Unregulated Spyware’s Threat to National Security

Commercial spyware is a dual-use technology: it can theoretically be an essential last-resort tool for the most critical national security and law enforcement investigations, but it carries profound risk of abuse. Criticisms of spyware proliferation have focused primarily on its human rights violations, such as its abusive deployment against journalists, activists, and others merely exercising their freedom of expression and assembly. But like every dual-use technology – drones, small arms, nuclear materials, or biological agents – the proliferation of spyware poses a national security threat to the United States and its allies and partners unless the international community develops and enforces firm regulations and export controls governing their development and sale.

In the past, if a government sought to acquire the capabilities of modern commercial spyware, it would have to cultivate the requisite talent base, recruit scores if not hundreds of government hackers from this community, and maintain that workforce indefinitely.¹ Today, that workforce can be centralized in a single company headquartered abroad, exporting to dozens of client governments with little regard for how the tools sold are used. The result is as if the Manhattan Project were undertaken by a corporate R&D department in a faraway land and the spread of nuclear weapons was driven not by generals and spy chiefs, but shareholders and c-suites.

This status quo is dangerous and unsustainable. When cybersecurity researchers discover a vulnerability in a widely used device or application, they have a financial incentive – and, many would argue, a moral duty – to report that vulnerability to the developer – a process known as a “bug bounty.” However, the emergence of the commercial spyware industry creates a perverse incentive for researchers to sell or use their discovery to help develop hacking tools instead, which not only harms the targets of these hacking tools, but systemically puts all users of the underlying vulnerable technology at risk.

This paper lays out known instances when the spyware industry has presented a direct criminal, counterintelligence, and national security threat to the United States, supported by forensic evidence, press reporting, and even testimony of mercenary hackers turned FBI informants. If spyware is a necessary evil to protect national security interests, more work needs to be done to rein in unacceptable behavior and rebalance the incentives and equities involved.

Spyware Striking the United States

Below is a noncomprehensive list of known cases of foreign commercial spyware being deployed on American soil, on American citizens, and on American government officials. This list features cases of spyware breaches where the program has been developed by private companies and launched under the aegis of a foreign government. It excludes hacking incidents that could be attributed to tools developed internally by a foreign government agency, or tools deployed by a private party without government involvement – these are outside the scope of this report.

The lack of transparency or centralized reporting makes it likely that there have been more commercial spyware operations detrimental to American national security than we know of. Spyware companies like NSO Group claim not to keep tabs on whom their customers target using their products;² while that assertion may strain credulity, we can at least infer they do not do for the purposes of firing abusive customers, which has historically only resulted from outside revelations and contingent political pressure. Spyware customers – foreign governments – are effectively left to hold themselves accountable, which in practice means little to nothing.

Surveilling Michelle Obama

In 2015, First Lady Michelle Obama’s staff were organizing the itinerary for a stop in Qatar as part of a weeklong trip to the Middle East.³ Her time in Qatar would include a visit to Al Udeid Air Base, home to 10,000 American troops, and a speech at a summit organized by the Qatar Foundation and its chair, Sheikha Moza bint Nasser – the mother of the country’s ruling Emir.

Unbeknownst to the First Lady, her extensive coordination with Sheikha Moza was swept up by a company called CyberPoint, which had hacked and been surveilling the royal consort at the behest of the Gulf state’s nearby rival, the United Arab Emirates. More shocking still: CyberPoint was an American company, staffed predominantly with former NSA hackers, ostensibly contracting with the permission of the US State Department. Surveilling the First Lady – if only incidentally – sufficed to convince at least one ex-NSA analyst on the team that his mission had strayed so far from preserving national security as to be unrecognizable.

Surveilling the First Lady – if only incidentally – sufficed to convince at least one ex-NSA analyst on the team that his mission had strayed so far from preserving national security as to be unrecognizable.

The most outrageous details of the case have also made it easiest to remedy. CyberPoint’s contract with the UAE led to an FBI investigation that culminated in the deferred prosecution of three American contractors.⁴ Congress went on to ban American spies from working as mercenaries for foreign governments for 30 months after leaving civil service⁵ – a significant first step to stemming the tide of proliferation. While CyberPoint still exists, it is no longer reported to take on offensive operation contracts; its contract with the Emirati government was supplanted by the native Emirati firm DarkMatter.

Jamal Khashoggi, The Washington Post, and Jeff Bezos

When Washington Post columnist and Virginia resident Jamal Khashoggi was murdered, media reporting broadly framed the event as the assassination of a Saudi journalist/critic at the hands of his own government. The American public understood it as an appalling human rights violation, but with little clear or direct link to the United States or its interests.⁶

But Khashoggi’s surveillance and assassination absolutely ran roughshod over American institutions and interests, and spyware played an integral role in the killing – more than many observers realize.⁷ Jeff Bezos, who bought the Washington Post in 2013,⁸ was also allegedly hacked with spyware sent directly by Saudi Crown Prince Mohammed bin Salman (also known as MBS) five months before Khashoggi’s killing.⁹

Bezos and the Crown Prince had been casually conversing via WhatsApp before MBS, unsolicited, sent an unusually large video file,¹⁰ after which the data egressing Bezos’s phone skyrocketed by 29,000%. The data egress – circumstantial evidence of exfiltration by some hacker – combined with further advanced forensic analysis led investigators to conclude with high confidence that MBS’s suspicious video attachment was, in fact, infected with malware that caused the security breach.

