Why a lot of people are getting hacked with government spyware

For over a decade, manufacturers of government surveillance software have defended their products, claiming they are designed solely for monitoring serious criminals and terrorists. However, evidence collected from numerous incidents worldwide reveals that this justification is far from accurate. Journalists, human rights activists, and politicians have increasingly found themselves in the crosshairs of these technologies, both in authoritarian regimes and democracies alike. A recent high-profile case in Italy highlights this troubling trend. A political consultant affiliated with leftist parties became the latest confirmed victim of Paragon spyware, underscoring the widespread misuse of surveillance tools beyond their purported limited scope. "There's a misconception about who gets targeted by this kind of government spyware; being targeted doesn’t mean you’re a major threat," said Eva Galperin, the cybersecurity director at the Electronic Frontier Foundation. "In reality, targeting is so straightforward that governments often spy on a wide array of individuals, including minor political figures, activists, and journalists." Several factors contribute to the prevalence of spyware on devices belonging to individuals who theoretically shouldn’t be targets. One primary reason lies in the operational mechanics of these surveillance systems. Typically, when law enforcement or intelligence agencies acquire spyware, they pay a one-time fee based on the number of targets they can monitor simultaneously. This fee structure encourages some governments to purchase systems that allow them to surveil a large number of individuals. Leaked documents from the now-defunct Hacking Team revealed that some of their clients could monitor anywhere from a few individuals to an unlimited number of devices. While democratic nations generally have fewer targets to surveil, those with dubious human rights records often have broader surveillance capabilities. This disparity has led to an alarming trend where governments target a far wider audience than just criminals or terrorists. Countries such as Morocco, the UAE, and Saudi Arabia have previously been caught using spyware against journalists and activists. Security researcher Runa Sandvik, who assists at-risk journalists and activists, maintains an ever-growing list of spyware abuse cases globally. The ease of use of modern spyware, such as NSO’s Pegasus or Paragon’s Graphite, significantly amplifies this issue. Government officials merely need to input a phone number, and the rest unfolds seamlessly, increasing the likelihood of abuse. John Scott-Railton, a senior researcher at The Citizen Lab, emphasizes the risks associated with government spyware, describing it as a substantial threat to democracy. He notes that the lack of transparency and accountability allows governments to wield such invasive technologies without concern for repercussions. "The targeting of relatively minor figures is particularly alarming and reflects the impunity governments feel when deploying this invasive spyware," Galperin stated. There is, however, a glimmer of hope for accountability among victims. Paragon recently announced it would cut ties with the Italian government, citing the authorities' refusal to cooperate in investigating alleged abuses linked to its spyware. Similarly, NSO Group disclosed in court that it severed relationships with ten governments for misusing its technology, though it did not specify which nations were involved. Additionally, countries like Greece and Poland are initiating investigations into instances of spyware misuse. Under the Biden administration, the U.S. has imposed sanctions on several spyware companies, including Cytrox and NSO Group, as part of an effort to curb their influence. A coalition of mostly Western nations, led by the U.K. and France, is also seeking diplomatic solutions to mitigate the spyware market. Whether these actions will successfully limit the activities of this burgeoning multi-billion dollar industry remains to be seen, but the appetite for surveillance continues to grow among governments eager to spy on their citizens.