Top insights for IT pros
From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.
South Korea, Ireland, Japan, Germany, Poland, and Finland have joined the US and 10 other countries in an initiative to curb commercial spyware misuse. The international coalition aims to counter the “proliferation and misuse of commercial spyware,” according to a background press call at the White House on March 18.
In a joint statement, which was updated to include the six new signatories, the governments involved said they “recognize the threat posed by the misuse of commercial spyware and the need for strict domestic and international controls on the proliferation and use of such technology,” adding that “commercial spyware has been misused across the world by authoritarian regimes and in democracies.”
IT Brew caught up with Jake Williams, a faculty member at IANS Research—a Boston-based cybersecurity research and advisory firm—to chat about the implications of the joint statement and all things spyware.
First up, his thoughts on the coalition:
“Every government that joined into this pact is absolutely hacking other people’s diplomats,” the former NSA hacker told IT Brew. “Maybe they don’t call it spyware—they probably call it implants and backdoors, and whatever. But the reality is that commercial spyware—or that stuff they develop internally—that requires a lot of resourcing.”
When it comes to commercial spyware, what are some examples of the vulnerabilities we’re seeing?
One example “involved image rendering, a graphics rendering library, and iMessage,” Williams said, referring to the “actively exploited zero-click vulnerability” Citizen Lab discovered in 2023. Researchers at the Toronto-based interdisciplinary lab discovered that the vulnerability was “being used to deliver NSO Group’s Pegasus mercenary spyware.”
In terms of resources, Williams said NSO and other commercial vendors require a “constant influx of cash” and that “it’s not clear they can even survive without it.”
For the countries that have come together in this joint effort to combat commercial spyware misuse, Williams said they’re “removing their funding from it” so there’s essentially “nothing to buy” when the “authoritarian regimes show up.” “If these big governments don’t fund [the commercial vendors]—if the big spenders don’t spend on this stuff, it’s not clear that they can stay in the market,” he added.
Would you say commercial spyware is on the rise?
“That’s such a hard thing to measure, right? I would say the use of it is on the rise. The number of companies out there? That’s a hard thing to say,” he said. “There are more governments that are doing offensive cyber operations today than there were five years ago, without a doubt.”