Bezos and the Crown Prince had been casually conversing via WhatsApp before MBS, unsolicited, sent an unusually large video file,  after which the data egressing Bezos’s phone skyrocketed by 29,000%.

Bezos and his seasoned security consultant, Gavin De Becker, concluded that the hacking of his phone was linked to a story in the National Enquirer revealing that Bezos had been having an affair with television anchor Lauren Sanchez.¹¹ The story, published eight months after Bezos’s phone was allegedly infected (and three months after Khashoggi was killed), featured private text messages between Bezos and Sanchez.¹²

Although the National Enquirer publicly and vehemently claimed that its source was instead Sanchez’s brother, the Wall Street Journal reported that the tabloid was already investigating the affair when it contacted him.¹³ Coinciding with the circumstantial evidence of the hack is the National Enquirer’s indecorously cozy relationships with President Donald Trump¹⁴ and MBS¹⁵ – both with longstanding and well-documented grudges against the Washington Post and, by extension, Bezos.

Bezos was not hacked because he is rich; he was hacked because he owns one of the most influential newspapers in America. A foreign autocrat hacking and blackmailing an American newspaper owner for the paper’s critical coverage of his regime is a brazen assault on the national security interests of the United States, as well as its institutions and principles.

Ben Hubbard and the New York Times

Ben Hubbard, then the Beirut bureau chief at the New York Times, was also targeted with Pegasus by the Saudi government.¹⁶

Hubbard, a US citizen,¹⁷ was targeted twice in 2018 with malicious links sent via text and WhatsApp but avoided infection by not clicking on them.¹⁸ In 2020 and 2021, Hubbard was probed again – this time, with more powerful and insidious “zero-click” spyware, infecting his phone without him clicking any link or taking any direct action.

In 2020 and 2021, Hubbard was probed again – this time, with more powerful and insidious “zero-click” spyware, infecting his phone without him clicking any link or taking any direct action.

Hubbard’s hacking gives lie to NSO Group’s claim that Pegasus cannot be wielded against “US targets.”¹⁹ Pegasus may be unable to target US +1 country code phone numbers, but it lacks the digital code or human oversight to prevent it from being deployed against American citizens with foreign phone numbers like Hubbard, who was residing in Lebanon.

Hubbard was abroad, using a non-US phone number, and working as a journalist when he was hacked with Israeli technology by a Saudi operator. This shows that our national security protection against spyware is only as solid as foreign players allow it to be: in practice, not solid at all.

Spyware Infecting US Personnel in Africa

The impacts of spyware proliferation have been felt around the world, including in sub-Saharan Africa. Here, as in the UAE, the United States has enabled the problem, with the CIA paying for Djibouti to acquire Pegasus the same year Jamal Khashoggi was murdered.²⁰ This deal was brokered despite fact that the Horn of Africa country of about one million is ruled by a hereditary dictatorship with a well-documented history of human rights abuses,²¹ including arbitrary detention and torture of government critics.

The proliferation of Pegasus in Africa has also spread 1000 miles southwest to Uganda, an authoritarian state.²² In Uganda, Pegasus has boomeranged to infect 11 iPhones belonging to officials at the US Embassy in Kampala using non-US phone numbers, like Ben Hubbard’s.²³

Next door in Rwanda, the government has used or considered using Pegasus to target over 3,500 journalists, politicians, and members of civil society, according to the Pegasus Project.²⁴ Victims of Rwanda’s Pegasus operations include Carine Kanimba, the American²⁵ daughter of Paul Rusesabagina, the Rwandan hotel manager who sheltered over a thousand refugees during the 1994 Rwandan genocide.

In total, the White House has determined that at least 50 US government employees in ten countries have been infected by commercial spyware.²⁶ Unlike civilian victims of spyware, US government employees cannot bring their devices to forensic investigators like Amnesty Tech or Citizen Lab because their devices contain government-classified information, meaning the total number of US government devices infected could well be even higher. But even the conservative estimate of 50 government victims should suffice to prompt the US to take its foot off the gas spreading spyware, like in Djibouti, if not resolutely slam the brakes.

El Salvador and El Faro

El Salvador illustrates the paradox of spyware and the need for better regulation and protection. Ravaged for decades by gang violence, few countries arguably have a greater need to equip law enforcement with cutting edge technology like spyware. However, while it is likely spyware has been justifiably deployed to combat gangs like MS-13, it has still inexcusably ensnared innocent Salvadorans and even Americans.

