Why the spyware order put the burden on acquisition staff

The week

On March 27, 2023, President Biden signed Executive Order 14093, aimed at commercial spyware. These are hacking tools, built by private companies and sold to governments, that can secretly break into a phone or computer, often without the owner clicking anything, and copy messages, photos, location and contacts. For several years such tools had been turning up on the phones of journalists, human rights activists and political dissidents. The White House fact sheet issued with the order said US government personnel overseas had also been targeted, and that the administration was still assessing how widely.

An executive order is a directive from the President to federal agencies; it binds the government’s own conduct rather than private companies. This one prohibits federal agencies from making operational use of commercial spyware that poses significant counterintelligence or security risks to the US government. Counterintelligence is the work of protecting the government from foreign spying, so the concern was that a tool might expose the government to the very adversaries it was meant to watch.

The ban also covers spyware posing significant risks of improper use by a foreign government or person, including against activists, journalists or dissidents. The United States would not buy from a vendor whose products were being used to persecute people elsewhere.

The scope was deliberately wide. According to the fact sheet, the order applied across the executive branch, including law enforcement, defense and intelligence agencies, and it covered tools from domestic vendors as well as foreign ones. The text defined commercial spyware by what it does. It is software furnished for commercial purposes that gives remote access to a device without the owner’s consent, to collect its content, record calls or track its location. “Furnished” was defined broadly enough to include selling, licensing, brokering and rebranding.

The order listed factors for agencies to weigh. They included whether the spyware had been used against US government personnel and whether the vendor had ties to foreign governments that misuse such tools. Another was whether it had been used to facilitate human rights abuses. Agencies had to review existing uses and report to the national security adviser, the President’s senior official for coordinating national security policy.

The order also set a timetable and a chain of sign-offs. The Director of National Intelligence was to produce a classified assessment of foreign spyware and its misuse within 90 days, then twice a year. Agencies had 90 days after that assessment to review their existing uses and 180 days from the order to put internal controls in place. Before any intended operational use, one of a short list of senior officials, such as the Attorney General or the Secretary of Homeland Security, had to certify the tool. Waivers were possible for up to a year, in extraordinary circumstances, with notice to the President within 72 hours.

The order did not appear from nowhere. The Commerce Department had added NSO Group, Candiru and two other foreign firms to its Entity List in November 2021. Commerce export controls on certain cybersecurity items, drawn from the multilateral Wassenaar Arrangement and announced in October 2021, had taken effect in May 2022. In January 2022 the State Department and the National Counterintelligence and Security Center had issued a public advisory on protecting against commercial surveillance tools. Congress, in the intelligence authorization acts for fiscal years 2022 and 2023, had restricted former intelligence employees from going to work for foreign governments and companies, including foreign spyware firms.

The United States did not act alone. The order was signed on the eve of the second Summit for Democracy, co-hosted with Costa Rica, the Netherlands, South Korea and Zambia. On March 30 the United States and a group of partner governments issued a joint statement on countering the misuse of commercial spyware. The order was published in the Federal Register the same day.

It looked like a foreign policy story, and it was. But read closely, the order did its work through a much more ordinary channel: what the government chooses to buy, and from whom.

Most coverage treated the order as foreign policy, which it was. It followed the Commerce Department’s November 2021 decision to add NSO Group and Candiru to the Entity List, and reports that US officials’ phones had been targeted with commercial spyware. The Entity List is a Commerce Department list of foreign companies and individuals subject to special restrictions on receiving US goods and technology, a signal that Washington regards them as a risk.

The order’s mechanism, though, was acquisition, the formal word for government purchasing. It did not regulate the global spyware market. It used the federal government’s weight as a buyer to deny revenue and legitimacy to vendors whose products posed risks. When a buyer as large as the US government refuses to buy from a vendor, other customers notice.

The text made that explicit. A section headed “Procurement” set out what an agency had to do before buying commercial spyware for most purposes. It had to review the intelligence community’s classified assessment, ask for anything else relevant and weigh the order’s risk factors. It also had to consider whether the vendor had reasonable due diligence procedures of its own. Those are tasks for lawyers, security officers and contracting staff, not diplomats.

