Why the spyware order put the burden on acquisition staff

The week

On March 27, 2023, President Biden signed Executive Order 14093. It prohibits federal agencies from making operational use of commercial spyware that poses significant counterintelligence or security risks to the US government. The ban also covers spyware posing significant risks of improper use by a foreign government or person, including against activists, journalists or dissidents. The order listed factors for agencies to weigh. They included whether the spyware had been used against US government personnel, whether the vendor had ties to foreign governments that misuse such tools, and whether it had been used to facilitate human rights abuses. Agencies had to review existing uses and report to the national security adviser. Days later, at the second Summit for Democracy, the United States and a group of partner governments issued a joint statement on countering the misuse of commercial spyware.

Most coverage treated the order as foreign policy, which it was. It followed the Commerce Department’s November 2021 decision to add NSO Group and Candiru to the Entity List, and reports that US officials’ phones had been targeted with commercial spyware. The order’s mechanism, though, was acquisition. It did not regulate the global spyware market. It used the federal government’s weight as a buyer to deny revenue and legitimacy to vendors whose products posed risks. That put the work on agency counsel, security and contracting staff at three stages of the acquisition lifecycle: deciding what counts as covered spyware, assessing the vendor, and governing use after purchase.

Deciding what counts

The first challenge was scope. Surveillance and intrusion tools span a wide range. Lawful intercept equipment works through carriers under court order. Mobile forensic tools extract data from a device an investigator already holds. Network investigation techniques are deployed under warrant. Remote exploitation tools can compromise a phone without the owner’s knowledge. The order focused on software that gains remote access to a device and extracts information without the user’s consent. Agencies still had to decide which products in their portfolios fell inside it.

That decision could not rest with program offices alone, because they were the users with an interest in keeping the tools. A sound approach gave classification to a small group: the general counsel, the chief information security officer and the senior procurement executive. That group reviews any product with remote access or data extraction capability against the order’s definitions. It documents the conclusion and revisits it when the product or its vendor changes. Classification determines everything that follows, so it needs an owner with no stake in the answer.

Edge cases deserve written reasoning. A finding that a tool falls outside the order is as consequential as a finding that it falls inside, and both should be reviewable by an inspector general later.

Product changes are the hard part. A forensic tool that adds a remote collection module, or a vendor that acquires an exploit developer, can move a product across the line between one contract year and the next. Requiring vendors to notify the agency of material capability changes, and tying that notice to the classification review, keeps the determination current.

Assessing the vendor

The second stage was due diligence, and the order asked for something unusual. Standard vendor reviews look at price, performance, security and financial stability. The order’s factors required agencies to look at what a vendor had done with other customers. Had its tools been used against US personnel? Had foreign governments used them against journalists or activists? Did the vendor have ties to such governments?

Agencies are poorly placed to investigate that alone. The evidence often comes from intelligence reporting, academic researchers, civil society investigations and litigation abroad. The practical answer was shared determinations, coordinated through the national security process, so that agencies did not each form their own view of each vendor. A single determination applied across government is also fairer to vendors and harder to game.

Contracts carry the rest of the burden. Solicitations for sensitive surveillance capabilities can require disclosure of ownership, financing and corporate affiliates, including resellers and subsidiaries that may sell the same product under another name. They can require disclosure of foreign government customers in relevant categories and any known misuse findings. False or incomplete disclosure can be made grounds for termination. These clauses add friction for vendors and contracting officers. They also create a record that oversight bodies can later test.

Contracting officers need support to use these clauses well. Most have never weighed a human rights record or a counterintelligence assessment. A short playbook, a named contact in the agency’s security office and access to the shared determinations turn an unfamiliar requirement into a routine step.

Governing use after purchase

The third stage is the one most procurement processes neglect. A tool judged acceptable at award can become unacceptable later. A vendor may be sold, a new misuse finding may emerge, or the government may add the vendor to a sanctions or export control list. Agencies need to know where every sensitive surveillance tool is deployed, under which contract, with which licenses and accounts, so that a new determination can be applied everywhere at once.

That calls for a central register of covered and near-covered tools, held outside the program offices that use them. It should record deployment locations, authorizing officials and contract end dates. It also calls for contract terms that allow suspension or termination when the vendor’s status changes. Without them, agencies face a choice between breaching a contract and continuing to use a tool the government has decided is a risk.

Use itself needs governance. Logging of each operational use, review by an official outside the operating unit, and periodic reporting to the agency’s privacy and civil liberties officer give leaders evidence that the tool is used as approved. These controls cost operational speed. They are also what lets an inspector general verify compliance.

With hindsight

The policy broadened after 2023. In July 2023 the Commerce Department added Intellexa and Cytrox entities, linked to the Predator spyware, to the Entity List. In February 2024 the State Department announced a visa restriction policy for people involved in spyware misuse. The Treasury sanctioned Intellexa-linked individuals and entities in March and September 2024. The United Kingdom and France launched the Pall Mall Process in 2024 on the market for commercial intrusion tools. Enforcement through acquisition was harder to see from outside. One case became public: an ICE contract with Paragon Solutions, signed in September 2024, was put under a stop-work order that autumn for review against the order. Procurement records showed the stop-work order lifted at the end of August 2025, after Paragon’s sale to a US investor. The episode showed how much depends on who owns the post-award decision.