Wyden requests GAO inquiry into federal spyware and hacking tools
Democratic Senator Ron Wyden has asked the U.S. Government Accountability Office (GAO) to conduct a comprehensive review of how federal law enforcement agencies use hacking tools and spyware against Americans. His request covers the FBI, the Drug Enforcement Administration, ICE’s Homeland Security Investigations and the Secret Service.
In a letter sent on Friday, Wyden asked the federal watchdog to produce an unclassified report containing its findings and recommendations. He said agencies have used such tools for more than two decades, but that the public has little information about their scope, frequency or operational safeguards.
A request for visibility and controls
Wyden contrasted hacking operations with wiretaps and pen registers, for which authorities provide annual reporting. Pen registers can show when a call is made and to whom, while hacking tools can enable deeper access to a targeted device. The government does not publish annual reports on hacking operations, he wrote.
The senator said the Department of Justice and the FBI have repeatedly ignored congressional requests for greater transparency across multiple administrations. The GAO, which audits the federal government, is being asked to assess both the use of the tools and the controls intended to prevent misuse.
What the proposed review would examine
Wyden asked the GAO to investigate whether agents have abused hacking tools or spyware for unauthorised or personal purposes. The inquiry would also examine the technical and oversight measures agencies use to control access and prevent misuse.
Another requested area is how agencies acquire, store and secure these capabilities, including whether their handling creates a risk of dangerous leaks. Wyden also asked whether agencies submit relevant security flaws to the government process that determines when vulnerabilities should be reported so technology companies can fix them.
The proposed review would further assess how agencies inform courts when seeking warrants to deploy hacking tools. In particular, it would consider whether warrant applications disclose the risk that unknown or innocent targets could be affected.
Past cases illustrate the stakes
Wyden pointed to the case of Peter Williams, a former executive at defense contractor L3Harris, who stole and sold advanced hacking tools to a Russian broker. The tools were later used by Russian spies against Ukraine and by Chinese cybercriminals targeting cryptocurrency owners.
The earliest documented FBI spyware deployment dates to 1999. In an investigation into illegal gambling and loan sharking, agents found that Philadelphia mobster Nicodemo S. Scarfo used Pretty Good Privacy (PGP) to encrypt a computer file. The FBI installed rudimentary malware that recorded keystrokes, allowing agents to decrypt the file.
For businesses, the requested GAO review highlights why endpoint protection, encryption and disciplined vulnerability management remain practical priorities when powerful intrusion capabilities can be acquired, leaked or used in investigations.