Surreptitious Spyware versus Insider Risk Management

On Monday, President Biden signed an executive order limiting the purchase and use of commercial spyware by U.S. government departments and agencies. While the new order doesn’t entirely prohibit spyware, it lays out the criteria for which uses could be disqualified; and suggests that a case-by-case basis review will be required to allow agencies to acquire the technology for nonoperational uses, such as testing it for research or cybersecurity purposes.

This new executive order is part of an effort to improve cybersecurity and protect against malicious cyber activity. More specifically, it is to get ahead of the problem and set standards for other governments and its allies, which buy and deploy commercial spyware. It is also intended to ensure that government agencies are not engaging in activities that could be used to target and exploit vulnerable individuals or organizations.

Important to note, the directive targets spyware, not the array of cybersecurity tools commonly deployed within federal or local government or enterprise organizations for mitigating external or internal threats.