European Spyware Firms Threaten Digital Security and Privacy, U.S. Says

The Commerce Department said it was adding Intellexa, with corporate holdings in Greece and Ireland, and Cytrox, with holdings in Hungary and North Macedonia, to its entity list that generally bars U.S. firms from engaging in trade activity with them.

The action is the latest by the Biden administration to attempt to erect rules around the growing and lucrative spyware industry, where firms sell high-powered digital surveillance tools to law enforcement and intelligence agencies around the world that are able to surreptitiously infiltrate targeted smartphones and other devices. U.S. officials have said the proliferation of such tools can jeopardize U.S. national security and violate human rights.

“This rule reaffirms the protection of human rights worldwide as a fundamental U.S. foreign policy interest,” said Don Graves, deputy secretary at the Commerce Department. “The Entity List remains a powerful tool in our arsenal to prevent bad actors around the world from using American technology to reach their nefarious goals.”

Intellexa didn’t immediately respond to a request for comment. Cytrox couldn’t be reached.

While vendors of digital intrusion software say their tools are vital to track violent criminals and national security threats, Western governments and privacy advocates have said the tools are frequently abused by both authoritarian and democratic governments to target journalists, political opponents, human rights advocates and others not suspected of wrongdoing.

Reports of the growing use of hacking tools purchased from firms in Israel and elsewhere have fueled calls within Europe and in the U.S. to restrict their use. NSO Group, an Israeli technology company, was previously blacklisted by the Biden administration in 2021 along with three other vendors. That action and a raft of negative public attention harmed NSO Group’s business, and the firm recently assumed new ownership after lenders forced a change of control with plans to keep its controversial spyware business going, The Wall Street Journal reported in May.

Earlier this year, President Biden issued a first-of-its-kind executive order limiting the use of commercial spyware within the federal government, though it doesn’t outright prohibit its use, either for offensive purposes or testing. At the time, the administration also disclosed that it believed at least 50 U.S. personnel working overseas had been compromised by such spyware, a figure far higher than previous estimates.

Cybersecurity researchers at Citizen Lab at the University of Toronto have previously linked Cytrox to surveillance software called Predator, which was able to infect iPhones via single-click links sent over WhatsApp. The research group found Predator customers in a range of countries, including Armenia, Egypt, Greece, Indonesia and Saudi Arabia, and linked the tool to the hacking against an Egyptian political dissident.

Citizen Lab also concluded Cytrox was part of what it called the “Intellexa alliance,” an umbrella term for a set of spyware vendors that appeared to form around 2019.

Tuesday’s action follows a recent pledge from the U.S. and several allies to work collaboratively to curtail commercial spyware misuses.