Senator asks US government watchdog to review how feds use hacking tools

Democratic senator Ron Wyden is asking the U.S. government to review how federal law enforcement agencies use hacking tools and spyware against Americans, citing a lack of transparency into how often or for what reasons these tools are deployed.  

On Friday, Wyden sent a letter to the U.S. Government Accountability Office (GAO), which audits the federal government, requesting it to launch a comprehensive inquiry into how the FBI, the Drug Enforcement Administration, ICE’s Homeland Security Investigations, and the Secret Service employ hacking and spyware in their investigations.

In the letter, shared with TechCrunch, Wyden wrote that while these tools have been used for more than two decades, “there exists little public information regarding its scope, frequency, or operational safeguards.”

Wyden said that, unlike wiretaps and pen registers, which allow authorities to see when a call is placed and to whom, the government “does not publish annual reports for hacking operations.” For that reason, Wyden requested GAO to publish an unclassified report with its findings and recommendations. 

Federal agents have used hacking tools and spyware several times over the years, but as Wyden noted in the letter, the U.S. Department of Justice and the FBI “have repeatedly ignored congressional requests for greater transparency across multiple administrations.”

Wyden is making several requests to the GAO: 

• Investigate whether agents abused hacking tools and spyware for unauthorized or personal purposes, and to check what technical and oversight measures are in place to control and prevent misuse;
• Review how agencies “acquire, store, and secure” these tools to avoid dangerous leaks, as well as whether they submit them to a program designed to determine if the U.S. government should report security flaws to help tech companies fix them;
• And, assess how the feds inform courts when requesting warrants for the use of these tools, and whether they disclose the risk of affecting unknown or innocent targets.

To highlight the risks around the acquisition of hacking tools, Wyden specifically mentioned the case of Peter Williams, a former executive at the defense contractor L3Harris, who stole and sold advanced hacking tools to a Russian broker. The tools ended up being used by Russian spies against Ukraine, and Chinese cybercriminals against cryptocurrency owners. 

The earliest documented case of the FBI using spyware goes back to 1999. During an investigation for illegal gambling and loan sharking, federal agents discovered that Philadelphia mobster Nicodemo S. Scarfo used the program Pretty Good Privacy (PGP) to encrypt a file on his computer, which they believed contained key evidence.

To access it, the FBI installed a rudimentary malware designed to record the keystrokes on Scarfo’s computer, which allowed them to decrypt the file.