That put the work on agency counsel, security and contracting staff at three stages of the acquisition lifecycle: deciding what counts as covered spyware, assessing the vendor, and governing use after purchase. The same three stages apply to a state or local government, or to any organization that buys sensitive technology. The sections that follow take each stage in turn, then look at how the logic travels beyond federal agencies, walk through a hypothetical case, and weigh the strongest objections.

What commercial spyware is, and why buying it is different

Most software a government buys does something visible and uncontroversial: it pays benefits, tracks cases, answers phones. Surveillance software is different because its purpose is to reach into someone else’s device or communications, often without their knowledge. Used lawfully, under a warrant and with oversight, such tools can help catch criminals or protect national security. Misused, they can destroy lives.

The most powerful commercial spyware works by exploiting flaws in a phone’s software. A flaw is a mistake in the code that the phone’s maker does not know about yet. The spyware vendor discovers or buys knowledge of that flaw and builds a way to slip through it, called an exploit. Some of these attacks are “zero-click”: the target does not have to open a link or download anything. The phone is compromised, and the operator can read encrypted messages, switch on the microphone or track location.

Such an exploit works like a master key that opens a particular brand of lock without leaving a mark. Whoever holds the key has enormous power, and the locksmith who sells it decides who else gets a copy. So the order looked at who sells the tools, and to whom, as well as at what they do.

A product that decays and depends on its vendor

Exploit-based products also behave differently from ordinary software over time. When a phone maker learns of a flaw and patches it, the exploit stops working on updated devices. The vendor must then find or buy a new flaw and ship a new exploit. The customer is buying a continuing service of discovery and delivery, not a finished product it can run on its own.

That continuing service usually means continuing contact. Many such products rely on infrastructure the vendor designs or operates: servers that deliver the exploit, relay collected data or manage licenses. Some vendors can see which licenses are active and can switch them off. Each of those touchpoints is a channel through which the vendor may learn something about its customer.

Risk that runs in two directions

Buying such a tool is also unusual because the risk runs in two directions. The government is using the tool, but the vendor may also have access to it, to its data, or to knowledge of how the government uses it. If the vendor has close ties to a foreign government, that is a counterintelligence problem: the buyer could be exposing its own operations.

The order captured both directions in its factors. On one side were risks to the government itself. A vendor might keep or pass on data from the spyware without authorization, or disclose nonpublic government information. It might be under the direct or effective control of a foreign government running intelligence activities against the United States. On the other side were risks to people abroad: a tool used to intimidate activists, journalists, academics or political figures, or to track a US person without proper legal authority.

Ordinary vendor risk management handles the first direction reasonably well, because it resembles supply chain security. It is poorly equipped for the second, because the harm falls on people who are not parties to the contract and may never know the buyer’s name. The order asked procurement staff to carry both.

Deciding what counts

The first challenge was scope. Surveillance and intrusion tools span a wide range, and not all of them raise the same concerns:

• Lawful intercept equipment works through carriers under court order. The phone company, compelled by a judge, provides access to communications on its network.
• Mobile forensic tools extract data from a device an investigator already holds, such as a phone seized with a warrant.
• Network investigation techniques are deployed under warrant to identify or track suspects online.
• Remote exploitation tools can compromise a phone without the owner’s knowledge, from anywhere in the world.

The order focused on software that gains remote access to a device and extracts information without the user’s consent. Agencies still had to decide which products in their portfolios fell inside it. That is harder than it sounds, because products are sold under commercial names with marketing descriptions, not neat legal labels.

Three tests and a purpose

Read carefully, the definition breaks into three tests that a review group can apply to any product. First, the product must be furnished for commercial purposes, directly or through a third party or subsidiary. Tools an agency builds itself fall outside that phrase, while a product licensed through a reseller or sold under a new brand falls inside it. Second, it must give remote access to a device without the consent of its user, administrator or owner. Third, that access must let the operator collect content, record calls or track location.

A product that passes all three tests is commercial spyware for the order’s purposes. The next question is what the agency intends to do with it. The prohibition applies to operational use. It does not apply to use for testing, research, analysis or cybersecurity, to developing countermeasures, or to criminal investigations arising from the criminal sale or use of the spyware itself.

Those carve-outs matter. A security team that obtains a sample of spyware to study how it infects phones is doing something the order permits. So is an investigative unit building a case against people who sold or used spyware illegally. Even then, an agency that bought spyware for an excluded purpose, other than such a criminal investigation, had to report to the national security adviser within 45 days. The report covered what it was for and which uses were authorized. Purpose therefore needs to be recorded at the moment of purchase, not reconstructed later.