Since 2019, El Salvador has been ruled by President Nayib Bukele, who has called himself “the coolest dictator in the world.”²⁷ He has made El Salvador the first country to establish Bitcoin as legal tender and spearheaded a crackdown that has arrested over 65,000 suspected gang members – often without charge.²⁸ The most evocative recurring images of his presidency are of Bitcoin ATMs lining the streets and suspected gangsters herded half-naked on prison floors like livestock.²⁹

He is popular and feared. Bukele’s bare-knuckled approach to murderous gangs like MS-13 have netted him approval ratings over 75% and as high as 91%³⁰ – the highest in Latin America. He betrays no reticence as foreign leaders raise the alarm over his human rights abuses and assaults on the country’s courts and legislature. Instead, he contrasts this criticism with his soaring approval ratings and revered status in the global crypto community to fashion himself as an iconoclast and visionary, carrying El Salvador from corruption and anarchy to futuristic prosperity.

Although Bukele relishes the limelight, his relationships with journalists quickly sour once they become adversarial. One dauntless Salvadoran online newspaper that has especially piqued Bukele’s ire is El Faro. After publishing one critical story of Bukele’s gang policies, the president announced an investigation into El Faro for money laundering.

Bukele employed Pegasus in his campaign to surveil and intimidate El Faro, including a 26-year-old journalist from Indiana named Roman Gressier.³¹ was hacked shortly after publishing an article about the US State Department labeling a senior Bukele cabinet minister as corrupt. He was then hacked three more times over the span of about a month.

Gressier is a dual US and French citizen who became fluent in Spanish as a young Mormon missionary to Hispanic immigrants in Washington state. Before even knowing he was hacked, Gressier was sensitive to the threat of spyware and possible blackmail – he was openly bisexual to close friends and coworkers, but he avoided making this public due to anti-LGBTQ stigma in El Salvador.

After a pair of Salvadoran journalists at El Faro and GatoEncerrado discovered their strangely malfunctioning smartphones had, in fact, been hacked with Pegasus, El Faro held an emergency meeting. The newspaper agreed to have all employees’ devices forensically analyzed – ultimately discovering almost the entire organization had been infected. The journalists’ sources felt their trust had been betrayed, and many of the hacking victims have since fled the country.

The story of Gressier’s hacking is sadly familiar, but how he has responded to it is historic. In November 2022, Roman Gressier, 15 of his El Faro colleagues, and the Knight First Amendment Institute filed a lawsuit against NSO Group in US federal court for violating the 1986 Computer Fraud and Abuse Act³² – the first time an American victim of Pegasus has sued NSO Group in US court.³³ The legal case adds to the crescendo of pressure to hold NSO Group and its investors accountable for the company’s malfeasance.

Hacking a Journalist’s Son

Mexico has been a prodigious user of spyware. To NSO Group, Mexico has been a Pegasus success story – although the company categorically refuses to name its client governments, it has claimed its spyware was instrumental in the 2016 capture of the infamous Mexican drug lord El Chapo.³⁴

But Mexico has used Pegasus to track more than just drug cartels. Carmen Aristegui, an indefatigable journalist, also drew the disdain of the Mexican government for her critical coverage of Enrique Peña Nieto, Mexico’s president from 2012 to 2018. Her website, Aristegui Noticias, reported in 2014 that Peña Nieto’s wife purchased a home from a contractor close to the president worth $7 million – far outside her family’s budget.

Aristegui’s report of the real estate deal was impactful – the first lady was forced to give up the home, which became popularly known as the Casa Blanca, and the president issued a public apology. But in the aftermath, Aristegui’s office was burglarized, she faced multiple lawsuits, and the Mexican government used Pegasus not only to hack and surveil Aristegui, but her 16-year-old son Emilio – while he was on American soil.³⁵

Even as norms against using spyware against civilians have eroded, using it to hack a child remains viscerally shocking. “What did they want to know about my son, Emilio? Why did the government… want to know about the friendships, the communication my son had, his photos, what he does, what he says in real time?” Carmen said. Perhaps Carmen, as a journalist, may have spoken to someone of interest to Mexican law enforcement, like a member of a drug cartel. Hacking her teenage son, however, serves no apparent purpose but to heighten surveillance on Carmen herself – to effectively treat her journalism as criminal activity.

According to Citizen Lab, Emilio received at least 21 messages with links to infect his phone with Pegasus.³⁶ The texts used a variety of methods to manipulate Emilio into clicking the infected links, including impersonating the US Embassy in Mexico. It is worth noting that while he may not have been using an American phone number, Emilio was residing in Massachusetts while he was being targeted. Besides being morally repugnant, the hacking of Emilio on American soil violates the US Computer Fraud and Abuse Act; impersonating the US Embassy to do so is also a crime.³⁷

Spyware Proliferation: The Paradox

Is spyware worth the cost? Spyware companies like NSO Group are steadfast that their products are crucial tools for government agencies around the world to investigate serious crime and prevent terrorism. The capture of El Chapo shows that it can be a powerful tool to go after violent and lawless organizations. But it can just as easily go after the innocent as well. Journalists, civil society, and some government bodies have chronicled spyware industry abuses ranging for human rights violations to criminal activity and even threats against national security for the United States and NATO. The unregulated spyware industry is in desperate need of regulation.