Cybersecurity Policy Report, Privacy Advocates Question Treasury’s Reversal on Spyware Sanctions, (Jan 2, 2026)
Privacy and human rights advocates are expressing dismay at the Treasury Department’s decision to lift economic sanctions against three individuals suspected of being involved in a global spyware distribution network.
The department imposed economic sanctions on Merom Harpaz, Andrea Gambazzi, and Sara Hamou in 2024 over their work for the Intellexa Consortium, which the Biden administration accused of selling spyware to autocratic governments to monitor activists, journalists, and U.S. officials (CPR, Sept. 17, 2024).
On Tuesday, Treasury’s sanctions list update noted that the three individuals had been removed from its “Specially Designated Nationals List.”
A department spokesperson said the individuals were removed from the list after taking “measures to separate themselves from the Intellexa Consortium.”
“The power of sanctions derive not only from the ability to designate individuals, but also from our willingness to remove sanctions consistent with the law,” the spokesperson said.
Natalia Krapiva, senior tech-legal counsel at Access Now, said in a posting on Bluesky that Treasury should prove that its actions were warranted.
“The public deserves to know what evidence exists to prove that these individuals have ceased their involvement with Intellexa,” Ms. Krapiva said. “Any hasty decisions to remove sanctions from individuals involved in conducting cyber attacks against US persons and interests risk signaling to bad actors that this behavior may come with little consequences.”
Likewise, John Scott-Railton, a senior researcher at Citizen Lab, a research group based at the University of Toronto, questioned Treasury’s move in a series of posts on X.
“Natural question: did delisted individuals fully step away from sanctioned activities? When? What are their economic activities now?” Mr. Scott-Railton asked. “I worry: if this delisting signals a trend... mark my words the price will be paid in hacked US citizens & officials.”
MainStory: TopStory FederalLegislation DataPrivacy DataSecurity