Commercial spyware prohibited for federal agencies under Biden's executive order

On Monday, the Biden administration unveiled a fresh executive order that would prohibit U.S. federal agencies from utilizing commercially manufactured spyware that jeopardizes both human rights and national security, covering a wide range of applications.

The Biden administration has issued an executive order banning the use of commercial spyware by federal agencies, including law enforcement, defense, and intelligence. This comes as reports confirm that many US government personnel have had their phones targeted. Commercial spyware, created and sold by the private sector almost exclusively to governments and nation states, has long been criticized by human rights defenders and security researchers due to the risks it poses.

This powerful surveillance technology exploits previously undisclosed flaws found in an iPhone or Android’s software to steal a person’s photos, contacts, call logs, messages, and real-time location data. Critics claim that while governments claim to exclusively use the technology for investigating serious crimes, it has been deployed against journalists, lawyers, and human rights defenders who are vocally critical of their governments.

In a press call ahead of the order’s signing, Biden administration officials said that the United States was trying to get ahead of the problem and set standards for other governments and its allies, which buy and deploy commercial spyware. The order is the latest action taken by the government in recent years, including banning some spyware makers from doing business in the US and passing laws aimed at limiting the use and procurement of spyware by federal agencies.

The criteria for the ban has not been disclosed, but it is likely to affect known government spyware makers and vendors known to sell to authoritarian governments that commit human rights abuses, including NSO Group, Cytrox, and Candiru. The officials said that the order includes both domestic and foreign-made spyware, as to not incentivize companies to relocate to the United States, but that the list of banned spyware would not necessarily be made public.

The officials warned that the misuse of these surveillance tools is not limited to authoritarian regimes, noting that democratic governments, including European nations like Greece, Spain, and Poland, have also relied on commercial spyware. Reports confirm that many US federal employees in 10 countries on multiple continents are suspected or confirmed as being compromised by spyware.

The order is the latest response by the executive branch following years of congressional inaction, including gun violence and voting access. As the executive order was introduced as law by the Biden administration, it can be revoked at any time, including by any subsequent administration.