Cybersecurity Policy Report, Defense Bill Seeks to Discourage Government Support for ‘Malicious’ Spyware, (Dec 8, 2025)
Legislation that would encourage the U.S. government to counter malicious uses of commercial spyware was released yesterday as part of an annual Defense Department authorization bill.
“It is the policy of the United States ... to oppose the misuse of commercial spyware to target individuals, including journalists, defenders of internationally recognized human rights, and members of civil society groups, members of ethnic or religious minority groups, and others for exercising their internationally recognized human rights and fundamental freedoms, or the family members of these targeted individuals,” according to the bill.
The spyware policy statement appears in the Department of State Authorization Act for Fiscal Year 2026, which is appended to the National Defense Authorization Act (NDAA) for Fiscal Year 2026 (S.B. 1071, 119th Cong. (2025)).
The text of the NDAA was released yesterday by the House Armed Services Committee following several weeks of negotiations between House and Senate conferees to reconcile differences in the House and Senate versions of the 2026 NDAA (see separate story).
The spyware provision recognizes a “national security need for the legitimate and responsible procurement and application of cyber intrusion capabilities, including efforts related to counterterrorism, counternarcotics, and countertrafficking.”
But it warns that a “growing commercial market for sophisticated cyber intrusion capabilities has enhanced state and non-state actors’ abilities to target and track for nefarious purposes” certain individuals.
The proliferation of commercial spyware “presents significant and growing risks to United States national security, including to the safety and security of United States Government personnel” and risks “spreading potentially destructive or disruptive cyber capabilities to a wider range of malicious actors,” it says.
It calls on the U.S. government “to coordinate with allies and partners to prevent the export of commercial spyware tools to end-users likely to use them for malicious activities.”
The U.S. government should also “maintain robust information-sharing with trusted allies and partners on commercial spyware proliferation and misuse, including to better identify and track these tools,” the provision adds. It encourages the government to “work with private industry to identify and counter the abuse and misuse of commercial spyware technology.”
News: FederalLegislation DataPrivacy DataSecurity