Wyden asks GAO to audit federal use of hacking tools

Democratic senator Ron Wyden is asking the U.S. government to review how federal law enforcement agencies use hacking tools and spyware against Americans, citing a lack of transparency into how often — or for what reasons — the tools are deployed. In a letter sent Friday to the U.S. Government Accountability Office (GAO), which audits the federal government, Wyden requested a comprehensive inquiry into how the FBI, the Drug Enforcement Administration, ICE’s Homeland Security Investigations, and the Secret Service employ hacking and spyware in their investigations. The tools have been used for more than two decades, Wyden wrote in the letter, shared with TechCrunch, but “there exists little public information regarding its scope, frequency, or operational safeguards.”

Unlike wiretaps and pen registers, which let authorities see when a call is placed and to whom, Wyden said the government does not publish annual reports on its hacking operations — which is why he asked the GAO to publish an unclassified report with its findings and recommendations. He added that the Department of Justice and the FBI have repeatedly ignored congressional requests for greater transparency across multiple administrations. Wyden’s letter asks the GAO to: investigate whether agents abused hacking tools and spyware for unauthorized or personal purposes and what oversight measures exist to prevent misuse; review how agencies acquire, store, and secure these tools to avoid leaks, and whether they submit newly discovered flaws to a program meant to help tech companies patch them; and assess how federal agents disclose the use of these tools to courts when requesting warrants, including the risk of affecting innocent or unintended targets.

To illustrate the risk around acquiring hacking tools, Wyden cited the case of Peter Williams, a former executive at defense contractor L3Harris, who stole and sold advanced hacking tools to a Russian broker; the tools ended up in the hands of Russian spies targeting Ukraine and Chinese cybercriminals targeting cryptocurrency owners. The earliest documented case of FBI spyware use dates to 1999, when federal agents investigating Philadelphia mobster Nicodemo S. Scarfo for illegal gambling and loan sharking discovered he had used the encryption program PGP to protect a file they believed held key evidence — and installed rudimentary keystroke-recording malware on his computer to decrypt it.

Why it matters

Wyden’s request lands as hacking tools and commercial spyware have moved from a niche national-security capability to a routine law enforcement one, with almost none of the public reporting that governs older surveillance methods like wiretaps.