Google: Governments need to do more to combat commercial spyware

The commercial spyware industry continues to supply highly advanced surveillance capabilities despite efforts to better regulate it.

Google researchers focused on the most complex hacking threats argued in a report published Tuesday that governments around the world should take more aggressive steps to combat the growth of a commercial spyware industry that is continuing to supply governments with invasive malware used to target journalists, human rights defenders, dissidents and political opponents.

Responsible for combating the most sophisticated threats to Google users, the company’s Threat Analysis Group said in their report that they are currently tracking roughly 40 commercial spyware vendors — an indication of how the industry has grown and advanced spyware capabilities have proliferated. The report notes that the industry is fluid with new companies opening shop every year and established ones reincorporating under new names.

Commercial spyware vendors enable highly effective and targeted surveillance for governments that may not have the in-house cyber expertise. These firms devote exceptional resources to weaponize previously undetected vulnerabilities — tracked in the industry as “zero-days” — and make them available to clients for use in surveillance.

“If governments ever had a monopoly on the most sophisticated capabilities, that era is certainly over,” the researchers wrote, noting that 20 of the 25 in-the-wild zero-days Google TAG discovered in 2023 were exploited by commercial spyware vendors.

Tuesday’s report welcomed efforts by the U.S. government to crack down on such vendors — including a 2023 executive order limiting U.S. government use of spyware and sanctions against key vendors — but said more could be done to regulate an industry implicated in widespread human rights abuses.

The report recommends that the U.S. government share more information about the implementation of its efforts thus far, as well as “setting heightened transparency requirements for the domestic surveillance industry, and setting an example to other governments by reviewing and disclosing its own historical use of these tools.”

The researchers also called on the U.S. government to impose “further sanctions to limit spyware vendors’ ability to operate in the U.S. and receive U.S. investment. The harms from this industry are amply evident by this point, and we believe they outweigh any benefit to continued use.”

On Monday, the U.S. State Department announced it would begin denying visas for people seeking to travel to the U.S. who have been implicated in the misuse of commercial spyware. But the practical effect of the policy is not clear, and an anonymous administration official told reporters the move represents “an important signal to those involved in this industry.”

Despite a litany of government, NGO and journalistic reports in recent years documenting how commercial spyware firms have sold surveillance capabilities to governments that have gone on to use them against dissidents, opposition politicians and journalists, the industry’s key players continue to be implicated in human rights abuses.

Last week, for instance, Human Rights Watch reported that two of its staffers in Jordan, along with devices connected to at least 33 Jordanian and Jordan-based journalists, activists, and politicians, were targeted with NSO Group’s Pegasus spyware between 2019 and 2023.

Among the case studies included in Tuesday’s report is Carlos Dada, the co-founder and director of Salvadoran investigative news outlet El Faro. Dada’s phone and those belonging to 21 of his colleagues were infected with Pegasus by an unknown government client between June 2020 and November 2021, according to a Citizen Lab analysis.

Suspicion immediately fell to the government of El Salvador, led by President Nayib Bukele. El Faro staffers sued NSO Group in U.S. federal court in December 2022, demanding to know who the client was. That case is currently working its way through federal court in the Northern District of California.

The Bukele government has denied any connection to NSO Group or the Pegasus spyware. Bukele easily won reelection earlier this week.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems