US Senator Calls for a Review of How Intelligence Agencies Use Hacking Tools

Democratic Senator Ron Wyden has asked the US Government Accountability Office (GAO), which audits federal agencies, to launch a comprehensive review of how law enforcement uses hacking tools and spyware against the country's citizens. The letter was sent on Friday and shared with TechCrunch.

In the senator's sights are the FBI, the Drug Enforcement Administration (DEA), ICE's investigative arm (HSI) and the Secret Service. According to Wyden, these tools have been in use for more than two decades, yet “there is almost no public information about their scale, how often they are deployed, or the safeguards involved.”

The senator stresses the contrast with wiretaps and pen registers: agencies are required to report on those methods, whereas for hacking operations the government “publishes no annual reports.” Wyden therefore asks the GAO to prepare an unclassified report with findings and recommendations. In his words, the Justice Department and the FBI have “repeatedly ignored requests from Congress for greater transparency” across different administrations.

Three Key Questions

The senator asks the auditors to determine several things at once. First, whether agents have abused such tools for personal or unauthorized purposes, and what technical and oversight mechanisms prevent such use. Second, how the agencies “acquire, store and protect” these tools to avoid dangerous leaks, and whether they submit them to the program that decides whether manufacturers should be told about discovered vulnerabilities. Third, how honestly the agencies inform the courts when requesting warrants — in particular, whether they disclose the risk of affecting unknown or innocent people.

Wyden illustrated the danger of unchecked procurement of such tools with the story of Peter Williams, a former executive at the defense contractor L3Harris. Williams stole and sold advanced hacking tools to a Russian broker. According to the letter, they ultimately ended up in the hands of Russian intelligence services, which used them against Ukraine, and of Chinese cybercriminals hunting for cryptocurrency holders.

A Practice Dating Back to the Last Century

The earliest documented case of the FBI using spyware dates to 1999. While investigating a case involving illegal gambling and loan-sharking, agents discovered that Philadelphia mobster Nicodemo Scarfo had encrypted an important file with PGP. To gain access to it, the FBI installed a primitive piece of malware that recorded keystrokes — and that made it possible to decrypt the data.

Source: TechCrunch