US announces new restrictions to curb global spyware industry
The US said it will impose global visa restrictions on individuals who have been involved in the misuse of commercial spyware, in a move that could affect major US allies including Israel, India, Jordan and Hungary.
The new policy, unveiled on Monday, underscores how the Biden administration continues to see the proliferation of weapons-grade commercial spyware – which has been used by governments around the world against hundreds of political dissidents, human rights advocates, journalists and lawyers – as a major threat to US national security and counterintelligence capabilities.
The move comes three years after the administration placed Israel’s NSO Group on a commerce department blacklist and issued an executive order prohibiting the US government’s own use of commercial spyware. Israeli companies lead the world in producing commercial spyware and the Biden administration’s tough stance on those companies has emerged as a diplomatic sore point between the two allies.
When it is successfully used against a target, spyware like NSO’s Pegasus can infiltrate any phone without a user knowing. Intelligence or other government agencies using a spyware like Pegasus can silently gain access to a mobile phone user’s photographs, phone conversations and texts, and messages shared via encrypted apps like WhatsApp and Signal. It can even be used as a remote listening device.
In a statement, Antony Blinken, the US secretary of state, said the misuse of commercial spyware has been linked to “arbitrary detentions, forced disappearances and extrajudicial killings in the most egregious of cases”.
It is not entirely clear what specific extrajudicial killing Blinken was referring to, but the Guardian and other media outlets have previously reported that close associates of the Saudi journalist Jamal Khashoggi had been targeted and hacked with Pegasus before his murder by Saudi agents inside the Saudi embassy in Istanbul in October 2018.
NSO has previously said its technology “was not associated in any way with the heinous murder of Jamal Khashoggi”.
For the US government, the proliferation of spyware – even when it is used by close allies – has for years been seen as a threat to security, especially against US government employees,like diplomats and intelligence officials who are stationed abroad. A senior administration official on Monday said that more than 50 US government personnel in 10 countries and 3 continents have been targeted by spyware in recent years.
In the constant cat-and-mouse game between spyware companies and those experts trying to stop the sophisticated technology from infecting phones, companies like Apple have notched up some victories. Researchers who study hacking have said that they have found evidence of individuals who use Apple’s “lockdown” security function of being targeted but not successfully infected by spyware.
Yet it remains a major issue, including in Jordan, where Access Now, an advocacy group, recently reported nearly three dozen cases of individuals who were targeted or hacked by Pegasus.
The state department said on Monday that the visa restrictions would also apply to individuals in countries that do not usually require a visa to enter the US, like EU countries and Israel. It is considered a “global” visa ban, so individuals who are potentially subject to the sanction would be notified that they are no longer eligible for visa-free travel and would need to apply for a visa at a US consulate if they are seeking to enter the US.
According to guidance issued by the state department, the ban will restrict entry for individuals believed to be involved in the misuse of commercial spyware “to target, arbitrarily or unlawfully surveil, harass, suppress, or intimidate individuals including journalists, activists, other persons perceived to be dissidents for their work, members of marginalized communities or vulnerable populations, or the family members of these targeted individuals”.
The visa ban will also affect individuals believed to facilitate or derive financial benefit from the misuse of commercial spyware and their immediate families. While the visa ban would not directly affect US financial firms or investors involved in the spyware industry, a senior administration official said that its actions would send an “important signal” about the risks associated with the industry.