Senator Wyden Requests GAO Review of Federal Agencies' Hacking Tool Use

Call for Transparency on Hacking Tool Use

Senator Ron Wyden has formally requested that the U.S. Government Accountability Office (GAO) conduct a comprehensive review of how federal law enforcement agencies deploy hacking tools and spyware. This request, outlined in a letter sent to the GAO, highlights concerns about the lack of public information regarding the use of these surveillance technologies by agencies such as the FBI, the Drug Enforcement Administration (DEA), ICE’s Homeland Security Investigations, and the Secret Service.

Decades of Use, Limited Oversight

While federal agents have utilized hacking tools and spyware for over two decades, Wyden noted that there is minimal public data on their scope, frequency, or operational safeguards. Unlike traditional surveillance methods like wiretaps, hacking operations do not have annual public reporting requirements. This absence of transparency has led to repeated congressional requests for more information being ignored by the Department of Justice and the FBI across multiple administrations.

Key Areas of Investigation

Wyden's request to the GAO includes several specific areas for investigation. These include examining whether agents have misused hacking tools for unauthorized purposes, reviewing how agencies acquire, store, and secure these tools to prevent leaks, and assessing how courts are informed about the risks to unknown or innocent targets when warrants for these tools are requested. The GAO is also asked to determine if agencies submit these tools to a program that assesses whether security flaws should be reported to tech companies.

Risks of Acquisition Highlighted

To underscore the potential dangers associated with the acquisition of hacking tools, Wyden referenced the case of Peter Williams, a former L3Harris executive. Williams was involved in stealing and selling advanced hacking tools to a Russian broker, which were subsequently used by Russian spies against Ukraine and by Chinese cybercriminals against cryptocurrency owners. This incident serves as an example of the broader risks involved in the federal government's use and management of such technologies.