercial spyware to spy on U.S. citizens without legal authorization, protection, or oversight; and
• Selling commercial spyware to governments with a record of engaging in systematic acts of political repression or other human rights violations.

“This executive order also serves as a foundation for deepening international cooperation to promote the responsible use of surveillance technology, combat the proliferation and misuse of such technology, and promote industry reform,” the White House said in a statement. ‘ said.

It is estimated that about 50 US government officials in at least 10 countries have been infected with or targeted by such spyware to date, a higher number than previously known. reports the Wall Street Journal.

While this order doesn’t lead to an outright ban, more and more sophisticated and invasive surveillance tools are being deployed, using zero-click exploits to remotely access electronic devices and reveal valuable information about their targets without their knowledge. It is being developed because it is designed to extract without your consent.

Last week, The New York Times reported that Artemis Seaford, former security policy manager at Meta, had his phone tapped and hacked by Greece’s national intelligence agency using Predator, spyware developed by Cytrox.

That said, the order also leaves open the possibility for government agencies to use other types of spyware devices, such as IMSI catchers, to gather valuable information.

From that perspective, it is also acknowledged that the spyware distribution industry plays an important role in intelligence gathering operations, but this technology constitutes an increased counterintelligence and national security risk to government officials.

Earlier this month, the Federal Bureau of Investigation (FBI) confirmed that the FBI had in the past purchased location data of U.S. citizens from data brokers as a means of circumventing the traditional warrant process.

The FBI is also said to have purchased a license for Israeli company NSO Group’s Pegasus from 2020 to 2021 and admitted that it was used for research and development purposes.

In a similar fashion, the Drug Enforcement Administration (DEA) uses Graphite, a spyware tool created by another Israeli company named Paragon, to fight drugs. It is not immediately clear whether other US federal agencies are currently using commercial spyware.