White House bans government 'operational' use of commercial spyware in executive order
Valerio Rosati / EyeEm/Getty Images
The Biden administration hopes the ban on government use of commercial spyware will serve as a model for other countries to help stem the proliferation of surreptitious surveillance tools.
The Biden administration announced major federal action against commercial spyware technologies with a new executive order prohibiting the U.S. government from using commercial spyware products that threaten national security and human rights.
Commercial spyware refers to surveillance software that can be disseminated surreptitiously, without the knowledge of an end user. After installation, the software can extract and export sensitive data on a device. Officials on a press call confirmed at least 50 U.S. personnel overseas were targeted by commercial spyware, spurring further federal action to reduce U.S. data exposure.
“This executive order will serve as a concrete demonstration of U.S. leadership and commitment to countering the misuse of commercial spyware and other surveillance technology,” a senior administration official said during a press call on Monday. “The executive order…prohibits departments and agencies across the federal government, from operationally using commercial spyware tools that pose significant counterintelligence or security risks to the U.S. government, or significant risks of improper use by a foreign government or foreign person, including to target Americans or enable human rights abuses, and it encompasses spyware tools that are furnished by foreign or domestic commercial entities.”
The administration noted that it has seen a “growing number” of foreign governments utilizing commercial spyware against their own citizens in both democratic and authoritarian regimes. In 2021, the Biden administration launched a multi-agency initiative to study how commercial surveillance tech can be used against civil rights and what policy measures would be needed to counter these effects.
The Department of Commerce moved in sync with these efforts in November 2021 by adding four foreign companies based in Israel, Russia and Singapore to its list of designated spyware technology suppliers. They were subsequently placed on federal export control.
“As we dug into this effort, we also recognized quickly that the proliferation of commercial spyware poses distinct and growing counterintelligence and security risks to the United States, including to the safety and security of U.S. personnel and their families,” the senior administration official said.
Preceding this executive order, the Biden administration had issued export controls on software linked to known spyware. Now, the executive order functions as a “consensus product” between all U.S. departments and agencies, ensuring that federal agencies using commercial spyware align with U.S. foreign policy and national security interests, and that they do not contribute to commercial spyware abuse.
By formalizing potential factors that could indicate cybersecurity risks, the executive order attempts to add some oversight of a largely uncontrolled industry. It aims to function as an information sharing vehicle to ensure that federal agencies can make accurate determinations on commercial spyware with precise information on its security and impacts.
“We believe this executive order will also help spur reform in a largely unregulated and insufficiently controlled industry, including by outlining responsible use, and remedial factors that are intended to prevent misuse and reduce risks to U.S. national security,” the senior administration official added.