U.S. Sanctions Predator Spyware-Maker Targeting Journalists, Officials, Strips Technology Access to Safeguard Human Rights

By Moon Harper

Mar 06, 2024 12:24 AM EST

On Tuesday, the Treasury Department declared sanctions against two individuals and a Greece-based commercial spyware firm led by a former Israeli military officer that developed, operated, and distributed technology to target U.S. government officials, journalists, and policy experts.

The Treasury Department's First Sanction Imposed on Improper Use of Spyware

The United States has imposed sanctions on the Intellexa Consortium, accused of selling and disseminating commercial spyware and surveillance tools for targeted and mass surveillance endeavors. Other entities linked with Intellexa, such as Cytrox AD in North Macedonia, Cytrox Holdings ZRT in Hungary, and Thalestris Limited in Ireland, have also been sanctioned for their involvement in creating and disseminating a suite of tools called Predator.

According to Biden administration officials, this marks the Treasury Department's inaugural sanctioning of individuals or organizations for the improper use of spyware.

Spyware: Predator

Predator is a spyware tool that enables the infiltration of electronic devices via zero-click attacks, requiring no user interaction for infection. It has been utilized in numerous countries, facilitating unauthorized data extraction, geolocation tracking, and access to personal information on compromised devices.

U.S Commitment to Safeguarding Human Rights

Brian Nelson, Treasury's undersecretary for terrorism and financial intelligence, highlighted that today's measures signify progress in deterring the misuse of commercial surveillance tools, which pose a growing security threat to the United States and its citizens. He emphasized the U.S. commitment to establishing clear guardrails for the responsible development and use of such technologies while safeguarding human rights and civil liberties globally.

Last year, the Commerce Department placed Intellexa and Cytrox on its blacklist, barring them from accessing U.S. technology.

Series of Spyware's Threat

In October, Amnesty International's Security Lab released a report revealing that Predator had been utilized to target but not necessarily infect devices connected to the President of the European Parliament, Roberta Metsola, the President of Taiwan, Tsai Ing-Wen, U.S. Congressman Michael McCaul, and Senator John Hoeven, R-N.D.

Europe has also experienced several spyware incidents, notably in Greece, where Predator spyware was reportedly employed and led to the resignation in 2022 of two high-ranking government officials, including the national intelligence director.

Researchers at the University of Toronto's Citizen Lab uncovered Predator spyware on the iPhone of a prominent exiled Egyptian dissident in December 2021, where it revealed that Cytrox had clients in various countries, including Armenia, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia, through a collaborative investigation with Facebook.

Further Visa Restrictions Imposition

Intellexa was established in 2019 by former Israeli military officer Tal Dilian and Sara Hamou, a corporate off-shoring specialist who has rendered managerial services to Intellexa, which was also subjected to sanctions.

John Scott-Railton, a senior researcher at Citizen Lab, described the sanctions as America's major escalation initiative to curb the proliferation of mercenary spyware.

The sanctions against the developers of Predator follow the recent introduction of a new policy by the Biden administration, enabling the imposition of visa restrictions on foreign individuals engaged in the misuse of commercial spyware.

The visa policy introduced by the Democratic administration extends to individuals who misuse commercial spyware, targeting journalists, activists, perceived dissidents, members of marginalized communities, or their family members. According to officials, the visa restrictions may encompass individuals who facilitate or profit from the misuse of such spyware.