A classification file a senior official can sign

The stakes of classification rose with the order’s sign-off chain. Before intended operational use, one of six senior officials had to certify that the tool did not pose the prohibited risks. They were the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, the Director of National Intelligence and the directors of the CIA and the NSA. The order sharply limited delegation of that duty. The agency head also had to notify the national security adviser, and use could not begin until at least seven days later unless the White House said no further process was needed.

A cabinet official will not, and should not, sign on the strength of a vendor brochure. The classification file needs to stand on its own. A sound one records the product name and version, every module licensed, how it is deployed, who operates the infrastructure and what data flows back to the vendor. It also records the result of each of the three tests, the intended purpose, the decision, the decision owner and the event that will trigger the next review.

The seven-day notice also changes program planning. A unit that expects to use a new covered capability in a particular operation must start the certification process well before it needs the tool. Schedules built around a vendor’s delivery date, rather than the review calendar, will slip.

Who decides

That decision could not rest with program offices alone, because they were the users with an interest in keeping the tools. A program office is the part of an agency that runs a particular mission and uses the tools to do it. Asking it to decide whether its own favorite tool is banned puts the question to the people with the most reason to answer no.

A sound approach gave classification to a small group: the general counsel, the chief information security officer and the senior procurement executive. The general counsel is the agency’s chief lawyer. The chief information security officer leads cybersecurity. The senior procurement executive oversees how the agency buys things. That group reviews any product with remote access or data extraction capability against the order’s definitions. It documents the conclusion and revisits it when the product or its vendor changes. Classification determines everything that follows, so it needs an owner with no stake in the answer.

The group still needs the program office in the room. Users know what a product actually does in the field, which features they rely on and which they have never switched on. The right arrangement gives users a voice and a duty to disclose, while keeping the decision with people who do not depend on the answer.

Edge cases deserve written reasoning. A finding that a tool falls outside the order is as consequential as a finding that it falls inside, and both should be reviewable by an inspector general later. An inspector general is an independent internal watchdog within each agency, responsible for investigating waste, fraud and misconduct.

Tools that arrive through someone else

The order also barred agencies from asking a third party to make prohibited use on their behalf, or directly enabling one to do so. That closes an obvious gap. A component cannot avoid the rules by having a task-order contractor, a system integrator or a partner agency run a covered tool for it.

For the classification group, that means looking beyond the agency’s own license list. Services contracts for investigative support, technical surveillance or digital forensics may include capabilities the agency never bought directly. The scope review should cover what contractors use on the agency’s behalf, and services contracts should require disclosure of any such tools.

Products that change

Product changes are the hard part. A forensic tool that adds a remote collection module, or a vendor that acquires an exploit developer, can move a product across the line between one contract year and the next. The tool the agency approved two years ago may not be the tool it is using today.

Requiring vendors to notify the agency of material capability changes, and tying that notice to the classification review, keeps the determination current. A material change is one significant enough to affect the decision, such as new features that let the tool reach into devices remotely.

Notice clauses have limits. Vendors may describe a new module in marketing terms that obscure what it does, and an update may arrive automatically. Two technical controls help. The agency can require that new modules stay disabled until it accepts them in writing, and it can test each major release against the three-part definition before deployment.

Assessing the vendor

The second stage was due diligence, the investigation a buyer does before committing, and the order asked for something unusual. Standard vendor reviews look at price, performance, security and financial stability. The order’s factors required agencies to look at what a vendor had done with other customers. Agencies had to ask whether its tools had been used against US personnel, or by foreign governments against journalists or activists. They also had to ask whether the vendor had ties to such governments. These were questions about conduct and associations as much as about the product.

Conduct across the whole portfolio

Several factors reached further than a product review normally goes. Misuse of “other spyware from the same vendor” counted, so a clean record for one product did not clear a vendor whose other products had been abused. Selling to governments that the State Department’s annual human rights reports credibly identified as engaging in systematic political repression counted too. The standard of proof was credible information, not a court judgment.

The order also asked whether the vendor knew or should have known of the risks, and whether it had taken remedial steps. Its examples included canceling licenses with misusing customers, taking verifiable action to stop misuse and cooperating with US efforts. That gave vendors a path back, and gave agencies a duty to assess remediation claims rather than accept them.

