U.S. expands anti-spyware coalition, but questions linger about strategy

A version of this story appeared in the daily Threat Status newsletter from The Washington Times. Click here to receive Threat Status delivered directly to your inbox each weekday.

The Biden administration said Monday that six nations are joining its push to restrict commercial spyware tools, but questions persist about the speed and effectiveness of the U.S. government’s approach to fighting cyberespionage.

Finland, Germany, Ireland, Japan, Poland and South Korea are the six additions to a group now totaling 17 countries agreeing to counter the development and spread of commercial spyware tools. Spyware is malicious software that enables hackers to spy on people via their devices.

“Our efforts will allow us to work collectively for the first time as we develop and implement policies to discourage the misuse of commercial spyware and encourage the development and implementation of responsible use principles that are consistent with respect for universal human rights, the rule of law and civil rights and civil liberties,” says the statement of the 17 nations shared by the White House.

The statement was first issued in March 2023, signed by the U.S. and a core group of allies.

President Biden also signed an executive order in March 2023 that the White House said prohibited the U.S. government’s use of commercial spyware that poses risks to national security or has been misused by foreigners.

Some critics say the Biden administration’s actions are long overdue.

The Atlantic Council’s Rose Jackson said Friday that the U.S. had not adequately addressed its role in the proliferation of spyware tools when she worked in the Obama administration, and when Mr. Biden was vice president.

Speaking at an Atlantic Council event on spyware, Ms. Jackson recounted seeing unregulated technology companies working with some of the most repressive regimes in Africa — and “no one cared.”

“The reason it made me even angrier was that they were almost entirely European, American, or Israeli — not a single one of them was Chinese or from an authoritarian country,” Ms. Jackson said. “Every single one of the worst [companies] were sitting in democracies.”

Effective hacking equipment used by China, which is harder to track, spilled out into the news in an unexpected fashion last month, following the unprecedented leak online of a top Chinese contractor’s hacking tools and internal corporate communications.

A collection of documents, images, and messages from the Chinese government-affiliated security contractor I-Soon became visible on the GitHub software development platform.

The rare glimpse provided cybersecurity analysts with an unprecedented peek at China’s tools. Security company SentinelOne said I-Soon appeared to be responsible for compromising at least 14 governments, NATO, universities and pro-democracy organizations in Hong Kong.

Whether the Biden administration’s coalition of nations voluntarily agreeing to do their part to slow the spread of spyware diminished any adversary’s operations is unclear.

The number of U.S. government personnel suspected of being victimized by spyware tools has grown since the allied nations’ statement on spyware was first published last year, the White House’s National Security Council told CNN.

The anti-spyware coalition includes promises to thwart exports of spying tools to people likely to use them for illegal hacking, to improve information sharing, and to work with private industry and other groups.

The private sector has scored some victories against commercial spyware vendors. Last month, the U.S. District Court for the Northern District of California directed NSO Group to share full details of its spyware with Meta as part of the Big Tech company’s legal battle with the Israeli spyware vendor.

Judge Phyllis J. Hamilton told NSO Group officials they “must produce information concerning the full functionality of the relevant spyware,” but added that the spyware vendor did not need to disclose its clients to Meta.

The judge’s decision was cheered by rights groups who have warned about government abuses enabled by spyware, including at Amnesty International.