Loading story…
Sen. Ron Wyden and Rep. Greg Casar have asked the U.S. Government Accountability Office to investigate how federal agencies use hacking tools and spyware against Americans, seeking an unclassified public report on the scope, frequency, safeguards, and legal processes behind those operations. The request targets agencies including the FBI, DEA, ICE Homeland Security Investigations, and the Secret Service, and argues that federal law enforcement has used such capabilities for more than 25 years with far less transparency than exists for traditional wiretap authorities.
The lawmakers asked the GAO to examine how agencies acquire and secure hacking tools, whether government personnel have misused them, what is disclosed to courts when warrants are sought, and how Rule 41 authorities are used for court-approved hacking. The push comes amid broader scrutiny of U.S. government spyware practices, including ICE's acknowledged work with spyware firm Paragon, and follows concerns that stolen government hacking tools have previously been repurposed by foreign adversaries against Ukraine and cryptocurrency users.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Sen. Ron Wyden and Rep. Greg Casar sent a letter to the U.S. Government Accountability Office asking it to investigate how federal agencies use hacking tools and spyware against Americans and to produce a public, unclassified report. They asked the GAO to examine frequency of use, safeguards, procurement and protection of tools, possible misuse by personnel, and court disclosures including Rule 41 requests.
Wyden and Casar said federal law enforcement agencies have used hacking and spyware as investigative tools for more than 25 years, framing the long-running practice as lacking transparency and oversight.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Administrative Office of the U.S. Courts will begin publicly disclosing how often judges approve government use of hacking tools and spyware in lawful wiretap investigations, adding a new **"spyware/hacking"** category to its annual Wiretap Report. The change will first appear in the report covering 2028 activity, scheduled for publication in 2029, and will track use of **network investigative techniques (NITs)** for real-time interception of communications. The new reporting is expected to cover surveillance targeting calls and messages, including encrypted services such as **Signal** and **WhatsApp**, but it will not include remote device hacking used to collect stored data because those actions fall under separate search-warrant authorities. The move follows years of pressure from Senator **Ron Wyden** and has been welcomed by privacy groups including the **EFF** and **ACLU** as a long-sought transparency measure over government hacking practices that have reportedly been used by the FBI since at least 1998 without public accounting.
Aug 20, 2026
Sen. Ron Wyden and Rep. Shontel Brown asked the Government Accountability Office to investigate whether the Department of Transportation has failed for more than four decades to enforce airline passenger-data privacy protections. Their request cites allegations that Airlines Reporting Corporation, an airline-owned data broker, sold federal agencies access to roughly 722 million passenger travel records without warrants or court oversight, alongside reports of DEA traveler profiling and payments to airline employees for private passenger information. The lawmakers said DOT has not publicly brought privacy-enforcement cases or issued civil penalties despite major incidents affecting hundreds of millions of travelers. They also requested scrutiny of DOT's oversight model and coordination with the DEA, and asked GAO to determine the status, findings, and any enforcement outcomes from the department's March 2024 review of data-collection and use practices at the 10 largest U.S. airlines, whose responses and results have not been publicly released.
Aug 27, 2026
U.S. Immigration and Customs Enforcement confirmed to lawmakers that it bought and used Paragon Solutions spyware, including **Graphite**, in investigations tied to drug trafficking, fentanyl networks, and other organizations using encrypted communications. Acting ICE Director Todd Lyons said the deployment complied with constitutional requirements and the 2023 executive order restricting government use of commercial spyware, but House Democrats including **Rep. Summer Lee** said ICE had not provided enough documentation, safeguards, or oversight to justify such invasive surveillance. The disclosure followed the reactivation of ICE’s Paragon contract after an earlier suspension for review, and came amid wider controversy over reports linking Paragon spyware to targeting of journalists and activists. The admission intensified concerns that U.S. policy may be softening toward the commercial spyware industry even as evidence mounts that these vendors are driving serious cyber abuse. Reporting and research cited growing alarm over the lifting of sanctions on Intellexa executives, new U.S.-linked ownership of **NSO Group** and Paragon, and the expanding role of brokers, resellers, and other intermediaries that help spyware vendors evade export controls and obscure supply chains. Analysts also noted that Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-backed groups in 2025, while lawmakers pressed for briefings on federal spyware use and U.S. investment in firms long associated with abuses involving **Pegasus**, **Predator**, and related surveillance tools.
Jun 29, 2026