Counting Government Spyware for the First Time
The FBI has used hacking tools and spyware since at least 1998, and in all that time nobody outside the government has known how often. That gap is closing, at least for the narrow case where spyware is used to tap someone’s live communications. Starting with the 2028 Wiretap Report, the US judiciary will publish how many times judges authorised wiretaps carried out with hacking tools, a category federal agencies call network investigative techniques, or NITs.
Key Takeaways
- The Administrative Office of the US Courts told Senator Ron Wyden this week that it will begin tracking a new “spyware/hacking” category in the 2028 report, which appears the following year.
- The count covers only interception of live communications, including calls and messages on services such as Signal and WhatsApp. Remotely breaking into a phone to extract stored files, images or location history is legally a search and stays uncounted.
- Privacy groups describe the change as overdue, and note that other countries already publish similar figures. Italy recorded spyware use against 4,321 targets in 2023.
What the Wiretap Report Already Covers
The Administrative Office coordinates operations across the federal judiciary and has issued annual Wiretap Reports for close to two decades. Each edition sets out how many wiretaps were authorised, split by federal or state judges, by state, by the crime under investigation and by other measures.
The reports also break intercepts down by type. Audio wiretaps capture live voice from phone calls. Oral taps rely on physical microphones and other eavesdropping methods. Electronic taps collect text messages, emails and other communications as they cross a provider’s network. The new category will add spyware to that structure.
Wiretaps carry a high evidentiary bar, because they are among the most invasive tools available to police. A judge has to be persuaded that a crime is under way before authorising one, which keeps the annual totals far below search warrant numbers. Scale is still possible. One wiretap years ago supported a surveillance operation that swept up millions of text messages across three months.
Why the Numbers Take Until 2029
An Administrative Office spokesperson explained the lag in an emailed statement. “The Wiretap Report is compiled from individual forms submitted from throughout the country and throughout the year. Before the new data can appear in the annual report, reporting forms and procedures need to be updated to accommodate the new categories,” the spokesperson said.
The full timeline runs long. The change was agreed in 2026, applies to data collected during 2028, and reaches the public in 2029.
A Decade-Long Request
Wyden has pressed for this since 2017, criticising what he called “the unnecessary secrecy around electronic surveillance orders.” He welcomed the decision while pointing past it.
“The American people remain largely in the dark about the different ways that the government is spying on them,” Wyden said in a statement. “I am thankful that the federal courts agreed to collect and publish data about hacking, but Congress must go further and pass my Government Surveillance Transparency Act,” referring to a draft bill he and others reintroduced earlier this year.
Privacy researchers put the value plainly. “Up until now, we have only been able to guess at the size of the problem,” said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and a specialist in government spyware. Once the figures are public, she said, denial becomes harder. “Being able to point to a report saying that spyware was used X number of times will help with accountability, especially if it turns out that number is quite high,” Galperin added. “It’s hard to say that you’re using spyware as a surgical tool when you’ve deployed it tens of thousands of times.”
Brett Max Kaufman, a senior counsel at the American Civil Liberties Union’s Center for Democracy, called the change “an important and long-overdue step forward for transparency around government hacking and should lead to better-informed policy and law around these issues going forward.”
What the Number Will and Will Not Show
The figure that lands in 2029 will be a floor rather than a total. It captures interception only. The far more common scenario, where investigators use a forensic tool to open a seized device and pull out what is stored inside, falls under search authority and still has no equivalent public tally. That distinction matters because the extraction category has been growing on its own, with purpose-built software for pulling data out of phones already in custody spreading through police forces well beyond the United States.
Context also comes from the existing reports. The most recent annual tally, covering intercepts concluded during 2025, recorded 1,735 authorised wiretaps, down 24 percent from 2,297 the year before, at an average cost of $92,963 each. A spyware line inside that structure will show what share of a shrinking practice now runs on hacking tools rather than provider cooperation.
The disclosure arrives while the market it measures keeps leaking. Exploit toolkits sold to government clients have turned up far from their intended buyers, including cases where the same iPhone exploit chain moved from a surveillance vendor to a suspected state espionage group to financial scam sites. Researchers have repeatedly traced commercial spyware vendors’ work resurfacing inside state hacking campaigns, and ordinary criminals now reach comparable data with malware dressed up as a routine phone update. Wyden made an earlier request for basic statistics on government hacking back in 2022 and got nowhere. Publishing a count will not settle whether these tools are used proportionately. It will simply make the argument possible.
Written by Vytautas Valinskas
