The Commerce Department has placed two European-based Israeli-owned spyware companies on its trade blacklist because of national security concerns.
Intellexa S.A. in Greece, its entity Intellexa Limited in Ireland, and Cytrox AD in North Macedonia, along with its entity Cytrox Holdings Crt in Hungary, were added to the technology export blacklist, the department said in a July 18 statement.
The blacklisting means that the companies will no longer be able to conduct business or make transactions with U.S. companies. This significantly reduces a company’s ability to access commodities, software, and technology that it could use to develop surveillance tools that could be misused, or conduct activities contrary to the national security or foreign policy interests of the United States.
Officials said the move was based on a determination that the companies had engaged in “trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.”
The companies join Israeli-owned Candiru, a Tel Aviv-based technology company, and NSO Group, based in Herzliya, Israel, which has faced continuous criticism over its Pegasus spyware and its alleged spying activities, on the blacklist.
Both companies were placed on the list in 2021.
“The proliferation of commercial spyware poses distinct and growing counterintelligence and security risks to the United States, including to the safety and security of U.S. government personnel and their families,” the Commerce Department said in its statement.
Repression, Human Rights Abuses
The proliferation of commercial spyware has had an even broader impact, according to the Commerce Department.
“The misuse of these tools globally has also facilitated repression and enabled human rights abuses, including to intimidate political opponents and curb dissent, limit freedom of expression, and monitor and target activists and journalists,” the department said.
According to its website, Intellexa develops and integrates technologies to “empower LEAs [law enforcement agencies] and intelligence agencies to help protect communities.”
Cytrox doesn’t appear to have a website.
Both companies have been linked to a number of alleged surveillance incidents, according to reports.
Cytrox’s “predator” spyware was used to hack the mobile phone of Ayman Nour, an Egyptian politician living in exile in Turkey, as well as an unnamed Egyptian television journalist, according to the Citizen Lab at the University of Toronto, which studies human rights and global security.
Additionally, one of the company’s products was reportedly used by the Greek government to hack the cellphone of a former Meta security executive.
Meanwhile, Intellexa was fined 50,000 euros ($56,129) by the Data Protection Authority in Greece in January for failing to cooperate with an ongoing investigation into the use of spyware that was allegedly used to spy on high-ranking Greek officials.
US Cracking Down on Spyware
In a statement at the time, the Hellenic Data Protection Authority (HDPA) said it had “performed an on-site inspection at Intellexa’s premises but such premises were completely empty and without a functional network infrastructure or IT system.”
“Additionally, the HDPA noted that Intellexa had failed to provide all the information requested by the HDPA during the auditing process,” the statement read.
The relationship between Intellexa and Cytrox is unknown.
“We remain laser-focused on stemming the proliferation of digital tools for repression,” Undersecretary of Commerce Alan Estevez, who heads the Bureau of Industry and Security, said in a July 18 statement. “Considering the impact of surveillance tools and other technologies on international human rights, I am pleased to announce these additions to our Entity List.”
The latest bans on Intellexa and Cytrox are part of a “government-wide effort to counter the risks posed by commercial spyware,” the Commerce Department said.
In March, the White House issued an executive order prohibiting the U.S. government’s use of commercial spyware that poses risks to national security or has been misused by foreign actors to enable human rights abuses.
The Biden administration has also released guiding principles on governmental use of surveillance technologies and is actively working with the governments of Australia, Canada, Costa Rica, Denmark, France, New Zealand, Norway, Sweden, Switzerland, and the UK, to ensure strict domestic and international controls to prevent the misuse of commercial spyware.
