Renting surveillance: from a monthly app to a government contract

Summary

• Surveillance is sold at four rough levels: consumer apps, hackers for hire, commercial spyware for governments, and tools that states build for themselves. The public record has examples of the first three, and the boundaries between them are not sharp.
• A hack-for-hire case is not always spyware. In the federal case described below, hired hackers used phishing to steal passwords, not malware on a phone.
• For commercial spyware, courts and agencies have acted. The Commerce Department put two vendors on its Entity List in 2021, a federal jury found against a vendor in 2025, and the Treasury Department sanctioned people and companies linked to another vendor in 2024.
• Most people will not be targeted by the top tier. Apple says the vast majority of users never will. The risk to an ordinary person comes mainly from the cheaper tiers, and from people they know.
• If Apple tells you that you were individually targeted, treat it as serious and get expert help. An examiner may still be unable to confirm an infection, because traces can be thin and some vendors work to remove them.

One market, several tiers

The pattern across the records below is access. The buyer does not need to understand how the product works. Someone else has already done the technical work, and what is sold is the result. What differs between tiers is price, who the buyer is, and how much a target can do about it. Figure 1 sets the tiers side by side, using only examples from the public record. It does not rank the sellers or claim a size for any tier.

The lines blur at the edges. In 2021 three former U.S. intelligence community members agreed to pay about $1.7 million under a deferred prosecution agreement to resolve charges over hacking work for the United Arab Emirates (the case was widely reported as Project Raven). Reporting says they did not dispute the facts alleged by prosecutors. It is a reminder that skill can move from a government to a private seller and back.

Tier 1: the consumer app

The cheapest tier is the one most readers are likelier to meet. LAB-0012 covers it in detail. Briefly: the FTC announced an order in 2021 that bans a stalkerware vendor, Support King (SpyFone), and its chief executive from the surveillance business, on allegations that include secret collection of people's data and poor security. In 2014 the head of a company that sold a mobile spyware app pleaded guilty in federal court in Virginia and was fined $500,000. In 2019 Citizen Lab reviewed the marketing of eight such products and found that most of the companies' blog and search content referred extensively to spousal monitoring. These apps are sold as products, to individuals who need no skill, and the public record shows that regulators and prosecutors can and do act against sellers on the facts of a case.

Tier 2: hackers for hire

One layer up, people pay for a result: access to somebody's email or accounts. The best-documented public record is the one on Dark Basin. In June 2020 the Citizen Lab at the University of Toronto described a hack-for-hire group it called Dark Basin, which it linked "with high confidence" to an India-based company, BellTroX InfoTech Services. The report said the group targeted thousands of individuals and hundreds of institutions on six continents. The targets included advocacy groups and journalists, including U.S. climate and net neutrality organizations, as well as lawyers, officials, financial companies and, in a few cases, individuals in personal or divorce disputes. Citizen Lab said it did not know who hired the group for the climate campaign or for a campaign tied to the German payments company Wirecard.

Notice the method. Citizen Lab describes credential phishing: emails and fake pages that tricked people into typing their passwords. The group was not installing spyware on phones. That matters for anyone who suspects they were watched. A person who lost an account to phishing will not find anything on the phone.

A U.S. federal court has heard part of the same story. In November 2023 an Israeli private investigator, Aviram Azari, was sentenced in Manhattan to 80 months in prison after pleading guilty to wire fraud, conspiracy to commit computer hacking and aggravated identity theft. The Justice Department said he coordinated hacking campaigns from 2014 to 2019 and was paid about $4.8 million, hiring hackers, including a group from India, to harvest credentials. Victims included climate advocacy organizations, whose stolen communications were leaked to the press. Prosecutors did not name the Indian group, and Reuters reported that it was BellTroX. That identification is Reuters's, not the court's.

Tier 3: commercial spyware sold to governments

The top commercial tier is software sold to governments that can infect a phone remotely, sometimes with no action from the owner. Google's Threat Analysis Group said in February 2024 that it tracked around 40 commercial surveillance vendors and that they were behind half of the known zero-day exploits against Google products. The word "commercial" matters: these vendors sell to states, and what a state does with a license is outside the vendor's code and outside the phone.

Several public records show how this tier has played out.

