Congress takes aggressive stance against foreign spyware

Congress is seeking to ramp up U.S. defenses against the evolving threat of foreign spyware following recent incidents exposing its use on government officials, journalists and dissidents.

Last week, the House Intelligence Committee passed the Intelligence Authorization Act, which included a provision authorizing the Director of National Intelligence to prohibit the U.S. intelligence community from buying and using foreign spyware. 

The bill would also allow the president to impose sanctions on foreign government officials and firms that target U.S. officials with spyware.  

At a Wednesday hearing, Intelligence Chairman Adam Schiff (D-Calif.) shined a light on foreign government use of the Pegasus spyware, which was developed and sold by the Israeli company NSO Group, to monitor domestic and foreign officials, journalists, human rights activists and political opponents.

“This spyware could be used against every member of this committee, every employee of the executive branch, every journalist or political activist,” Schiff said. 

“And aside from periodically updating the software on our devices, there’s little you can currently do to protect yourself from being targeted and compromised,” he added.

Schiff also mentioned how a group of news organizations and researchers working last year for the Pegasus Project, which investigated how and where the spyware was deployed, uncovered rampant use by countries around the world, including Mexico, Saudi Arabia, India, Poland and Hungary. 

The project also released a leaked list of more than 50,000 phone numbers of individuals targeted by governments using the spyware tool. 

“Since that disclosure, a steady stream of disturbing reports has revealed that thousands of journalists, civil society activists, and many others have had their devices compromised by NSO’s tools,” Schiff said.

U.S. officials, including diplomats, have reportedly numbered among the victims of the spyware. 

Late last year, Reuters reported that at least nine State Department officials based in Uganda were hacked by an unknown attacker using Pegasus. Sources told Reuters at the time that the hacks took place over several months. 

Although the Israeli spyware cannot penetrate phones with U.S. numbers, the hacker was able to get inside the State Department officials’ phones because they were registered with foreign ones

U.S. allies have also been a target of the spyware. In April, it was reported that U.K. Prime Minister Boris Johnson’s office was the target of multiple malware attacks between 2020 and 2021. Although researchers investigating the hacks were unable to identify specific individuals, they linked the attacks to the United Arab Emirates.

This week, a top European Union lawmaker said his phone was likely compromised by Pegasus.

In a letter obtained by Reuters, EU Justice Commissioner Didier Reynders said that Apple informed him last year that his phone had likely been hacked using the Israeli spyware. 

The potential hack prompted an investigation of Reydner’s devices as well as phones belonging to other EU…