Sharing the burden

Agencies are poorly placed to investigate that alone. The evidence often comes from intelligence reporting, academic researchers, civil society investigations and litigation abroad. A procurement team in a domestic agency is not set up to evaluate a forensic report from a university lab or a court filing in another country.

The order built a shared channel for that reason. The Director of National Intelligence’s classified assessment was to draw together intelligence, open-source, financial, sanctions and export control information. Agencies had to send their own determinations and new credible information back to the Director, so that one agency’s finding could inform another’s. The national security adviser was to convene agencies within 30 days of each assessment. The Federal Acquisition Security Council, which already reviewed supply chain risks in federal purchasing, was told to take the assessment into account.

A single determination applied across government is also fairer to vendors and harder to game. Without it, a vendor rejected by one agency might simply try the next one down the hall.

Working with classified inputs

The shared channel brought a practical problem. The assessment was classified, and many contracting officers and procurement attorneys in civilian components do not hold clearances at the level needed to read it. The agency needs a cleared liaison who can read the assessment, translate its conclusions into an unclassified decision record and place the classified analysis in a properly controlled annex.

Without that liaison, two failures are likely. Either the contracting officer proceeds without the intelligence, or the decision moves entirely into classified channels, where auditors and later reviewers without clearances cannot test it. Neither serves the order’s goal.

Writing it into contracts

Contracts carry the rest of the burden. A solicitation is the formal document an agency issues to invite bids. Solicitations for sensitive surveillance capabilities can require disclosure of ownership, financing and corporate affiliates, including resellers and subsidiaries that may sell the same product under another name. They can require disclosure of foreign government customers in relevant categories and any known misuse findings. False or incomplete disclosure can be made grounds for termination.

Ownership disclosure needs to reach the people and funds that control the vendor, beyond the legal entity on the invoice. Spyware vendors have often been organized as groups of companies in several countries, and the entity that signs a US contract may be a local subsidiary. The disclosure should name ultimate owners, significant investors with control rights and any affiliate that develops or sells exploits.

These clauses add friction for vendors and contracting officers. They also create a record that oversight bodies can later test. If a vendor swore it had no relevant foreign customers and that later proves untrue, the agency has both a clear contractual remedy and a documented basis for its original decision.

The vendor’s own controls, and a tension inside them

The procurement section also asked agencies to consider whether the vendor had reasonable due diligence procedures to prevent prohibited uses, pointing to State Department guidance on business and human rights. In contract terms, that means asking how the vendor vets government customers, what it does when it learns of misuse, and whether it has ever cut off a customer.

Here the two directions of risk collide. The strongest misuse controls give the vendor visibility and power over its customers: audit logs of how licenses are used, the ability to see targets’ country codes, a remote switch to disable a license. Those same features give the vendor insight into the US government’s own operations, which is the counterintelligence risk the order also worried about.

No contract clause dissolves that tension. The agency has to decide, product by product, how much vendor visibility it will accept, and record why. A reasonable middle course accepts vendor controls that operate on licensing and technical limits, such as blocking use against certain countries’ numbers, while refusing vendor access to operational data or target identities.

Equipping contracting officers

Contracting officers need support to use these clauses well. Contracting officers are the officials legally authorized to sign contracts on the government’s behalf. Most have never weighed a human rights record or a counterintelligence assessment. A short playbook, a named contact in the agency’s security office and access to the shared determinations turn an unfamiliar requirement into a routine step.

The playbook can be brief: the three-part scope test, the list of required disclosures, the standard clauses, the route to the cleared liaison and the documents that must sit in the contract file. Training should use realistic product descriptions, because the hard part is recognizing a covered capability inside an innocuous-sounding offer.

Governing use after purchase

The third stage is the one most procurement processes neglect. Buying is treated as the finish line, when for sensitive tools it is closer to the start. A tool judged acceptable at award can become unacceptable later. A vendor may be sold, a new misuse finding may emerge, or the government may add the vendor to a sanctions or export control list. Sanctions restrict financial dealings with named people or companies; export controls restrict who may receive certain technology.

