US President Joe Biden has signed an executive order that bars federal agencies from buying third-party commercial spyware like Pegasus that poses significant counterintelligence or security risks to the US government or significant risks of improper use by a foreign government or foreign person.
The order discourages the improper use of commercial spyware and encourages the development and implementation of responsible norms regarding the use of commercial spyware that are consistent with respect for the rule of law, human rights, and democratic norms and values.
The executive order will affect government spyware makers and vendors known to sell to authoritarian governments, including NSO Group, Cytrox and Candiru. Pegasus was already completely banned in the US and in 2021, the Department of Commerce added NSO, along with Candiru, to its Entity List, barring US companies from doing business with it.
The Biden statement said that commercial spyware may pose counterintelligence or security risks to the US government when a foreign government or foreign person has used or acquired the commercial spyware to gain or attempt to gain access to government computers or the computers of government personnel without authorisation.
The threat is when a foreign entity maintains, transfers, or uses data obtained from the commercial spyware without authorisation from the licensed end-user or the US government and has disclosed or intends to disclose information about the activities of the US government.
It poses national security risk if foreign governments "collect information on activists, academics, journalists, dissidents, political figures, or members of non-governmental organisations or marginalised communities in order to intimidate such persons; curb dissent or political opposition; otherwise limit freedoms of expression, peaceful assembly, or association; or enable other forms of human rights abuses or suppression of civil liberties", the Biden order read.