US, UK and France Pressure Commercial Spyware Industry

The United States ramped up pressure on the commercial surveillance industry shortly before the United Kingdom and France convened a summit intend to culminate in an international agreement limiting the proliferation of advanced spyware.

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

U.S. Secretary of State Antony Blinken on Monday announced a policy of limiting entry visas for individuals involved in the misuse of commercial spyware or who control the companies that furnish spyware to governments that deploy the apps to snoop on journalists, activists and dissidents. The limits also apply to close family members such as children and spouses.

Approximately two dozen countries including the United States assembled in the United Kingdom Tuesday for a two-day meeting initiating talks dubbed the Pall Mall Process that participants said will result in guidelines over the responsible deployment of commercial spyware. Participants include companies such as Google and Microsoft.

“Many of these tools and services can be used for legitimate purposes, but they should not be developed or used in ways that threaten the stability of cyberspace or human rights and fundamental freedoms,” participants affirmed. They plan on meeting again in France next year.

Google, which tracks the global commercial spyware industry, now estimates there are 40 global purveyors of commercial spyware – apps that record and transmit the activity on an infected smartphones, even devices that have the very latest operating system patches and security fixes (see: Dozens of Commercial Spyware Vendors at Work, Google Warns).

Human rights organizations have long highlighted that governments with authoritarian predispositions – including countries in Europe such as Poland and Hungary – have used spyware to surveil opposition groups despite claims from some vendors that they only sell their goods for use in combatting national security threats and crime.

In announcing the new visa restriction, the Department of State linked commercial surveillance to “arbitrary detentions, forced disappearances, and extrajudicial killings in the most egregious of cases.” President Joe Biden in March signed an executive order banning the federal government from buying licenses for spyware used by foreign governments to spy on dissident and has restricted exports to some spyware vendors (see: US Limits Government Use of Advanced Smartphone Spyware).

John Scott-Railton, a senior researcher at The Citizen Lab lauded the Biden administration decision. The “visa ban will be impactful because it follows the people. Prior efforts focused on spyware companies. Which is good. But spyware players play shell games with corporate identities. Now, no matter what your company name is this week, you still can’t go to Disneyworld,” Scott-Railton said.

Speaking at a closed-door Pall Mall Process event, U.K. Deputy Prime Minister Oliver Dowden said that threats from cyber intrusion tools have been made more challenging with the advancements in artificial intelligence.

“Thanks to rapid advances in technology – including AI – those weapons are becoming cheaper, more widespread, and easier to use,” Dowden said. “If we fail to act, this market will rapidly become a driver for much of the cyber threat we face.

Dowden also added private sector companies played a vital role in spyware intrusion. This included ensuring their products receive regular patches and mitigating suppky chain risks.

In addition to U.K. and France, other Pall Mall Process participants include the Republic of Cyprus, Greece and the Gulf Cooperation Council, a regional body – as well as Japan, Germany and Australia. Private sector participants additionally include Apple, BAE Systems, and Eset.