Foreign abusers of commercial spyware hit with new visa restrictions

Commercial spyware is a national-security threat, White House officials said Monday, announcing visa restrictions on foreign actors who misuse it against U.S. citizens.

Such software, which can include things like keyloggers, location trackers, can help adversaries obtain personal data from citizens, government workers and even U.S. service personnel, a senior Biden administration official told reporters.

“We've been very clear that it also relates to what we view as counterintelligence and security risks for American citizens as well as U.S. government personnel,” the official said, pointing to a March 2023 executive order that prohibits U.S. government use of commercial spyware. 

“At the time, we made clear publicly that we were tracking over 50 U.S. government personnel…in over 10 countries on three continents that had been targeted by commercial spyware. So for us, this is another step, another policy that we are initiating, that will help ensure accountability and is intended ultimately to both shake this ecosystem, but also better protect U.S. government personnel, including our servicemembers,” the official said. 

There likely are far more than 50 Americans who have been targeted by this kind of spyware, given how difficult it is to detect, the official said.

The new restrictions will apply “to individuals who've been involved in the misuse of commercial spyware to target individuals, including journalists, activists, perceived as dissidents, members of marginalized marginalized communities.”

The announcement comes at a time when more and more autocratic states are relying on such tools, and particularly the Pegasus software from Israel’s NSO group, to surveil dissidents, journalists, human rights groups, and other targets. Pegasus may have played a role in the death of journalist Jamal Khashoggi; a 2021 forensic inspection determined that people from the UAE had installed it on his wife’s phone, enabling tracking. 

While people from the UAE, Saudi Arabia, and many other states must obtain a visa to enter the United States, Israelis do not. 

“This visa restriction policy is global and can apply to citizens of any country. Individuals potentially subject to visa restrictions under the policy may be notified that they are no longer eligible for the Visa Waiver Program (VWP) and may need to apply for a visa at the nearest U.S. embassy or consulate before traveling to the United States,” the White House said in a statement.  

The official said that the new restrictions should “serve as a signal to those that may be seeking, moving forward, to either misuse the tool or that are involved in furnishing tools to those governments that may misuse them. So I think I would do this also as an important signal to those involved in this industry.”