The order treated that as a standing duty. When new information arrived, an agency had to reassess. If the tool now posed a prohibited risk, the agency had to end operational use as soon as reasonably possible without compromising ongoing operations. It also had to tell the Director of National Intelligence and the national security adviser. Within 180 days of the order, agencies that might use such tools had to establish internal controls and oversight procedures for these determinations.

Agencies need to know where every sensitive surveillance tool is deployed, under which contract, with which licenses and accounts, so that a new determination can be applied everywhere at once. If the government decides on a Monday that a vendor is now off-limits, an agency should be able to answer by Tuesday where that vendor’s products are in use.

A register held outside the users

That calls for a central register of covered and near-covered tools, held outside the program offices that use them. A register is simply an authoritative list. It should record deployment locations, authorizing officials and contract end dates.

The register is also how an agency produces the reports the order demanded. Agencies that bought spyware for operational use had to report within one year and then annually. The report covered which tools remained in use and why they were judged acceptable, which uses had ended in the prior year and why, and what had been bought. An agency that keeps the register current writes that report from its own records. An agency that does not has to rebuild a year of decisions from email.

Waivers belong in the register too. A waiver could last at most a year and could be revoked at any time. Each entry should carry the waiver’s expiry date, the official who signed it and the date the national security adviser was notified, so that no waiver lapses unnoticed while the tool stays in use.

It also calls for contract terms that allow suspension or termination when the vendor’s status changes. Without them, agencies face a choice between breaching a contract and continuing to use a tool the government has decided is a risk. Neither is acceptable, and the time to avoid that choice is when the contract is written.

Winding down without wrecking a case

The phrase “without compromising ongoing operations” carries real weight. An investigation may depend on a tool that has just become prohibited. Pulling it overnight could lose evidence or expose an operation. Leaving it running indefinitely defeats the order.

A wind-down plan, written in advance, resolves most of that. It names the alternative tools already qualified for each mission, sets out how data already collected will be preserved and handled, and gives the decision on timing to someone outside the operating unit. The agency should know, before it needs to, how long a clean exit from each covered product would take.

Watching how the tool is used

Use itself needs governance. Logging of each operational use, review by an official outside the operating unit, and periodic reporting to the agency’s privacy and civil liberties officer give leaders evidence that the tool is used as approved. The privacy and civil liberties officer is the official charged with making sure agency activities respect individual rights.

The logs create their own risk. A record of every operational use is a map of the agency’s sensitive work: its targets, methods and timing. Access to those logs must be limited and itself recorded, and the logs must be stored where the vendor cannot reach them.

These controls cost operational speed. An investigator who must log every use and accept outside review will move a little more slowly. They are also what lets an inspector general verify compliance. Without records, an agency can only assert that it follows the rules; with them, it can show it.

County police, councils and private buyers

The order binds federal agencies, but its logic travels. State and local police departments, prosecutors and corrections agencies buy surveillance and forensic technology too, often from the same vendors and resellers. A county that buys a tool the federal government has decided is a risk faces awkward questions from its council, its residents and the press, even if no rule forbids the purchase.

Some local governments already had a framework to hang this on. Cities including Seattle, Oakland and New York have adopted ordinances that require police to disclose surveillance technologies and publish policies on how they are used. Those rules focus on transparency and approval by elected officials. They rarely ask the vendor-conduct questions the federal order asked, which is the gap a council could close by adding them to its review checklist.

Local buyers face one disadvantage the federal government does not. They have no access to a classified intelligence assessment. They can still use the public signals: the Commerce Entity List, Treasury sanctions designations, State Department visa restrictions and published forensic research. A short written check against those sources before award costs little and shows the council that someone looked.

The reputational stakes are real for any public body. If a tool an agency bought turns out to have been used against journalists elsewhere, the agency’s name becomes part of that story. Explaining that the purchase was technically allowed is a weak defense. Being able to show a documented diligence process, a clear decision owner and an exit clause is a much stronger one.

There is also a cost argument. Sensitive tools often come with multi-year licenses, training and integration into case management systems. Discovering mid-contract that a vendor is now sanctioned, with no clean way out, can mean paying for something the agency can no longer use while scrambling to replace it. Building the safeguards in at the start is cheaper than unwinding a bad purchase later.

Private organizations that buy security, monitoring or investigative technology can borrow the same three questions. What exactly does this tool do, and who decided? Who are we really buying from? And what will we do if the answer changes after we sign?

