Government cyber tools and commercial spyware

Summary

• A capability can be built in-house by an agency for its own operations, or built as a product and licensed to many customers. The line is blurry, because governments also buy commercial tools, but the two models point to different failure modes and different fixes.
• In-house tools can escape their purpose. Symantec counted about 100,000 computers infected by Stuxnet by 29 September 2010, in more than 155 countries, with about 60 percent in Iran, even though the code was aimed at one kind of industrial system. Exploits that were said to be in an agency's hands leaked in 2017 and were reused in WannaCry and NotPetya.
• Commercial spyware is built to be sold. Researchers have documented its use against journalists, activists and officials. The vendor NSO Group says it investigates credible claims of misuse and disputes parts of the reporting.
• Courts and trade rules now treat the commercial side as a company that can be sued and restricted. In WhatsApp v. NSO Group a jury awarded about $167.7 million in 2025, a judge cut the punitive part to $4 million and issued an injunction, and NSO is appealing.
• For a person at risk, the practical difference is limited. For an examiner, a device rarely shows which model a tool belongs to, and a clean indicator check says less for tools that have no public indicators.

Two ways a capability reaches the world

Hacking tools at the top end are alike in what they can do. They differ in who makes them, who may use them, and what happens when control is lost. In this article, an in-house tool is one that an agency builds or acquires for its own operations. A commercial tool is one that a company builds as a product and licenses to government customers. The labels are a lens. A government can buy a commercial tool, an agency can buy exploits from a broker, and the same weakness in a phone can be used by either. We use the labels to ask where the failures came from in the cases below.

The in-house model: Stuxnet

Stuxnet is the best known example of a tool built for a single purpose. Symantec's 2011 analysis describes it as a threat targeting a specific industrial control system, likely in Iran, with the goal of sabotaging a facility by reprogramming its controllers [1]. The New York Times reported in 2012, citing current and former officials, that it was part of a joint American and Israeli program against Iran's nuclear effort [2] [3]. Neither the dossier nor this article rests on an official acknowledgement, and we cite none.

The record also shows what a narrow aim did not prevent. Symantec monitored the code's control servers from 20 July 2010 and, as of 29 September 2010, counted about 100,000 infected hosts, over 40,000 unique external addresses in more than 155 countries, and about 60 percent of infected hosts in Iran [1]. The Times reported that officials blamed an error in the code for letting it spread beyond its target [2] [3]. So a tool built for one target and never sold still reached computers far beyond it. Whether anyone intended that is not something these sources can show.

When an in-house tool leaks

The second failure of the in-house model is theft or leakage. In April 2017 a group calling itself the Shadow Brokers published what it described as data from the U.S. National Security Agency. Rapid7's analysis at the time says the material included Windows exploits, and that four of them, including the one called EternalBlue, used vulnerabilities that Microsoft had patched the previous month; Rapid7 calls the NSA link "alleged" [5]. Microsoft's bulletin MS17-010, published on 14 March 2017, was the patch [4].

In May 2017 the WannaCry ransomware spread using an exploit of that kind. Microsoft's president Brad Smith wrote that the exploits used had been stolen from the NSA, that a fix had been issued about a month earlier, and that many computers were still unpatched two months after it; he called on governments to report vulnerabilities to vendors rather than stockpile them [6]. On 19 December 2017 the governments of the United States, Australia, Canada, Japan and the United Kingdom attributed WannaCry to North Korea, which denies it; the U.S. Justice Department filed criminal charges in September 2018 [7]. In June 2017 the NotPetya malware followed. On 15 February 2018 the White House said the Russian military was responsible and called it the most destructive and costly cyber-attack in history [8]. WIRED reported a U.S. government assessment of more than $10 billion in total damage, and that NotPetya also used the EternalBlue exploit [9].

The lesson here is about timing and patching. The leaked exploits targeted flaws that had already been fixed, and the harm fell on systems that had not been updated. A leak turns a capability that one agency held into a tool anyone can reuse. Figure 1 gives the order of events.

The commercial model: Pegasus

Pegasus is the spyware sold by the Israeli company NSO Group. An early and widely read public analysis was Citizen Lab's report of 25 August 2016 on an attack against the human rights defender Ahmed Mansoor in the United Arab Emirates. The researchers, working with Lookout, found a chain of previously unknown iPhone flaws, tied the links to NSO Group, and assessed with caution that the UAE government was probably responsible [10]. Apple fixed the flaws in iOS 9.3.5 [10].

