Nearly 100 nations have purchased advanced cellphone spyware

Advanced cellphone spyware is increasingly prevalent around the world. What started out as "science fiction" in James Bond movies is now being used by nearly 100 nations, US counterintelligence authorities report. This spyware, designed to infiltrate mobile devices, poses a growing threat as it becomes more accessible not just to governments but also to non-state actors, including criminal groups and ransomware operators.

Michael Casey, Head of the US National Counterintelligence and Security Center (NCSC), recently warned that many spyware tools are now "plug and play," making them easier for virtually anyone to deploy. According to Breaking Defense, he spoke at a webinar on January 14 put on by the Intelligence and National Security Alliance, pointing out that this market is transformative, particularly for countries without the resources to develop their own cyber capabilities. Spyware allows such states to achieve surveillance and intelligence-gathering capabilities that would otherwise take decades to build. 

For instance, the UK’s National Cyber Security Centre reported in April 2023 that over 80 countries had acquired spyware, and this number has now risen to nearly 100. The technology is not just being used for legitimate law enforcement purposes but is also being employed to target journalists, political dissidents, human rights activists, and foreign officials, often on a large scale, with thousands of individuals reportedly affected annually.

“I think what you see is an increasing number of countries investing in spyware, frankly, specifically targeted at cellphones and all that things we carry around with us and put information on,” said Casey. “Everyone knows about the NSO Group, but there are dozens of these companies.”

The Israeli company NSO Group, which developed the notorious Pegasus spyware, has drawn significant attention in this domain. Blacklisted by the US government in 2021, the company was accused of enabling foreign governments to use its spyware to target journalists, activists, academics, and even government officials. NSO Group has defended itself by stating that its technologies address international security threats and that it has terminated contracts when misuse was discovered. However, as Casey pointed out, NSO is only one of many players in a rapidly expanding and profitable spyware industry, which Casey describes as a “huge growth business.”

At the same time, US government agencies have also been utilizing similar surveillance capabilities. Media reports revealed that agencies like the Department of Homeland Security (DHS), Customs and Border Protection (CBP), and Immigration and Customs Enforcement (ICE) have been purchasing sensitive GPS location data from private companies, such as Venntel. This data is used to track and locate individuals within the United States, including for immigration enforcement. The practice raises ethical and legal concerns, as it involves the acquisition of personal location information without direct oversight or accountability.

Non-state actors are also leveraging this technology. The availability of advanced spyware to criminal and ransomware groups underscores the risks posed to individuals and institutions alike. As Casey noted, “whoever wants to use it and get on your phone” can now access these tools, highlighting the increasing commoditization of surveillance technology.

The widespread availability of spyware and its dual use by state and non-state actors underscores the blurred lines between national security and personal privacy. While companies like NSO Group argue that their technologies are essential for combating terrorism and other serious crimes, critics point to the misuse of such tools to suppress dissent and target vulnerable groups. The global proliferation of spyware reflects its profitability and the growing demand for digital surveillance tools, despite significant risks to privacy, civil liberties, and democratic accountability.

This burgeoning market represents a significant shift in the cyber landscape. It offers states and non-state actors unprecedented capabilities to conduct surveillance and cyber operations, often with little regard for international norms or individual rights. As the spyware industry grows, it amplifies threats to personal privacy and global security, with thousands of individuals targeted annually. For states with limited cyber expertise, commercial spyware provides a shortcut to advanced surveillance capabilities, transforming their ability to conduct intelligence operations. This trend raises urgent questions about regulation, accountability, and the balance between security and privacy in an increasingly interconnected world.

By Nazrin Sadigova