• The Pegasus Project, July 2021. More than 80 journalists from 17 media organizations in 10 countries, coordinated by Forbidden Stories with technical support from Amnesty International's Security Lab, examined a leaked list of 50,000 phone numbers. Amnesty describes the list as potential targets, not confirmed infections. Amnesty's forensic work found Pegasus traces on some phones. The vendor, NSO Group, denied the claims and said the reporting rested on incorrect assumptions.
• State Department phones, December 2021. Reuters reported, citing four unnamed sources, that the iPhones of at least nine U.S. State Department employees, based in Uganda or working on Uganda, were hacked with NSO's software. Apple had notified them. Reuters did not determine who was responsible. NSO said it was not aware of its tools being used in the alleged hack, and the State Department did not confirm it.
• WhatsApp v. NSO. WhatsApp sued in 2019 over a flaw used to deliver spyware to about 1,400 of its users. In May 2025 a jury found NSO liable and awarded $444,719 in compensatory and $167.25 million in punitive damages. In October 2025 the judge cut the punitive award to just over $4 million and issued a permanent injunction barring NSO from hacking WhatsApp. These are findings of one court, and the SecurityWeek report describes NSO's challenge to the size of the award.
• Intellexa, March 2024. The Treasury Department designated the Intellexa consortium's founder, a corporate off-shoring specialist and five entities. Treasury said the consortium's Predator spyware has been used to covertly surveil U.S. government officials, journalists and policy experts. Treasury designated two more people in September 2024. On 30 December 2025 Treasury removed three individuals from the list, saying the step was part of a normal administrative process after a petition, and that they had demonstrated measures to separate themselves from the consortium. A Citizen Lab researcher publicly questioned whether they had stopped.
• Paragon, June 2025. Citizen Lab reported forensic confirmation that a vendor's Graphite spyware infected the iPhone of one European journalist, through a zero-click message attack that Apple has since fixed, and found artifacts of a targeting attempt on a second journalist's iPhone. It concluded with high confidence that both were targeted with the same spyware. Citizen Lab said it had not identified who was behind the targeting, and that it could not confirm infection on a third journalist's Android phone because of sparse logs.

How governments have responded

Governments have not stood still, though no response has stopped the market. Figure 2 lists the main U.S. and international steps in the order they happened.

Two points stand out. First, the same government that restricts a vendor in one year can reverse a step in another, as the December 2025 removal shows, so a listing is not permanent. Second, none of these steps gives a target a way to find out. For that, a target depends on the platform's notices, researchers and examiners.

Who is at risk, and what to do

It is tempting to say that nobody is safe. That is not what the records show. Apple says mercenary spyware is rare, costly and aimed at a small number of people, often journalists, activists, politicians and diplomats, and that the vast majority of users will never be targeted. Google describes the usual targets as high-risk users such as journalists, human rights defenders, dissidents and opposition politicians. The ordinary reader is likelier to meet the cheaper tiers: a monitoring app put on the phone by someone who has held it, or a phishing message from a paid operator.

If you get an Apple threat notification, Apple describes it as a high-confidence alert that you were individually targeted. It arrives as an alert on the iPhone, an email to the addresses on your Apple Account and a banner when you sign in at account.apple.com. Apple says a real notification never asks you to click a link, open a file, install an app or share a password or code, and that you can confirm it by signing in at account.apple.com yourself. It recommends turning on Lockdown Mode, and it points to the Digital Security Helpline run by Access Now, which is open at all hours. Take it seriously, and get expert help before you wipe or replace the phone.

If you suspect a monitoring app from someone who has had your phone, use the safety steps in LAB-0012, and talk to an advocate before you remove anything.

What an examiner can and cannot conclude

An examiner can say what a phone shows. For a tier-1 app, that is often the app or the permissions it needs. For tiers 2 and 3 it is harder. A phishing case leaves nothing on the phone, so an examiner should look at the accounts: sign-in history, recovery settings and mail rules, from the account holder's own records. A tier-3 infection leaves few traces by design. Citizen Lab's own report shows the range. For one iPhone it could confirm infection. For one Android phone it could not, because the logs were sparse, and it said that full findings may be unavailable even where infection likely occurred, because of log limits and efforts to delete traces.

An examiner therefore cannot treat "nothing found" as "not infected". The rule from Lab work on empty results applies: a claim that nothing happened needs a store that could have recorded it (LAB-TR-0034; see also LAB-0005). An examiner also cannot say who bought or operated a tool. A phone may show that something ran. A buyer's identity comes from other evidence, such as a vendor's records obtained lawfully, or a court finding. Likewise, the presence of a number on a leaked list does not show infection, and an Apple notice does not say why Apple sent it.

What an examiner can add is care in the report. State what was examined and what was out of reach, name the version and the extraction type, and say which questions the evidence cannot reach. For a person at risk, an independent examination, with their consent, is worth more than a single scan, and it should be planned before the phone is wiped.

What this article does not claim

Sources

Every number and claim, and where it comes from. Web pages were read on 2026-11-08. Items from an earlier newspaper version that could not be confirmed from a primary or reputable source were left out. LAB-TR-0034 is a Lab Technical Report available on this site (LAB-TR-0034).

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related