US announces visa restriction policy targeting spyware abuses

The U.S. will restrict visas for people “involved in the misuse of commercial spyware,” Secretary of State Antony Blinken said Monday.

The new policy will be used against those “believed to facilitate or derive financial benefit from the misuse of commercial spyware” and who are involved in “developing, directing, or operationally controlling companies that furnish technologies such as commercial spyware to governments, or those acting on behalf of governments, that engage in activities.”

The restrictions can also be used against the spouses or children of those involved in the illicit sale of spyware as well. The policy will be issued under the Immigration and Nationality Act.

In a statement, Blinken said the U.S. “remains concerned with the growing misuse of commercial spyware around the world to facilitate repression, restrict the free flow of information, and enable human rights abuses.”

“The misuse of commercial spyware threatens privacy and freedoms of expression, peaceful assembly, and association. Such targeting has been linked to arbitrary detentions, forced disappearances, and extrajudicial killings in the most egregious of cases,” he said.

“Additionally, the misuse of these tools presents a security and counterintelligence threat to U.S. personnel. The United States stands on the side of human rights and fundamental freedoms and will continue to promote accountability for individuals involved in commercial spyware misuse.”

A senior administration official told reporters that the visa ban was related to a previous executive order issued in March 2023 that restricted U.S. government agencies from using commercial spyware that could pose security risks to the U.S. or already has been misused by foreign actors.

The administration official said Monday that they are still tracking a previously publicized campaign that involved more than 50 U.S. government workers in more than 10 countries being targeted with commercial spyware.

The official said the U.S. does not already have a list of people whose visas they would restrict and will handle it on a “case by case basis.”

They declined to answer questions about who would realistically be targeted by the restriction — whether engineers at a spyware company, board members or those involved directly in sales to governments. They also didn’t address if people selling spyware to U.S. allies would face similar restrictions.

When pressed, the official said they were unsure if the policy would apply to people from the European Union or Israel — both of which are home to dozens of spyware vendors but whose citizens do not need visas to enter the United States.

Last week, a civil rights group said three dozen journalists, human rights advocates and lawyers in Jordan — a staunch U.S. ally — were infected with the infamous Pegasus spyware. Several other close U.S. partners, including India, United Arab Emirates and Mexico, have recently been accused of using spyware to target political opponents and journalists.

Last year, Britain’s cyber agency revealed that more than 80 countries have purchased spyware over the past decade.

Blinken noted in his statement that the Department of Commerce previously sanctioned several commercial spyware companies “that enabled the abuse of sophisticated surveillance tools” and that the U.S. has worked with Australia, Canada, Costa Rica, Denmark, France, New Zealand, Norway, Sweden, Switzerland and the United Kingdom on efforts to counter the proliferation of spyware.

“This new visa restriction policy adds to the toolset that this administration is using to combat the growing misuse of commercial spyware that has facilitated repression, restricted the free flow of information and enabled human rights abuses,” a senior administration official said.

“This is part of an overall effort to ensure greater accountability for those that are either misusing these tools or those that are enabling the misuse of these tools. We view it as an important new step, as well as a signal to those that may be seeking to misuse or are facilitating the misuse by selling these tools.”

Travel to the U.S. is “an important element for those that are involved in this sector and that are involved in technology broadly,” they said, declining to answer questions about what tangible effect this could have on spyware vendors.