In July 2021 Forbidden Stories, Amnesty International and media partners published the Pegasus Project. It was based on a leaked list of 50,000 phone numbers of potential surveillance targets. Amnesty describes the numbers as selected for potential targeting and not as confirmed infections, and says the consortium also found numbers of suspected criminals [11]. NSO denied the report's claims, said its technology was not associated with the murder of Jamal Khashoggi, and said it would continue to investigate credible claims of misuse [11]. In El Salvador, researchers confirmed Pegasus on the phones of 35 people, and the presidential communications office said the country is not an NSO customer, according to ICIJ [12].

Commercial tools are not an exotic corner. In February 2024 Google's Threat Analysis Group reported that commercial surveillance vendors were behind about half of the known zero-day exploits it saw targeting Google products and Android devices, and that it tracked around 40 such vendors [16]. That is Google's count for its own products and the devices it can see, not a measure of the whole market.

Courts, export controls and agreements

Because the commercial model is a company, ordinary law reaches it. The record so far, stated as it stands in the sources:

• WhatsApp v. NSO Group. In December 2024 the judge, Phyllis Hamilton of the U.S. District Court for the Northern District of California, ruled for WhatsApp, finding that NSO had violated U.S. and California anti-hacking laws and had not complied with orders to produce evidence [13]. On 6 May 2025 a jury awarded $444,719 in compensatory damages and nearly $167.3 million in punitive damages, for about 1,400 WhatsApp users, according to CyberScoop [13]. In October 2025 the judge cut the punitive award to $4 million and issued a permanent injunction against NSO targeting WhatsApp and its users. The injunction does not cover NSO's customers and is limited to WhatsApp [14]. NSO called the reduction a step in the right direction and said the remaining sum is still disproportionately high [14]. NSO appealed, and the Knight First Amendment Institute's case page shows the briefing complete in July 2026 and the case awaiting an argument date [15]. In June 2026 Meta asked the court to hold NSO in contempt, alleging a phishing campaign aimed at WhatsApp users. These are allegations, and NSO did not respond to CyberScoop's request for comment [17].
• Export controls. On 3 November 2021 the U.S. Commerce Department added NSO Group and the Israeli company Candiru to the Entity List, saying they had developed and supplied spyware to foreign governments that used it to target officials, journalists, businesspeople, activists, academics and embassy workers [18]. TechCrunch reported in January 2026 that NSO has lobbied to have the restrictions lifted and that critics say it wants to enter the U.S. market; we did not check the current status of the list [19].
• U.S. government use. Executive Order 14093 of 27 March 2023 bars federal agencies from operational use of commercial spyware that poses significant counterintelligence, security or improper-use risks [20]. We could not confirm whether the order remains in force and make no claim about it today.
• International agreement. The Pall Mall Process Code of Practice for States, launched in Paris on 3 and 4 April 2025, is voluntary and addresses states: it sets out commitments for the development, facilitation, purchase and use of commercial cyber intrusion capabilities. The U.K. government page lists the United States among supporters from 11 April 2025 [21]. It addresses what states do, not only what vendors sell.

The two models side by side

Figure 2 summarizes the cases above. It is the Lab's reading of a handful of documented cases, not a general law, and each cell points to its source.

What this means for risk and for an examiner

This section is the Lab's own reading, as a mobile forensics research lab.

For a person at risk

Most people are not a target of either kind. For those who are, such as journalists, activists, politicians, diplomats and their staff, the difference between the two models matters less than the steps that follow: keep the phone and its software up to date as the maker advises (unless an examination is pending, see the note on updates in LAB-0020), use the protective modes a maker offers for people at high risk, and get expert help if you have a warning or a reason to suspect. LAB-0020 covers that sequence. The El Faro and Pegasus cases show that a tool sold to many customers can still be aimed at a small, specific group.

For an examiner

A commercial product used in many places can leave traces that researchers publish after one campaign and that other examinations can then look for. The Mobile Verification Toolkit was released by Amnesty International's Security Lab in July 2021 in the context of the Pegasus Project [22], and published indicators are what such tools check against. A tool with no public indicators cannot be checked this way, so a clean result against known indicators says less. That is why an examiner reports what was checked and does not report "clean" (LAB-TR-0034).

An examiner also cannot usually say, from a phone, whether a tool was an in-house or a commercial one, or which government used it. Apple says it does not attribute the attacks behind its notifications [23]. Attribution rests on outside evidence and carries stated confidence, as in Citizen Lab's 2016 assessment that the UAE was probably responsible [10]. Treat any statement of "who" as a separate claim from "what was found".

What this article does not claim

References

Pages were read on 8 November 2026, except three that the Lab's tools could not open and that are cited from search-result summaries only (references 2, 3 and 9: the New York Times, NPR and WIRED pages); treat their details with that in mind. Reference 18, the Commerce press release, was read in full on 9 November 2026. Details in the source material we could not verify were left out, including claims about the number of people infected over time, the age of the exploit inside the agency, and individual cases outside the cited reports.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related