For a bank or a health system, those questions apply less to spyware than to the tools around it: mobile device management, insider risk monitoring, digital forensics retainers and investigations firms. A bank that hires an outside investigator for a fraud case, for example, should know which collection tools the investigator uses and on whose devices. The sanctions angle applies directly. A US bank cannot pay a sanctioned vendor without running into Treasury’s rules, whatever its own purchasing policy says.

When a forensic tool’s vendor changes hands

Suppose the investigations unit of a federal law enforcement component bought a mobile forensic tool several years ago to extract data from phones seized under warrant. The tool was clearly outside the order’s scope: it worked only on devices the agency physically held.

Then suppose the vendor is acquired by a larger company that also owns an exploit developer. A year later, a software update adds a feature that can pull data from a phone remotely.

In a weak process, nobody notices. The investigations unit sees a useful new feature and starts using it. The contract has no notice clause, the tool appears on no central register, and the classification decision made years ago is never revisited. The agency is now arguably using covered spyware without having decided to. No certification was signed, no notice went to the White House and no annual report mentions the tool.

In a strong process, the vendor is contractually required to report the acquisition and the new capability. That notice triggers a review by the classification group. The group documents its reasoning and either approves continued use with conditions or disables the new feature. If the parent company later appears on a sanctions list, the central register shows exactly where the tool is installed, and the contract allows suspension without a dispute. Every step leaves a record an inspector general can follow.

The certification path, step by step

If the group decides the new feature is covered and the unit wants to keep it, the order’s machinery takes over. The group assesses the parent company against the risk factors, using the intelligence assessment through the cleared liaison. If it finds no prohibited risk, the file goes to the relevant senior official for certification, and the agency head notifies the national security adviser. The remote feature stays disabled for at least the seven-day waiting period, and its use is logged from the first day.

If the group finds a prohibited risk, the remote feature stays off. The agency then decides whether the original forensic function, which remains outside the order, can be kept safely under a vendor now owned by a company of concern. That question belongs to ordinary supply chain review, and the answer may still be to move to another product.

The reverse case

Ownership changes can also cut the other way. A vendor once judged risky may be sold to new owners and present itself as a changed company. The same discipline applies. The group should ask what changed beyond the cap table: whether the old customers, engineers and infrastructure remain, and whether the products that were misused are still sold. A new owner is evidence, not a verdict.

What separates the good and bad outcomes is ownership, contract language and record-keeping, the everyday tools of procurement.

Why a single review at purchase falls short

Most failures come from treating a policy problem as a one-time purchasing decision. The program office classifies its own tools. A product is reviewed once at purchase and never again. Resellers and subsidiaries selling the same capability under another name slip through. Contracting officers are left to judge human rights and counterintelligence questions without guidance. Contracts have no clean exit when a vendor’s status changes, and nobody keeps a usable record of how the tools are actually used.

The arrangements that hold up share a handful of features:

• Classification of surveillance and intrusion tools rests with counsel, security and procurement leaders, not the users, and every decision is written down.
• Vendors must disclose ownership, affiliates, relevant foreign government customers and material capability changes, with false disclosure as grounds for termination.
• Agencies rely on shared, government-wide vendor determinations rather than their own isolated judgments.
• A central register, held outside the using units, records where each tool is deployed and under what authority.
• Contracts include suspension and termination rights tied to sanctions, export control or misuse findings.
• Each operational use is logged and reviewed by someone outside the operating unit.

The case against, and why the argument holds

Three objections deserve a hearing. The first is that the procurement burden achieves little, because the most capable governments build their own tools and the order leaves government-built capabilities alone. That is true, but beside the purpose. The order aimed at the commercial market, where a vendor’s revenue depends on customers. Denying it the largest customer of all changes its economics in a way that a statement of principle does not.

The second objection is that secrecy defeats accountability. The intelligence assessment was classified, the agency reports went to the national security adviser rather than the public, and individual procurement decisions about surveillance tools are rarely published. The public cannot easily tell whether the order is working. That is a fair criticism of the order’s design. It makes internal records more important, not less, because inspectors general and congressional committees with clearances are the only outside reviewers who can test compliance.

The third objection is durability. An executive order can be revised or revoked by a later President, and the procurement clauses an agency writes may outlast the policy that prompted them. The clauses are still worth writing. Disclosure of ownership, notice of capability changes and termination rights tied to sanctions are sound contract hygiene for any sensitive technology, whatever the policy of the day.

