Fast Facts

• US investment in spyware firms nearly tripled in 2024, with 31 American investors identified versus 11 last year.
• The US is now the largest investor in the global spyware market, surpassing Israel and Italy.
• Some US-backed firms are linked to spyware targeting journalists and civil society members across multiple countries.
• Apple’s upcoming iPhone 17 will introduce new security features designed specifically to combat spyware threats.
• Complex webs of resellers and brokers make the spyware supply chain more secretive and harder to regulate.

The New Gold Rush: Spyware’s American Backers

Picture the spyware industry as a high-stakes chessboard - pieces shifting in shadows, kings and queens hidden behind layers of shell companies. This year, a new player has stepped into the spotlight: American capital. According to a fresh report from the Atlantic Council, the number of US-based investors funding spyware companies has nearly tripled in 2024, climbing from 11 to 31. The US has leapfrogged Israel and Italy to become the world’s largest financial backer of these controversial surveillance tools.

This surge is especially striking given Washington’s own efforts to rein in the spyware trade. In recent years, the US government has imposed sanctions, blacklisted companies, and restricted visas for executives tied to spyware abuse. Yet, while the left hand cracks down, the right hand signs checks: American private equity and venture funds are pouring resources into firms whose products have been linked to surveillance of journalists, activists, and even government officials worldwide.

From Florida to the Frontlines of Surveillance

The Atlantic Council’s investigation reveals that Florida-based AE Industrial Partners acquired Paragon, whose Graphite spyware was allegedly used to target 90 WhatsApp users - including civil society members - in more than two dozen countries. Meanwhile, Integrity Partners invested in Saito Tech Ltd, the makers of Candiru spyware, even after the US Commerce Department added the company to its Entity List in 2021 for activities deemed a threat to national security.

These moves highlight a glaring contradiction: US investors are bankrolling companies that Washington itself has flagged as dangerous. The logic is simple - spyware firms are lucrative, and the demand for digital surveillance tools is booming from Panama to Malaysia. But the risks are profound: every dollar invested helps build more sophisticated tools for digital intrusion and espionage.

The Opaque Web: Brokers, Resellers, and Global Expansion

The spyware market isn’t just growing; it’s mutating. The Atlantic Council notes a rise in new vendors, suppliers, and, crucially, resellers and brokers. These middlemen add layers of secrecy, creating a tangled web that shields spyware firms from scrutiny and regulation. With corporate structures stretched across multiple jurisdictions, tracing ownership or enforcing accountability becomes a game of digital whack-a-mole.

The global reach of spyware is also expanding. New players have emerged in Japan, Malaysia, and Panama, with at least four new vendors and ten new suppliers surfacing in the past year alone. As the market sprawls, so do the challenges for law enforcement and policymakers.

Tech Fights Back: Apple’s New Armor

In a rare move, Apple has acknowledged the gravity of the spyware threat. The upcoming iPhone 17 will introduce Memory Integrity Enforcement (MIE), a technical safeguard designed to make it far harder for spyware to burrow into the device. It’s a digital shield, forged in response to attack methods uncovered by Apple’s own offensive research team. While no security is perfect, Apple hopes MIE will limit the “degrees of freedom” attackers have, making high-end spyware campaigns significantly more difficult.

WIKICROOK

• Spyware: Spyware is software that secretly monitors or steals information from your device without your consent, putting your privacy and data at risk.
• Entity List: The Entity List is a US government list of foreign entities restricted from receiving certain exports due to national security or policy concerns.
• Reseller: A reseller buys products or services, such as cybersecurity tools, from suppliers and sells them to end users, often masking the original source.
• Memory Integrity Enforcement (MIE): Memory Integrity Enforcement is a security feature that prevents hackers from exploiting device memory, making it harder for malware or spyware to take hold.
• Shell Company: A shell company is a business entity with no real operations or assets, often used to hide money flows or obscure the true owners of assets.