Senator Wyden Urges GAO Investigation Into FBI, DEA, ICE and Secret Service Use of Hacking Tools and Spyware

TL;DR

• Senator Ron Wyden has formally asked the Government Accountability Office to launch a wide-ranging review of how four major federal law enforcement agencies acquire and deploy hacking tools and commercial spyware against people in the U.S.
• The proposed probe would examine the FBI, the Drug Enforcement Administration, ICE Homeland Security Investigations, and the Secret Service, focusing on their procurement practices, legal justifications, and internal oversight.
• Driven by growing civil liberties concerns over warrantless surveillance and secretive spyware contracts, the investigation could force new transparency and accountability standards for federal hacking operations.

A Push for Transparency on Federal Hacking

Senator Ron Wyden (D-Ore.), a longtime critic of warrantless government surveillance, is pressing for a new level of independent oversight into how federal law enforcement hacks into phones, computers, and other devices. In a letter sent this month to Comptroller General Gene Dodaro, who heads the Government Accountability Office, Wyden requested a comprehensive review of the hacking tools and commercial spyware currently in use across the federal government.

The request marks one of the most ambitious congressional efforts yet to bring the government's rapidly expanding hacking capabilities under independent scrutiny. While federal agencies have acknowledged using network investigative techniques and other forms of lawful hacking for years, the full scale of their reliance on commercial spyware and zero-day exploits has remained largely shielded from public and congressional oversight.

Why Wyden Is Demanding Answers Now

Wyden's call for a GAO investigation comes amid mounting concern over the unchecked proliferation of powerful commercial spyware. Tools developed by companies like NSO Group (Pegasus), Intellexa (Predator), and Paragon Solutions (Graphite) have been shown to provide near-total access to a target's device, including encrypted messages, photos, location data, and microphone and camera feeds, often without any user interaction.

While these tools were initially marketed for counterterrorism and targeting foreign adversaries, investigations by journalists and civil liberties groups have revealed their use by U.S. law enforcement in domestic criminal investigations. Previous disclosures have shown the FBI explored and tested NSO Group's Pegasus system, and other agencies have reportedly purchased similar capabilities through intermediaries and contractors, making it difficult to track spending and usage.

Wyden argues that existing oversight mechanisms have failed to keep pace. His office has pointed to inconsistent disclosure to Congress and the courts, vague legal authorities, and a lack of clear, government-wide rules governing when and how these invasive tools can be deployed against Americans.

The Four Agencies Under the Microscope

The proposed GAO probe specifically names four components of the Department of Justice and the Department of Homeland Security:

• The Federal Bureau of Investigation, which has the most extensive and well-documented history of using hacking tools, including network investigative techniques authorized by Rule 41 and its past evaluation of Pegasus.
• The Drug Enforcement Administration, which has faced questions about its use of advanced surveillance and data collection tools in drug trafficking cases with limited judicial oversight.
• ICE Homeland Security Investigations, the investigative arm of Immigration and Customs Enforcement, which has quietly expanded its digital surveillance portfolio in recent years.
• The United States Secret Service, whose use of hacking and spyware tools has received far less public attention but falls within the same DHS oversight structure.

Wyden is asking the GAO to examine each agency's entire lifecycle of spyware use, from procurement and contracting to operational deployment and data retention.

The Scope of the Proposed GAO Probe

According to details of the request, Wyden wants the GAO to answer several key questions that have so far gone unanswered. The investigation would audit how agencies purchase hacking tools, including whether they use open contracts, shell companies, or third-party vendors to obscure acquisitions.

It would also review the legal authorities agencies claim for deploying spyware, whether they consistently obtain probable-cause warrants, and how they interpret existing wiretap and computer fraud statutes to justify remote device searches.

A third pillar of the review would focus on internal safeguards: what policies govern who can approve spyware use, how data collected from infected devices is stored and shared, what auditing exists to prevent abuse, and whether agencies notify courts and defendants when spyware-derived evidence is used in prosecutions.

Finally, Wyden has asked the GAO to assess whether agencies have complied with existing notification requirements to Congress and whether current Department of Justice and DHS guidance is sufficient to protect Americans' Fourth Amendment rights.

Civil Liberties and the Oversight Gap

Privacy advocates and civil liberties groups have quickly backed the push for an independent review. Organizations including the American Civil Liberties Union and the Electronic Frontier Foundation have long warned that commercial spyware is fundamentally incompatible with traditional notions of targeted, narrowly-scoped searches. Unlike a conventional wiretap, spyware can sweep up years of personal data in a single operation, creating what critics call a digital general warrant.

The concern is compounded by a lack of transparency. Unlike other surveillance authorities that require annual reporting to Congress, there is no centralized, public accounting of how often federal law enforcement uses hacking tools, how much taxpayer money is spent on them, or how many Americans have been affected. Wyden has argued this secrecy prevents meaningful oversight and leaves courts without the information needed to evaluate the constitutionality of the searches.

Supporters of the review also point to the risk of mission creep. As spyware becomes cheaper and more widely available, there are fears it could shift from being a tool of last resort in serious national security cases to a routine investigative technique for lower-level offenses.

What a GAO Investigation Could Mean for Federal Surveillance

If accepted, the GAO investigation would not have the power to ban the use of spyware outright, but its findings could be transformative. GAO reports carry significant weight in Congress and often serve as the factual basis for new legislation, appropriations restrictions, and agency reforms.

A comprehensive audit could force the agencies to publicly disclose their policies for the first time, establish government-wide standards for warrant requirements and data minimization, and create new reporting obligations to Congress and the judiciary. It could also lead to recommendations for stricter procurement rules, including mandatory disclosure of commercial spyware contracts and prohibitions on purchasing tools from vendors with histories of human rights abuses.

For the tech industry and the public, increased accountability could mean clearer legal boundaries around device hacking and stronger protections against the silent compromise of personal devices. For law enforcement, it could mean new procedural hurdles but also clearer, more defensible legal footing for investigations that do rely on hacking.

The GAO has not yet formally announced whether it will open the review, but Wyden's request puts significant pressure on the watchdog to act. As commercial spyware capabilities continue to advance, the outcome of this push could determine whether federal hacking remains a largely secret practice or finally faces sustained, independent oversight.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.