A fourth concern comes from investigators, who argue that strong encryption leaves them few alternatives to remote access. The order did not dispute that. It allowed operational use of tools that passed its tests and provided waivers for extraordinary cases. What it required was a decision, documented and owned, rather than an assumption.

Spyware checks belong in every renewal

The order’s process applies at purchase, but its risks change at renewal. A contract renewal, option exercise or license true-up is the natural moment to rerun the scope tests, refresh the vendor assessment and confirm the register entry. Tying the review to the renewal calendar puts it on a date someone already tracks.

A leadership team can test its own readiness with five questions:

1. Which tools do we own that can access a device or extract data from it, and who decided whether each is covered by the order?
2. How would we find out if a vendor added remote capabilities or was bought by another company?
3. What happens under our contracts if a vendor is sanctioned or found to have enabled misuse, and can we suspend use cleanly?
4. Is there one central list of where every sensitive surveillance tool is deployed, held outside the units that use them?
5. If our inspector general asked tomorrow to verify compliance, what evidence could we hand over?

With hindsight

The policy broadened after 2023, using several different levers. In July 2023 the Commerce Department added four entities linked to the Predator spyware to the Entity List: Intellexa companies in Greece and Ireland and Cytrox companies in North Macedonia and Hungary. In February 2024 the State Department announced a visa restriction policy for people involved in spyware misuse. The Treasury sanctioned Intellexa-linked individuals and entities in March and September 2024. Each of those steps also changed the status of vendors, which is exactly the kind of event that post-award governance has to absorb.

The Treasury action of March 5, 2024 shows how the levers fit together. It named the consortium’s founder, a corporate offshoring specialist and five companies, under the long-standing sanctions program for malicious cyber-enabled activity rather than under the spyware order itself. Four of the five companies were the ones Commerce had listed about eight months earlier. A vendor could thus move from an export restriction to a full sanctions designation, and a purchasing office that had tracked only one list would have missed the escalation.

The effort became more international too. The United Kingdom and France launched the Pall Mall Process in London in February 2024, focused on the market for commercial cyber intrusion capabilities. The concern was no longer confined to one government’s purchasing rules.

Enforcement through acquisition was harder to see from outside. Procurement decisions about sensitive tools are rarely public, so the public record shows the policy’s headline actions more clearly than its day-to-day effect. The classified assessments and the annual agency reports to the national security adviser were never meant for publication.

One case became public: an ICE contract with Paragon Solutions, worth about $2 million and signed in September 2024, was put under a stop-work order that autumn for review against the order. A stop-work order pauses a contract while the government examines it. Procurement records showed the stop-work order lifted at the end of August 2025, after Paragon’s sale to a US investor. Access Now, the digital rights group, later reported that ICE had told Congress in April 2026 it had used Paragon’s tools in drug trafficking cases.

The same year brought evidence of misuse elsewhere. Investigations by WhatsApp and the Citizen Lab at the University of Toronto found that Paragon’s Graphite spyware had been used in Italy against journalists and people working with refugee rescue organizations. The order counted misuse by a foreign government against journalists as a risk factor. The public record does not show how the ICE review weighed those findings, which is the transparency gap critics of the order had warned about.

The episode showed how much depends on who owns the post-award decision. A change in a vendor’s ownership was enough to shift the outcome, which is precisely why the classification and review steps described above need clear, independent owners and written reasoning. An outside observer could see the stop-work order and its lifting, but not the reasoning in between.

Three things held up. The acquisition lever was real: a federal contract could be stopped on the order’s terms, and the stop became news. The interlocking lists worked as designed, with the Entity List, sanctions and visa restrictions each changing a vendor’s status in ways a contract had to absorb. And international partners adopted the same vocabulary, through the joint statement and the Pall Mall Process.

Two things did not. Public accountability stayed thin, because the evidence that would show compliance sat in classified assessments and internal reports. And ownership turned out to be a weaker signal than the order’s factors implied, since a sale could change a vendor’s nationality without settling questions about how its products had been used.

In any public body, or any organization that buys sensitive technology, a purchasing policy is only as strong as its follow-through. Deciding what counts, checking who you are buying from and watching what happens after the contract is signed are the places where a principle either becomes practice or fades.